Denial Of Service (DoS)

libetpan.so is vulnerable to Denial of Service DoS. The vulnerability exists in mailimapmailboxdatastatusfree function of mailimaptypes.c due to a null pointer dereference in the IMAP STATUS response which allows an attacker to cause an application crash...

CVE-2022-4121

In libetpan a null pointer dereference in mailimapmailboxdatastatusfree in low-level/imap/mailimaptypes.c was found that could lead to a remote denial of service or other potential consequences...

Code injection

A 2-Step Verification problem in Axigen 10.3.3.52 allows an attacker to access a mailbox by bypassing 2-Step Verification when they try to add an account to any third-party webmail service or add an account to Outlook or Gmail, etc. with IMAP or POP3 without any verification code...

CVE-2023-23566

CVE-2023-23566 affects Axigen Mail Server v10.3.3.52, where a flaw in the 2-Step Verification flow allows an attacker to bypass 2FA when adding an account to a third‑party webmail service via IMAP/POP3, enabling mailbox access without a verification code. The underlying issue is bypassing 2FA dur...

CVE-2023-23566

A 2-Step Verification problem in Axigen 10.3.3.52 allows an attacker to access a mailbox by bypassing 2-Step Verification when they try to add an account to any third-party webmail service or add an account to Outlook or Gmail, etc. with IMAP or POP3 without any verification code...

CVE-2023-23566

A 2-Step Verification problem in Axigen 10.3.3.52 allows an attacker to access a mailbox by bypassing 2-Step Verification when they try to add an account to any third-party webmail service or add an account to Outlook or Gmail, etc. with IMAP or POP3 without any verification code...

GLSA-202301-07 : Alpine: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202301-07 Alpine: Multiple Vulnerabilities - In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS. CVE-2021-38370 - Alpine before 2.25 allows remote attackers to cause a denial of service...

Information Disclosure

org.apache.james:james-server-core is vulnerable to Information Disclosure. A local attacker is able to access private user data in transit due to the use of temporary files with insecure permissions which includes in the SMTP stack and IMAP APPEND command's vulnerable components, resulting in...

CVE-2022-45935

Usage of temporary files with insecure permissions by the Apache James server allows an attacker with local access to access private user data in transit. Vulnerable components includes the SMTP stack and IMAP APPEND command. This issue affects Apache James server version 3.7.2 and prior versions...

GHSA-V6VP-62VC-84QW Apache James server allows an attacker with local access to access private user data in transit

Usage of temporary files with insecure permissions by the Apache James server allows an attacker with local access to access private user data in transit. Vulnerable components includes the SMTP stack and IMAP APPEND command. This issue affects Apache James server version 3.7.2 and prior versions...

Apache James server allows an attacker with local access to access private user data in transit

Usage of temporary files with insecure permissions by the Apache James server allows an attacker with local access to access private user data in transit. Vulnerable components includes the SMTP stack and IMAP APPEND command. This issue affects Apache James server version 3.7.2 and prior versions...

CVE-2022-45935

Usage of temporary files with insecure permissions by the Apache James server allows an attacker with local access to access private user data in transit. Vulnerable components includes the SMTP stack and IMAP APPEND command. This issue affects Apache James server version 3.7.2 and prior versions...

CVE-2022-45935 Apache James server: Temporary File Information Disclosure

Usage of temporary files with insecure permissions by the Apache James server allows an attacker with local access to access private user data in transit. Vulnerable components includes the SMTP stack and IMAP APPEND command. This issue affects Apache James server version 3.7.2 and prior versions...

CVE-2022-45935 Apache James server: Temporary File Information Disclosure

Usage of temporary files with insecure permissions by the Apache James server allows an attacker with local access to access private user data in transit. Vulnerable components includes the SMTP stack and IMAP APPEND command. This issue affects Apache James server version 3.7.2 and prior versions...

Fedora 36 : libetpan (2022-de3e565494)

The remote Fedora 36 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-de3e565494 advisory. A potential bug is found on libetpan that when IMAP client receives invalid STATUS response, an invalid free can occur on mailimapmailboxdatastatusfree. This...

Fedora 35 : libetpan (2022-df2f4923ea)

The remote Fedora 35 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-df2f4923ea advisory. A potential bug is found on libetpan that when IMAP client receives invalid STATUS response, an invalid free can occur on mailimapmailboxdatastatusfree. This...

PT-2022-6377 · Nextcloud · Nextcloud Mail

Name of the Vulnerable Software and Affected Versions: Nextcloud mail versions prior to 1.15.0 Nextcloud mail versions prior to 2.2.2 Description: The issue is related to insufficient validation of incoming requests in the Nextcloud mail client, allowing a remote attacker to scan internal service...

GLSA-202212-01 : curl: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202212-01 curl: Multiple Vulnerabilities - When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the...

Amazon Linux 2 : mutt (ALAS-2022-1892)

The version of mutt installed on the remote host is prior to 1.5.21-29. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1892 advisory. Mutt before 1.14.3 allows an IMAP fcc/postpone man-in-the-middle attack via a PREAUTH response. CVE-2020-14093 Mutt before...

PHP IMAP imap_open Command Injection (CVE-2018-19518)

A command injection vulnerability exists in the IMAP component of PHP. The vulnerability is due to improper handling of the server parameter passed to the imapopen function. A remote, authenticated attacker can exploit this vulnerability by supplying a crafted server parameter to the imapopen...