36 matches found
CVE-2026-106454
A flaw was found in Twisted. An authenticated remote attacker can cause a Denial of Service DoS by submitting specially crafted mailbox search queries using Internet Message Access Protocol IMAP commands such as LIST or LSUB. Because the server fails to properly sanitize these search patterns...
CVE-2026-106454
The Twisted event-based framework (supporting Python 3.6+ ) is vulnerable to a Regular Expression Denial of Service (ReDoS) in versions 25.5.0 and earlier . The flaw exists in the wildcardToRegexp() function within twisted/mail/imap4.py, where characters from an authenticated client's LIST or LSU...
PT-2026-107243
Name of the Vulnerable Software and Affected Versions Twisted versions 25.5.0 and earlier Description The wildcardToRegexp function in twisted/mail/imap4.py improperly handles patterns from authenticated clients during LIST or LSUB operations. While it translates IMAP asterisk and percent...
EUVD-2021-7686
Malicious code in bioql PyPI...
SUSE CVE-2010-4717
Multiple stack-based buffer overflows in the IMAP server component in GroupWise Internet Agent GWIA in Novell GroupWise before 8.02HP allow remote attackers to execute arbitrary code via a long 1 LIST or 2 LSUB command...
SUSE CVE-2021-20247
A flaw was found in mbsync before v1.3.5 and v1.4.1. Validations of the mailbox names returned by IMAP LIST/LSUB do not occur allowing a malicious or compromised server to use specially crafted mailbox names containing '..' path components to access data outside the designated mailbox on the...
Denial Of Service (DoS)
Alpine is vulnerable to denial of service. The vulnerability exists when LIST or LSUB is sent before STARTTLS which allows an attacker to cause an application crash...
DEBIAN-CVE-2021-46853
Alpine before 2.25 allows remote attackers to cause a denial of service application crash when LIST or LSUB is sent before STARTTLS...
UBUNTU-CVE-2021-46853
Alpine before 2.25 allows remote attackers to cause a denial of service application crash when LIST or LSUB is sent before STARTTLS...
CVE-2021-46853
Alpine before 2.25 allows remote attackers to cause a denial of service application crash when LIST or LSUB is sent before STARTTLS...
CVE-2021-46853
Alpine before 2.25 allows remote attackers to cause a denial of service application crash when LIST or LSUB is sent before STARTTLS...
PT-2022-12945
Name of the Vulnerable Software and Affected Versions Alpine versions prior to 2.25 Description The issue allows remote attackers to cause a denial of service, resulting in an application or daemon crash, when the LIST or LSUB command is sent before STARTTLS. Recommendations For versions prior to...
CVE-2021-46853: Time-of-check Time-of-use (TOCTOU) Race Condition
Alpine before 2.25 allows remote attackers to cause a denial of service application crash when LIST or LSUB is sent before STARTTLS...
CVE-2021-46853
CVE-2021-46853 affects Alpine prior to 2.25. A remote attacker can cause an application crash (denial of service) by sending LIST or LSUB before STARTTLS. This issue arises from how the IMAP/mail handling processes pre-TLS commands, enabling a crash under network conditions. The connected documen...
Design/Logic Flaw
A flaw was found in mbsync before v1.3.5 and v1.4.1. Validations of the mailbox names returned by IMAP LIST/LSUB do not occur allowing a malicious or compromised server to use specially crafted mailbox names containing '..' path components to access data outside the designated mailbox on the...
CVE-2021-20247
A flaw was found in mbsync before v1.3.5 and v1.4.1. Validations of the mailbox names returned by IMAP LIST/LSUB do not occur allowing a malicious or compromised server to use specially crafted mailbox names containing '..' path components to access data outside the designated mailbox on the...
CVE-2021-20247: Improper Input Validation
A flaw was found in mbsync before v1.3.5 and v1.4.1. Validations of the mailbox names returned by IMAP LIST/LSUB do not occur allowing a malicious or compromised server to use specially crafted mailbox names containing '..' path components to access data outside the designated mailbox on the...
PT-2021-13854
Name of the Vulnerable Software and Affected Versions: mbsync versions prior to 1.3.5 and 1.4.1 Description: A flaw was found in mbsync where validations of the mailbox names returned by IMAP LIST/LSUB do not occur, allowing a malicious or compromised server to use specially crafted mailbox names...
Huawei Vicky-AL00A and Victoria-AL00A cell phones isub denial of service vulnerability
The Huawei Vicky-AL00A and Victoria-AL00A are both smartphone devices from the Chinese company Huawei Huawei. A denial of service vulnerability exists in the lsub service in the Huawei Vicky-AL00A Vicky-AL00AC00B157 prior and Victoria-VL00A Victoria-VL00AC00B157 prior, which stems from a program...
SurgeMail 3.8 - IMAP LSUB Command Remote Stack Buffer Overflow Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/28377/info SurgeMail is prone to a remote stack-based buffer-overflow vulnerability because it fails to properly bounds-check user-supplied input. Successfully exploiting this issue may allow remote attackers to execute...