Vulnerabilities > Mcafee

DATE CVE VULNERABILITY TITLE RISK
2012-08-22 CVE-2012-4581 Improper Authentication vulnerability in Mcafee Email and web Security and Email Gateway
McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0 before Patch 1, does not disable the server-side session token upon the closing of the Management Console/Dashboard, which makes it easier for remote attackers to hijack sessions by capturing a session cookie and then modifying the response to a login attempt, related to a "Logout Failure" issue.
network
mcafee CWE-287
6.8
2012-08-22 CVE-2012-4580 Cross-Site Scripting vulnerability in Mcafee Email and web Security and Email Gateway
Cross-site scripting (XSS) vulnerability in McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0 before Patch 1, allows remote attackers to inject arbitrary web script or HTML via vectors related to the McAfee Security Appliance Management Console/Dashboard.
network
mcafee CWE-79
4.3
2012-08-22 CVE-2011-5101 Remote Security vulnerability in SaaS Endpoint Protection
The Rumor technology in McAfee SaaS Endpoint Protection before 5.2.4 allows remote attackers to relay e-mail messages via unspecified vectors, as demonstrated by relaying spam.
network
low complexity
mcafee
5.0
2012-08-22 CVE-2011-5100 Improper Authentication vulnerability in Mcafee Firewall Reporter 5.1.0.6
The web interface in McAfee Firewall Reporter before 5.1.0.13 does not properly implement cookie authentication, which allows remote attackers to obtain access, and disable anti-virus functionality, via an HTTP request.
network
low complexity
mcafee CWE-287
7.5
2012-08-22 CVE-2010-5143 Permissions, Privileges, and Access Controls vulnerability in Mcafee Virusscan Enterprise
McAfee VirusScan Enterprise before 8.8 allows local users to disable the product by leveraging administrative privileges to execute an unspecified Metasploit Framework module.
local
high complexity
mcafee CWE-264
2.6
2012-08-22 CVE-2010-3496 Permissions, Privileges, and Access Controls vulnerability in Mcafee Virusscan Enterprise 8.5I/8.7I
McAfee VirusScan Enterprise 8.5i and 8.7i does not properly interact with the processing of hcp:// URLs by the Microsoft Help and Support Center, which makes it easier for remote attackers to execute arbitrary code via malware that is correctly detected by this product, but with a detection approach that occurs too late to stop the code execution.
network
low complexity
mcafee CWE-264
6.4
2012-08-22 CVE-2009-5118 Unspecified vulnerability in Mcafee Virusscan Enterprise 7.1.0/8.0I/8.5I
Untrusted search path vulnerability in McAfee VirusScan Enterprise before 8.7i allows local users to gain privileges via a Trojan horse DLL in an unspecified directory, as demonstrated by scanning a document located on a remote share.
network
mcafee
critical
9.3
2012-08-22 CVE-2009-5117 Information Exposure vulnerability in Mcafee Host Data Loss Prevention 3.0.100.6/9.0.0.416
The Web Post Protection feature in McAfee Host Data Loss Prevention (DLP) 3.x before 3.0.100.10 and 9.x before 9.0.0.422, when HTTP Capture mode is enabled, allows local users to obtain sensitive information from web traffic by reading unspecified files.
local
mcafee CWE-200
1.9
2012-08-22 CVE-2009-5116 Improper Authentication vulnerability in Mcafee Linuxshield 1.5/1.5.1
McAfee LinuxShield 1.5.1 and earlier does not properly implement client authentication, which allows remote authenticated users to obtain Admin access to the statistics server by leveraging a client account.
network
low complexity
mcafee CWE-287
6.5
2012-08-22 CVE-2009-5115 Permissions, Privileges, and Access Controls vulnerability in Mcafee Common Management Agent
McAfee Common Management Agent (CMA) 3.5.5 through 3.5.5.588 and 3.6.0 through 3.6.0.608, and McAfee Agent 4.0 before Patch 3, allows remote authenticated users to overwrite arbitrary files by accessing a report-writing ActiveX control COM object.
network
low complexity
mcafee CWE-264
6.5