118 matches found
MGASA-2019-0072 Updated dovecot packages fix security vulnerability
CVE-2019-3814: If imap/pop3/managesieve/submission client has trusted certificate with missing username field sslcertusernamefield, under some configurations Dovecot mistakenly trusts the username provided via authentication instead of failing...
Updated dovecot packages fix security vulnerability
CVE-2019-3814: If imap/pop3/managesieve/submission client has trusted certificate with missing username field sslcertusernamefield, under some configurations Dovecot mistakenly trusts the username provided via authentication instead of failing...
[SECURITY] [DLA 1667-1] dovecot security update
Package : dovecot Version : 1:2.2.13-12deb8u5 CVE ID : CVE-2019-3814 It was discovered that there was a vulnerability in the dovecot IMAP/POP3 server. A flaw in the TLS username handling could lead to an attacker logging in as anyone else in the system if both authsslrequireclient,usernamefromcer...
[ASA-201902-1] dovecot: authentication bypass
Arch Linux Security Advisory ASA-201902-1 ========================================= Severity: High Date : 2019-02-06 CVE-ID : CVE-2019-3814 Package : dovecot Type : authentication bypass Remote : Yes Link : https://security.archlinux.org/AVG-872 Summary ======= The package dovecot before version...
Ubuntu: Security Advisory (USN-3881-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Debian DSA-4385-1 : dovecot - security update
halfdog discovered an authentication bypass vulnerability in the Dovecot email server. Under some configurations Dovecot mistakenly trusts the username provided via authentication instead of failing. If there is no additional password verification, this allows the attacker to login as anyone else...
[SECURITY] [DSA 4385-1] dovecot security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4385-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso February 05, 2019 https://www.debian.org/security/faq -...
[SECURITY] [DSA 4385-1] dovecot security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4385-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso February 05, 2019 https://www.debian.org/security/faq -...
CVE-2019-3814
It was discovered that Dovecot before versions 2.2.36.1 and 2.3.4.1 incorrectly handled client certificates. A remote attacker in possession of a valid certificate with an empty username field could possibly use this issue to impersonate other users...
Ubuntu 14.04 LTS : ClamAV vulnerabilities (USN-3814-2)
The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3814-2 advisory. Updated: 2018-11-21: The embedded version of libmspack in ClamAV was found to not be affected by the listed vulnerabilities, therefore the following is n...
Ubuntu 16.04 LTS / 18.04 LTS : libmspack vulnerabilities (USN-3814-1)
The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3814-1 advisory. It was discovered libmspack incorrectly handled certain malformed CAB files. A remote attacker could use this issue to cause libmspack to...
Ubuntu: Security Advisory (USN-3814-2)
The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2018-3814
Craft CMS 2.6.3000 is affected by a remote code execution vulnerability that occurs when using the Assets→Upload files screen followed by Replace it, allowing a .jpg file to carry embedded PHP code and be renamed to a .php extension. This is the official CVE description and is echoed across multi...
CVE-2018-3814
Craft CMS 2.6.3000 allows remote attackers to execute arbitrary PHP code by using the "Assets-Upload files" screen and then the "Replace it" option, because this allows a .jpg file to have embedded PHP code, and then be renamed to a .php extension...
Debian: Security Advisory (DSA-3814-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2017-3814
Cisco Firepower System Software contains a vulnerability (CVE-2017-3814) that could allow an unauthenticated remote attacker to bypass the appliance’s web content blocking. The issue is caused by insufficient input validation in the URL handling logic, enabling an attacker to add malicious text t...
CVE-2016-3814
The NVIDIA camera driver in Android before 2016-07-05 on Nexus 9 devices allows attackers to obtain sensitive information via a crafted application, aka Android internal bug 28193342...
CVE-2016-3814
CVE-2016-3814 : NVIDIA kernel driver’s camera component has a heap-buffer overwrite vulnerability that can cause denial of service. Connected docs confirm the heap-overwrite and DoS potential; no explicit remediation details are provided in the supplied materials.
Design/Logic Flaw
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-3814. Reason: This candidate is a reservation duplicate of CVE-2016-3814. Notes: All CVE users should reference CVE-2016-3814 instead of this candidate. All references and descriptions in this candidate have been removed to...
CVE-2016-3794
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2016-3814. Reason: This candidate is a reservation duplicate of CVE-2016-3814. Notes: All CVE users should reference CVE-2016-3814 instead of this candidate. All references and descriptions in this candidate have been removed to...