Vulnerabilities > Mcafee > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2010-05-28 | CVE-2010-2116 | Incorrect Permission Assignment FOR Critical Resource vulnerability in Mcafee Email Gateway and Secure Mail The web interface in McAfee Email Gateway (formerly IronMail) 6.7.1 allows remote authenticated users, with only Read privileges, to gain Write privileges to modify configuration via the save action in a direct request to admin/systemWebAdminConfig.do. | 6.5 |
| 2009-11-13 | CVE-2009-3566 | Cross-Site Scripting vulnerability in Mcafee Intrushield Network Security Manager 5.1.7.7/5.1.7.73 McAfee IntruShield Network Security Manager (NSM) before 5.1.11.8.1 does not include the HTTPOnly flag in the Set-Cookie header for the session identifier, which allows remote attackers to hijack a session by leveraging a cross-site scripting (XSS) vulnerability. | 4.3 |
| 2009-11-13 | CVE-2009-3565 | Cross-Site Scripting vulnerability in Mcafee Intrushield Network Security Manager 5.1.7.7/5.1.7.73 Multiple cross-site scripting (XSS) vulnerabilities in intruvert/jsp/module/Login.jsp in McAfee IntruShield Network Security Manager (NSM) before 5.1.11.6 allow remote attackers to inject arbitrary web script or HTML via the (1) iaction or (2) node parameter. | 4.3 |
| 2009-07-10 | CVE-2009-2429 | Credentials Management vulnerability in Mcafee Smartfilter 4.2.1.00 SmartFilter Web Gateway Security 4.2.1.00 stores user credentials in cleartext in admin_backup.xml files and uses insecure permissions for these files, which allows local users to gain privileges. | 4.6 |
| 2009-07-02 | CVE-2009-2312 | Cryptographic Issues vulnerability in Mcafee Smartfilter 4.2.1.00 SmartFilter Web Gateway Security 4.2.1.00 stores user credentials in cleartext in config.txt and uses insecure permissions for this file, which allows local users to gain privileges. | 4.6 |
| 2008-08-12 | CVE-2008-3605 | Permissions, Privileges, and Access Controls vulnerability in Mcafee Encrypted USB Manager 3.1.0.0 Unspecified vulnerability in McAfee Encrypted USB Manager 3.1.0.0, when the Re-use Threshold for passwords is nonzero, allows remote attackers to conduct offline brute force attacks via unknown vectors. | 6.8 |
| 2008-04-16 | CVE-2008-1855 | Resource Management Errors vulnerability in Mcafee CMA FrameworkService.exe in McAfee Common Management Agent (CMA) 3.6.0.574 Patch 3 and earlier, as used by ePolicy Orchestrator (ePO) and ProtectionPilot (PrP), allows remote attackers to corrupt memory and cause a denial of service (CMA Framework service crash) via a long invalid method in requests for the /spin//AVClient//AVClient.csp URI, a different vulnerability than CVE-2006-5274. | 5.0 |
| 2008-03-17 | CVE-2008-1357 | USE of Externally-Controlled Format String vulnerability in Mcafee products Format string vulnerability in the logDetail function of applib.dll in McAfee Common Management Agent (CMA) 3.6.0.574 (Patch 3) and earlier, as used in ePolicy Orchestrator 4.0.0 build 1015, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in a sender field in an AgentWakeup request to UDP port 8082. | 5.4 |
| 2007-04-19 | CVE-2007-2151 | Denial of Service vulnerability in McAfee E-Business Administration Server Authentication Packet The administration server in McAfee e-Business Server before 8.1.1 and 8.5.x before 8.5.2 allows remote attackers to cause a denial of service (service crash) via a large length value in a malformed authentication packet, which triggers a heap over-read. | 5.0 |
| 2007-03-02 | CVE-2007-1227 | Permissions, Privileges, and Access Controls vulnerability in Mcafee Virex 6.2 VShieldCheck in McAfee VirusScan for Mac (Virex) before 7.7 patch 1 allow local users to change permissions of arbitrary files via a symlink attack on /Library/Application Support/Virex/VShieldExclude.txt, as demonstrated by symlinking to the root crontab file to execute arbitrary commands. | 6.6 |