CVE-2021-38084

An issue was discovered in the POP3 component of Courier Mail Server before 1.1.5. Meddler-in-the-middle attackers can pipeline commands after the POP3 STLS command, injecting plaintext commands into an encrypted user session...

CVE-2021-38084

An issue was discovered in the POP3 component of Courier Mail Server before 1.1.5. Meddler-in-the-middle attackers can pipeline commands after the POP3 STLS command, injecting plaintext commands into an encrypted user session...

CVE-2021-38084

An issue was discovered in the POP3 component of Courier Mail Server before 1.1.5. Meddler-in-the-middle attackers can pipeline commands after the POP3 STLS command, injecting plaintext commands into an encrypted user session...

Session fixation

An issue was discovered in the POP3 component of Courier Mail Server before 1.1.5. Meddler-in-the-middle attackers can pipeline commands after the POP3 STLS command, injecting plaintext commands into an encrypted user session...

UBUNTU-CVE-2021-38084

An issue was discovered in the POP3 component of Courier Mail Server before 1.1.5. Meddler-in-the-middle attackers can pipeline commands after the POP3 STLS command, injecting plaintext commands into an encrypted user session...

CVE-2021-38084

CVE-2021-38084 affects the Courier Mail Server POP3 component prior to 1.1.5. A meddler-in-the-middle can pipeline commands after the POP3 STLS command, injecting plaintext commands into an encrypted user session, with impact on confidentiality, integrity, and availability. The available sources ...

CVE-2021-38084

An issue was discovered in the POP3 component of Courier Mail Server before 1.1.5. Meddler-in-the-middle attackers can pipeline commands after the POP3 STLS command, injecting plaintext commands into an encrypted user session...

Courier Mail Server 注入漏洞

Courier Mail Server is an application. A courier mail server. A security vulnerability exists in versions of Courier Mail Server prior to 1.1.5, which can be exploited by attackers to enter malicious commands after POP3 STLS commands and inject malicious commands into an encrypted user session...

Fetchmail 资源管理错误漏洞

Fetchmail is an application for downloading emails. A security vulnerability exists in versions of Fetchmail prior to 6.4.20. The vulnerability stems from the fact that reportvbuild in report.c sometimes ignores the initialization of the valist parameter. This could result in a denial of service ...

The vulnerability of the Dovecot mail server arises from incorrect neutralization of special elements in the output data used by the incoming component, allowing attackers to expose user credentials.

The vulnerability of the Dovecot mail server is related to incorrect neutralization of special elements in the output data used by the incoming component. Exploiting this vulnerability can allow a remote attacker to expose user credentials...

The vulnerability of the Dovecot mail server, related to resource management errors, allows a hacker to cause a service failure.

The vulnerability of the Dovecot mail server is related to resource management errors. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...

Command Execution Vulnerability in IceWarp Mail Server

IceWarp Mail Server is an enterprise-grade email, collaboration and mobile solution for organizations of all sizes. A command execution vulnerability exists in IceWarp Mail Server, which can be exploited by an attacker to perform command execution by constructing malicious statements...

CVE-2021-31855

KDE Messagelib through 5.17.0 reveals cleartext of encrypted messages in some situations. Deleting an attachment of a decrypted encrypted message stored on a remote server e.g., an IMAP server causes KMail to upload the decrypted content of the message to the remote server. With a crafted message...

The vulnerability of the extractoption() function in the Exim message forwarding agent, related to writing beyond the buffer size in memory, allows a hacker to execute arbitrary code.

The vulnerability of the extractoption function in the Exim message forwarding agent is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code by sending a specially crafted message to the mail server...

Open-Xchange: Command Injection via STARTTLS in SMTP

During our research into the security of email servers at Münster University of Applied Sciences, we found a command injection vulnerability related to STARTTLS in Dovecot. See the attached advisory for details. The vulnerability allows a MITM attacker between a mail client and Dovecot to inject...

UBUNTU-CVE-2021-32056

Cyrus IMAP before 3.2.7, and 3.3.x and 3.4.x before 3.4.1, allows remote authenticated users to bypass intended access restrictions on server annotations and consequently cause replication to stall...

A week in security (May 3 – 9)

Last week on Malwarebytes Labs, we discussed how Spectre attacks have come back from the dead; why Facebook banned Instragram ads by Signal; we highlighted the differences between the most popular VPN protocols; pointed out that Google is about to start automatically enrolling users in two-step...

DEBIAN-CVE-2020-28016

Exim 4 before 4.94.2 allows an off-by-two Out-of-bounds Write because "-F ''" is mishandled by parsefixphrase...

DEBIAN-CVE-2020-28025

Exim 4 before 4.94.2 allows Out-of-bounds Read because pdkimfinishbodyhash does not validate the relationship between sig-bodyhash.len and b-bh.len; thus, a crafted DKIM-Signature header might lead to a leak of sensitive information from process memory...

CVE-2020-28013

Exim 4 before 4.94.2 allows Heap-based Buffer Overflow because it mishandles "-F '.'" on the command line, and thus may allow privilege escalation from any user to root. This occurs because of the interpretation of negative sizes in strncpy...