CVE-2012-4586

CVE-2012-4586 affects McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6, and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0 before Patch 1. The issue: remote authenticated users can cause a file request to be processed with root privileges, bypassing intended permission checks. T...

CVE-2012-4596

CVE-2012-4596 is a directory traversal vulnerability in McAfee Email Gateway (MEG) 7.0.0 and 7.0.1 . The issue allows remote authenticated users to bypass access restrictions and download arbitrary files via a crafted URL, potentially impacting confidentiality. The documents explicitly describe t...

CVE-2012-4597

The CVE-2012-4597 entry describes a cross-site scripting (XSS) vulnerability in McAfee Email and Web Security (EWS) 5.5 (through Patch 6) and 5.6 (through Patch 3), and McAfee Email Gateway (MEG) 7.0.0 and 7.0.1. The issue enables remote attackers to inject arbitrary web script or HTML via vector...

CVE-2012-4582

McAfee Email and Web Security EWS 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway MEG 7.0 before Patch 1, allows remote authenticated users to reset the passwords of arbitrary administrative accounts via unspecified vectors...

CVE-2012-4596

Directory traversal vulnerability in McAfee Email Gateway MEG 7.0.0 and 7.0.1 allows remote authenticated users to bypass intended access restrictions and download arbitrary files via a crafted URL...

CVE-2012-4585

CVE-2012-4585 affects McAfee Email and Web Security (EWS) 5.x prior to 5.5 Patch 6 and 5.6 prior to Patch 3, and McAfee Email Gateway (MEG) 7.0 prior to Patch 1. The vulnerability allows remote authenticated users to read arbitrary files via a crafted URL. The available documents do not provide e...

CVE-2012-4581

The vulnerability CVE-2012-4581 affects McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0 before Patch 1. The root cause is that the server-side session token is not invalidated when the Management Console/Dashboard is closed, en...

CVE-2012-4580

The CVE-2012-4580 issue affects McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0 before Patch 1. It is a cross-site scripting (XSS) vulnerability that allows a remote attacker to inject arbitrary web script or HTML via vectors r...

CVE-2012-4584

McAfee products affected: Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3; McAfee Email Gateway (MEG) 7.0 before Patch 1. The issue: backups are not properly encrypted, enabling remote authenticated users to read a backup file and obtain sensitive data such as password ...

McAfee WebShield Web UI Detection

WebShield Web UI included with products such as McAfee Email Gateway and McAfee Email and Web Security was detected on the remote host. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid58581; scriptversion"1.9"; scriptsetattributeattribute:"pluginmodificationdate",...

NGS00157 Patch Notification: McAfee Email and Web Security Appliance v5.6 - Password hashes can be recovered from a system backup and easily cracked

Medium Risk Vulnerability in McAfee Email and Web Security Appliance 29 March 2012 Ben Williams of NGS Secure has discovered a medium risk vulnerability in the McAfee Email and Web Security Appliance Impact: Active session tokens of other users are disclosed within the UI Versions affected: All...

CVE-2010-2116

The web interface in McAfee Email Gateway formerly IronMail 6.7.1 allows remote authenticated users, with only Read privileges, to gain Write privileges to modify configuration via the save action in a direct request to admin/systemWebAdminConfig.do...

CVE-2010-2116

The web interface in McAfee Email Gateway formerly IronMail 6.7.1 allows remote authenticated users, with only Read privileges, to gain Write privileges to modify configuration via the save action in a direct request to admin/systemWebAdminConfig.do...

CVE-2010-2116

The affected product is McAfee Email Gateway (formerly IronMail) version 6.7.1. The vulnerability is in the web interface, where remote authenticated users with only Read privileges can gain Write privileges by sending a direct request to admin/systemWebAdminConfig.do via the save action, allowin...

McAfee Email Gateway systemWebAdminConfig.do不安全访问控制漏洞

BUGTRAQ ID: 40255 McAfee Email Gateway之前名为IronMail，是企业级的硬件邮件网关和管理平台。 McAfee Email Gateway的systemWebAdminConfig.do配置文件没有执行正确的权限检查，拥有只读权限的Web Access用户可以通过在服务器响应的Form字段中添加HTML代码或发送特制POST请求执行写权限操作。 0 McAfee Email Gateway 6.7.1 厂商补丁： McAfee ------ 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

McAfee Email Gateway 6.7.1 - systemWebAdminConfig.do Remote Security Bypass

McAfee Email Gateway 6.7.1 - systemWebAdminConfig.do Remote Security Bypass source: https://www.securityfocus.com/bid/40255/info McAfee Email Gateway is prone to a security-bypass vulnerability because the web-based interface fails to properly perform user-profile checks. Attackers can exploit th...

McAfee Email Gateway - Web Administration Broken Access Control

McAfee Email Gateway - Web Administration Broken Access Control Advisory Name:Web Administration Broken Access Control in McAfee Email Gateway formerly IronMail Vulnerability Class: Broken Access Control Release Date: May 19, 2010 Affected Applications: Secure Mail Ironmail ver.6.7.1 Affected...

McAfee Email Gateway - Web Administration Broken Access Control

Advisory Name:Web Administration Broken Access Control in McAfee Email Gateway formerly IronMail Vulnerability Class: Broken Access Control Release Date: May 19, 2010 Affected Applications: Secure Mail Ironmail ver.6.7.1 Affected Platforms: FreeBSD 6.2 / Apache-Coyote 1.1 Local / Remote: Local...

McAfee Email Gateway 6.7.1 - 'systemWebAdminConfig.do' Remote Security Bypass

source: https://www.securityfocus.com/bid/40255/info McAfee Email Gateway is prone to a security-bypass vulnerability because the web-based interface fails to properly perform user-profile checks. Attackers can exploit this issue to bypass certain security restrictions to edit property and...

McAfee Email Gateway 6.7.2 Hotfix 2更新修复多个安全漏洞

BUGTRAQ ID: 39242 McAfee Email Gateway之前名为IronMail，是企业级的硬件邮件网关和管理平台。 McAfee Email Gateway的6.7.2 Hotfix 2之前版本中的多个漏洞允许本地用户导致拒绝服务、读取敏感信息、获得权限提升，或允许远程攻击者执行跨站脚本攻击。 1 处理CLI命令时的错误可能耗尽可用的系统资源。 2 由于没有正确地过滤提交给admin/queuedMessage.do页面的queueMsgType和QtnType参数，远程攻击者可以通过提交恶意请求执行跨站脚本攻击。 3...