Mati Aharoni

**Name of the Vulnerable Software and Affected Versions** McAfee Common Management Agent (CMA) versions 3.6.0.574 Patch 3 and earlier **Description** The issue allows remote attackers to corrupt memory and cause a denial of service, resulting in the CMA Framework service crash. This can be achieved by sending requests for the "/spin//AVClient//AVClient.csp" URI with a long invalid method. **Recommendations** For McAfee Common Management Agent (CMA) versions 3.6.0.574 Patch 3 and earlier, consider restricting access to the "/spin//AVClient//AVClient.csp" URI to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MailEnable Professional versions 1.71 and earlier MailEnable Enterprise versions 1.1 and earlier **Description** The issue allows remote authenticated users to execute arbitrary code via a long IMAP EXAMINE command, which is a buffer overflow. **Recommendations** For MailEnable Professional versions 1.71 and earlier, update to a version later than 1.71 to resolve the issue. For MailEnable Enterprise versions 1.1 and earlier, update to a version later than 1.1 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** MailEnable version 1.8 **Description** The issue allows remote attackers to cause a denial of service, resulting in an application crash. This is achieved by using format string specifiers in the `mailto` field. **Recommendations** For MailEnable version 1.8, consider restricting access to the mailto field to minimize the risk of exploitation until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Savant Web Server version 3.1 **Description** The issue allows remote attackers to execute arbitrary code via a long HTTP request, due to a buffer overflow. **Recommendations** For Savant Web Server version 3.1, update to a version that fixes the buffer overflow issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.