McAfee UTM Firewall Cross Site Scripting

Advisory Information Advisory ID: NGENUITY-2010-005 Date published: 6/9/2010 Vulnerability Information Class: Reflected Cross-Site Scripting XSS Software Description McAfee UTM Firewall Firmware 3.0.0 to 4.0.6 formerly SnapGear is the affected product line. More information can be found at...

McAfee Unified Threat Management Firewall 4.0.6 - page Cross-Site Scripting

McAfee Unified Threat Management Firewall 4.0.6 - page Cross-Site Scripting source: https://www.securityfocus.com/bid/40708/info McAfee Unified Threat Management UTM Firewall formerly SnapGear is prone to a cross-site scripting vulnerability because the device's web interface fails to properly...

McAfee Unified Threat Management Firewall 4.0.6 - 'page' Cross-Site Scripting

source: https://www.securityfocus.com/bid/40708/info McAfee Unified Threat Management UTM Firewall formerly SnapGear is prone to a cross-site scripting vulnerability because the device's web interface fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute...

CVE-2010-2116

The web interface in McAfee Email Gateway formerly IronMail 6.7.1 allows remote authenticated users, with only Read privileges, to gain Write privileges to modify configuration via the save action in a direct request to admin/systemWebAdminConfig.do...

CVE-2010-2116

The affected product is McAfee Email Gateway (formerly IronMail) version 6.7.1. The vulnerability is in the web interface, where remote authenticated users with only Read privileges can gain Write privileges by sending a direct request to admin/systemWebAdminConfig.do via the save action, allowin...

CVE-2010-2116

The web interface in McAfee Email Gateway formerly IronMail 6.7.1 allows remote authenticated users, with only Read privileges, to gain Write privileges to modify configuration via the save action in a direct request to admin/systemWebAdminConfig.do...

CVE-2010-2116: Incorrect Permission Assignment for Critical Resource

The web interface in McAfee Email Gateway formerly IronMail 6.7.1 allows remote authenticated users, with only Read privileges, to gain Write privileges to modify configuration via the save action in a direct request to admin/systemWebAdminConfig.do...

McAfee Email Gateway systemWebAdminConfig.do不安全访问控制漏洞

BUGTRAQ ID: 40255 McAfee Email Gateway之前名为IronMail，是企业级的硬件邮件网关和管理平台。 McAfee Email Gateway的systemWebAdminConfig.do配置文件没有执行正确的权限检查，拥有只读权限的Web Access用户可以通过在服务器响应的Form字段中添加HTML代码或发送特制POST请求执行写权限操作。 0 McAfee Email Gateway 6.7.1 厂商补丁： McAfee ------ 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

Black Hat Researchers to Demo Product Hacks

A trio of researchers who discovered vulnerabilities in Cisco firewalls and in Cisco and McAfee security management software will demonstrate proof-of-concept attacks against these products at the upcoming Black Hat USA conference. Read the full article. Dark Reading...

McAfee Email Gateway 6.7.1 - systemWebAdminConfig.do Remote Security Bypass

McAfee Email Gateway 6.7.1 - systemWebAdminConfig.do Remote Security Bypass source: https://www.securityfocus.com/bid/40255/info McAfee Email Gateway is prone to a security-bypass vulnerability because the web-based interface fails to properly perform user-profile checks. Attackers can exploit th...

McAfee Email Gateway - Web Administration Broken Access Control

McAfee Email Gateway - Web Administration Broken Access Control Advisory Name:Web Administration Broken Access Control in McAfee Email Gateway formerly IronMail Vulnerability Class: Broken Access Control Release Date: May 19, 2010 Affected Applications: Secure Mail Ironmail ver.6.7.1 Affected...

McAfee Email Gateway 6.7.1 - 'systemWebAdminConfig.do' Remote Security Bypass

source: https://www.securityfocus.com/bid/40255/info McAfee Email Gateway is prone to a security-bypass vulnerability because the web-based interface fails to properly perform user-profile checks. Attackers can exploit this issue to bypass certain security restrictions to edit property and...

McAfee Email Gateway - Web Administration Broken Access Control

Advisory Name:Web Administration Broken Access Control in McAfee Email Gateway formerly IronMail Vulnerability Class: Broken Access Control Release Date: May 19, 2010 Affected Applications: Secure Mail Ironmail ver.6.7.1 Affected Platforms: FreeBSD 6.2 / Apache-Coyote 1.1 Local / Remote: Local...

Adobe Vulnerabilities Continue to Rise

It’s no secret to anyone who has been paying attention that Adobe Reader and Acrobat have become prime targets for attackers in the last year or so, but new research shows just how dramatic the increase has been in the number of high-risk vulnerabilities identified in Adobe products recently...

McAfee DAT 5958 Issues

US-CERT is aware of public reports indicating that McAfee DAT release 5958 is incorrectly identifying the valid system file, C:\Windows\system32\svchost.exe, as containing malicious code. Reports indicate that a false positive detection occurs on Windows XP Service Pack 3 systems. Symptoms includ...

McAfee ePolicy Orchestrator Agent HTTP POST Handling Flaw (CVE-2004-0095)

McAfee Corporation is a major vendor of numerous anti-virus, network, and desktop security products which are deployed in consumer as well as enterprise environments. McAfee ePolicy Orchestrator is a central security management system to manage security policy, assess and enforce policy, notify...

McAfee Email Gateway 6.7.2 Hotfix 2更新修复多个安全漏洞

BUGTRAQ ID: 39242 McAfee Email Gateway之前名为IronMail，是企业级的硬件邮件网关和管理平台。 McAfee Email Gateway的6.7.2 Hotfix 2之前版本中的多个漏洞允许本地用户导致拒绝服务、读取敏感信息、获得权限提升，或允许远程攻击者执行跨站脚本攻击。 1 处理CLI命令时的错误可能耗尽可用的系统资源。 2 由于没有正确地过滤提交给admin/queuedMessage.do页面的queueMsgType和QtnType参数，远程攻击者可以通过提交恶意请求执行跨站脚本攻击。 3...

McAfee Email Gateway (formerly IronMail) - Denial of Service

McAfee Email Gateway formerly IronMail - Denial of Service Advisory Name: Denial of Service in McAfee Email Gateway formerly IronMail Vulnerability Class: Denial of Service Release Date: Tue Apr 6, 2010 Affected Applications: Secure Mail Ironmail ver.6.7.1 Affected Platforms: FreeBSD 6.2 /...

McAfee Email Gateway (formerly IronMail) - Cross-Site Scripting

McAfee Email Gateway formerly IronMail - Cross-Site Scripting Advisory Name: Multiple Reflected Cross-Site Scripting XSS in McAfee Email Gateway formerly IronMail Vulnerability Class: Reflected Cross-Site Scripting XSS Release Date: Tue Apr 6, 2010 Affected Applications: Secure Mail Ironmail...

McAfee Email Gateway (formerly IronMail) - Local Privilege Escalation

McAfee Email Gateway formerly IronMail - Local Privilege Escalation Advisory Name: Local Privilege Escalation in McAfee Email Gateway formerly IronMail Vulnerability Class: Local Privilege Escalation Release Date: Tue Apr 6, 2010 Affected Applications: Secure Mail Ironmail ver.6.7.1 Affected...