CVE-2012-4596

CVE-2012-4596 is a directory traversal vulnerability in McAfee Email Gateway (MEG) 7.0.0 and 7.0.1 . The issue allows remote authenticated users to bypass access restrictions and download arbitrary files via a crafted URL, potentially impacting confidentiality. The documents explicitly describe t...

CVE-2012-4580

The CVE-2012-4580 issue affects McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0 before Patch 1. It is a cross-site scripting (XSS) vulnerability that allows a remote attacker to inject arbitrary web script or HTML via vectors r...

CVE-2012-4584

McAfee products affected: Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3; McAfee Email Gateway (MEG) 7.0 before Patch 1. The issue: backups are not properly encrypted, enabling remote authenticated users to read a backup file and obtain sensitive data such as password ...

CVE-2012-4595: Improper Authentication

McAfee Email and Web Security EWS 5.5 through Patch 6 and 5.6 through Patch 3, and McAfee Email Gateway MEG 7.0.0 and 7.0.1, allows remote attackers to bypass authentication and obtain an admin session ID via unspecified vectors...

PT-2012-5494

Name of the Vulnerable Software and Affected Versions McAfee Email and Web Security EWS versions 5.x through 5.5 before Patch 6 McAfee Email and Web Security EWS version 5.6 before Patch 3 McAfee Email Gateway MEG version 7.0 before Patch 1 Description The issue allows remote authenticated users ...

PT-2012-5492

Name of the Vulnerable Software and Affected Versions McAfee Email and Web Security EWS versions 5.x through 5.5 before Patch 6 McAfee Email and Web Security EWS version 5.6 before Patch 3 McAfee Email Gateway MEG version 7.0 before Patch 1 Description The issue allows remote authenticated users ...

PT-2012-5504

Name of the Vulnerable Software and Affected Versions McAfee Email Gateway versions 7.0.0 through 7.0.1 Description A directory traversal issue allows remote authenticated users to bypass access restrictions and download arbitrary files via a crafted URL. Recommendations For versions 7.0.0 and...

CVE-2012-4583: Exposure of Sensitive Information to an Unauthorized Actor

McAfee Email and Web Security EWS 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway MEG 7.0 before Patch 1, allows remote authenticated users to obtain the session tokens of arbitrary users by navigating within the Dashboard...

CVE-2012-4581: Improper Authentication

McAfee Email and Web Security EWS 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway MEG 7.0 before Patch 1, does not disable the server-side session token upon the closing of the Management Console/Dashboard, which makes it easier for remote attackers to hijack sessions by...

CVE-2012-4586: Undefined Security Weakness

McAfee Email and Web Security EWS 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway MEG 7.0 before Patch 1, accesses files with the privileges of the root user, which allows remote authenticated users to bypass intended permission settings by requesting a file...

CVE-2012-4585: Undefined Security Weakness

McAfee Email and Web Security EWS 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway MEG 7.0 before Patch 1, allows remote authenticated users to read arbitrary files via a crafted URL...

PT-2012-5503

Name of the Vulnerable Software and Affected Versions McAfee Email and Web Security EWS versions 5.5 through Patch 6 McAfee Email and Web Security EWS versions 5.6 through Patch 3 McAfee Email Gateway MEG version 7.0.0 McAfee Email Gateway MEG version 7.0.1 Description The issue allows remote...

CVE-2012-4596: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in McAfee Email Gateway MEG 7.0.0 and 7.0.1 allows remote authenticated users to bypass intended access restrictions and download arbitrary files via a crafted URL...

PT-2012-5488

Name of the Vulnerable Software and Affected Versions McAfee Email and Web Security EWS versions 5.x through 5.5 before Patch 6 McAfee Email and Web Security EWS version 5.6 before Patch 3 McAfee Email Gateway MEG version 7.0 before Patch 1 Description A cross-site scripting XSS issue allows remo...

PT-2012-5489

Name of the Vulnerable Software and Affected Versions McAfee Email and Web Security EWS versions 5.x through 5.5 before Patch 6 McAfee Email and Web Security EWS version 5.6 before Patch 3 McAfee Email Gateway MEG versions 7.0 before Patch 1 Description The issue is related to a "Logout Failure"...

PT-2012-5493

Name of the Vulnerable Software and Affected Versions McAfee Email and Web Security EWS versions 5.x through 5.5 before Patch 6 McAfee Email and Web Security EWS version 5.6 before Patch 3 McAfee Email Gateway MEG versions 7.0 before Patch 1 Description The issue allows remote authenticated users...

PT-2012-5505

Name of the Vulnerable Software and Affected Versions McAfee Email and Web Security EWS versions 5.5 through Patch 6 McAfee Email and Web Security EWS versions 5.6 through Patch 3 McAfee Email Gateway MEG version 7.0.0 McAfee Email Gateway MEG version 7.0.1 Description A cross-site scripting XSS...

PT-2012-5490

Name of the Vulnerable Software and Affected Versions McAfee Email and Web Security EWS versions 5.x through 5.5 before Patch 6 McAfee Email and Web Security EWS version 5.6 before Patch 3 McAfee Email Gateway MEG versions 7.0 before Patch 1 Description The issue allows remote authenticated users...

PT-2012-5491

Name of the Vulnerable Software and Affected Versions McAfee Email and Web Security EWS versions 5.x through 5.5 before Patch 6 McAfee Email and Web Security EWS version 5.6 before Patch 3 McAfee Email Gateway MEG versions 7.0 before Patch 1 Description The issue allows remote authenticated users...

CVE-2012-4582: Undefined Security Weakness

McAfee Email and Web Security EWS 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway MEG 7.0 before Patch 1, allows remote authenticated users to reset the passwords of arbitrary administrative accounts via unspecified vectors...