CVE-2009-5115: Undefined Security Weakness

McAfee Common Management Agent CMA 3.5.5 through 3.5.5.588 and 3.6.0 through 3.6.0.608, and McAfee Agent 4.0 before Patch 3, allows remote authenticated users to overwrite arbitrary files by accessing a report-writing ActiveX control COM object...

CVE-2012-4581: Improper Authentication

McAfee Email and Web Security EWS 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway MEG 7.0 before Patch 1, does not disable the server-side session token upon the closing of the Management Console/Dashboard, which makes it easier for remote attackers to hijack sessions by...

CVE-2012-4586: Undefined Security Weakness

McAfee Email and Web Security EWS 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway MEG 7.0 before Patch 1, accesses files with the privileges of the root user, which allows remote authenticated users to bypass intended permission settings by requesting a file...

CVE-2012-4587: Undefined Security Weakness

McAfee Enterprise Mobility Manager EMM Agent before 4.8 and Server before 10.1, when one-time provisioning OTP mode is enabled, have an improper dependency on DNS SRV records, which makes it easier for remote attackers to discover user passwords by spoofing the EMM server, as demonstrated by a...

CVE-2012-4585: Undefined Security Weakness

McAfee Email and Web Security EWS 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway MEG 7.0 before Patch 1, allows remote authenticated users to read arbitrary files via a crafted URL...

PT-2012-5501

Name of the Vulnerable Software and Affected Versions McAfee Application Control and Change Control versions 5.1.x through 6.0.0 Description The issue allows local users to bypass authentication by executing a command due to the software not enforcing an intended password requirement in certain...

PT-2012-5504

Name of the Vulnerable Software and Affected Versions McAfee Email Gateway versions 7.0.0 through 7.0.1 Description A directory traversal issue allows remote authenticated users to bypass access restrictions and download arbitrary files via a crafted URL. Recommendations For versions 7.0.0 and...

PT-2012-5503

Name of the Vulnerable Software and Affected Versions McAfee Email and Web Security EWS versions 5.5 through Patch 6 McAfee Email and Web Security EWS versions 5.6 through Patch 3 McAfee Email Gateway MEG version 7.0.0 McAfee Email Gateway MEG version 7.0.1 Description The issue allows remote...

PT-2012-5507

Name of the Vulnerable Software and Affected Versions McAfee SmartFilter Administration versions prior to 4.2.1.01 McAfee SmartFilter Administration Bess Edition versions prior to 4.2.1.01 Description The issue allows remote attackers to execute arbitrary code via a crafted .war file, due to the...

CVE-2012-4588: Undefined Security Weakness

McAfee Enterprise Mobility Manager EMM Agent before 4.8 and Server before 10.1 record all invalid usernames presented in failed login attempts, and place them on a list of accounts that an administrator may wish to unlock, which allows remote attackers to cause a denial of service excessive list...

CVE-2009-5116: Improper Authentication

McAfee LinuxShield 1.5.1 and earlier does not properly implement client authentication, which allows remote authenticated users to obtain Admin access to the statistics server by leveraging a client account...

CVE-2012-4589: Undefined Security Weakness

Login.aspx in the Portal in McAfee Enterprise Mobility Manager EMM before 10.0 does not have an off autocomplete attribute for unspecified form fields, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation...

CVE-2012-4596: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in McAfee Email Gateway MEG 7.0.0 and 7.0.1 allows remote authenticated users to bypass intended access restrictions and download arbitrary files via a crafted URL...

CVE-2012-4591: Exposure of Sensitive Information to an Unauthorized Actor

About.aspx in the Portal in McAfee Enterprise Mobility Manager EMM before 10.0 discloses the name of the user account for an IIS worker process, which allows remote attackers to obtain potentially sensitive information by visiting this page...

PT-2012-5499

Name of the Vulnerable Software and Affected Versions McAfee Enterprise Mobility Manager EMM versions prior to 10.0 Description The issue allows remote attackers to obtain potentially sensitive information by visiting the About.aspx page in the Portal, which discloses the name of the user account...

CVE-2012-4592: Undefined Security Weakness

The Portal in McAfee Enterprise Mobility Manager EMM before 10.0 does not set the secure flag for the ASP.NET session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session...

PT-2012-5495

Name of the Vulnerable Software and Affected Versions McAfee Enterprise Mobility Manager EMM Agent versions prior to 4.8 McAfee Enterprise Mobility Manager EMM Server versions prior to 10.1 Description The issue is related to an improper dependency on DNS SRV records when one-time provisioning OT...

PT-2012-5491

Name of the Vulnerable Software and Affected Versions McAfee Email and Web Security EWS versions 5.x through 5.5 before Patch 6 McAfee Email and Web Security EWS version 5.6 before Patch 3 McAfee Email Gateway MEG versions 7.0 before Patch 1 Description The issue allows remote authenticated users...

CVE-2010-3496: Undefined Security Weakness

McAfee VirusScan Enterprise 8.5i and 8.7i does not properly interact with the processing of hcp:// URLs by the Microsoft Help and Support Center, which makes it easier for remote attackers to execute arbitrary code via malware that is correctly detected by this product, but with a detection...

PT-2012-5488

Name of the Vulnerable Software and Affected Versions McAfee Email and Web Security EWS versions 5.x through 5.5 before Patch 6 McAfee Email and Web Security EWS version 5.6 before Patch 3 McAfee Email Gateway MEG version 7.0 before Patch 1 Description A cross-site scripting XSS issue allows remo...