Authentication flaw

McAfee Email and Web Security EWS 5.5 through Patch 6 and 5.6 through Patch 3, and McAfee Email Gateway MEG 7.0.0 and 7.0.1, allows remote attackers to bypass authentication and obtain an admin session ID via unspecified vectors...

Design/Logic Flaw

McAfee Enterprise Mobility Manager EMM Agent before 4.8 and Server before 10.1, when one-time provisioning OTP mode is enabled, have an improper dependency on DNS SRV records, which makes it easier for remote attackers to discover user passwords by spoofing the EMM server, as demonstrated by a...

Cross site scripting

Cross-site scripting XSS vulnerability in McAfee Email and Web Security EWS 5.5 through Patch 6 and 5.6 through Patch 3, and McAfee Email Gateway MEG 7.0.0 and 7.0.1, allows remote attackers to inject arbitrary web script or HTML via vectors related to the McAfee Security Appliance Management...

Code injection

An unspecified ActiveX control in McAfee Virtual Technician MVT before 6.4, and ePO-MVT, allows remote attackers to execute arbitrary code or cause a denial of service Internet Explorer crash via a crafted web site...

Cross site request forgery (csrf)

The web interface in McAfee Firewall Reporter before 5.1.0.13 does not properly implement cookie authentication, which allows remote attackers to obtain access, and disable anti-virus functionality, via an HTTP request...

Design/Logic Flaw

The Rumor technology in McAfee SaaS Endpoint Protection before 5.2.4 allows remote attackers to relay e-mail messages via unspecified vectors, as demonstrated by relaying spam...

Code injection

McAfee VirusScan Enterprise before 8.8 allows local users to disable the product by leveraging administrative privileges to execute an unspecified Metasploit Framework module...

Design/Logic Flaw

Untrusted search path vulnerability in McAfee VirusScan Enterprise before 8.7i allows local users to gain privileges via a Trojan horse DLL in an unspecified directory, as demonstrated by scanning a document located on a remote share...

Authentication flaw

McAfee LinuxShield 1.5.1 and earlier does not properly implement client authentication, which allows remote authenticated users to obtain Admin access to the statistics server by leveraging a client account...

Code injection

McAfee Common Management Agent CMA 3.5.5 through 3.5.5.588 and 3.6.0 through 3.6.0.608, and McAfee Agent 4.0 before Patch 3, allows remote authenticated users to overwrite arbitrary files by accessing a report-writing ActiveX control COM object...

Design/Logic Flaw

The Web Post Protection feature in McAfee Host Data Loss Prevention DLP 3.x before 3.0.100.10 and 9.x before 9.0.0.422, when HTTP Capture mode is enabled, allows local users to obtain sensitive information from web traffic by reading unspecified files...

Code injection

McAfee Email and Web Security EWS 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway MEG 7.0 before Patch 1, allows remote authenticated users to read arbitrary files via a crafted URL...

Design/Logic Flaw

McAfee Email and Web Security EWS 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway MEG 7.0 before Patch 1, does not disable the server-side session token upon the closing of the Management Console/Dashboard, which makes it easier for remote attackers to hijack sessions by...

Design/Logic Flaw

McAfee Email and Web Security EWS 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway MEG 7.0 before Patch 1, allows remote authenticated users to reset the passwords of arbitrary administrative accounts via unspecified vectors...

Design/Logic Flaw

McAfee Email and Web Security EWS 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway MEG 7.0 before Patch 1, accesses files with the privileges of the root user, which allows remote authenticated users to bypass intended permission settings by requesting a file...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in About.aspx in the Portal in McAfee Enterprise Mobility Manager EMM before 10.0 might allow remote attackers to inject arbitrary web script or HTML via the 1 User Agent or 2 Connection variable...

Design/Logic Flaw

McAfee ePolicy Orchestrator ePO 4.6.1 and earlier allows remote authenticated users to bypass intended access restrictions, and obtain sensitive information from arbitrary reporting panels, via a modified ID value in a console URL...

Authentication flaw

McAfee SmartFilter Administration, and SmartFilter Administration Bess Edition, before 4.2.1.01 does not require authentication for access to the JBoss Remote Method Invocation RMI interface, which allows remote attackers to execute arbitrary code via a crafted .war file...

Design/Logic Flaw

McAfee Email and Web Security EWS 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway MEG 7.0 before Patch 1, does not properly encrypt system-backup data, which makes it easier for remote authenticated users to obtain sensitive information by reading a backup file, as...

CVE-2009-5117

The Web Post Protection feature in McAfee Host Data Loss Prevention DLP 3.x before 3.0.100.10 and 9.x before 9.0.0.422, when HTTP Capture mode is enabled, allows local users to obtain sensitive information from web traffic by reading unspecified files...