1987 matches found
Fetchmail 资源管理错误漏洞
Fetchmail is an application for downloading emails. A security vulnerability exists in versions of Fetchmail prior to 6.4.20. The vulnerability stems from the fact that reportvbuild in report.c sometimes ignores the initialization of the valist parameter. This could result in a denial of service ...
The vulnerability of the Dovecot mail server arises from incorrect neutralization of special elements in the output data used by the incoming component, allowing attackers to expose user credentials.
The vulnerability of the Dovecot mail server is related to incorrect neutralization of special elements in the output data used by the incoming component. Exploiting this vulnerability can allow a remote attacker to expose user credentials...
The vulnerability of the Dovecot mail server, related to resource management errors, allows a hacker to cause a service failure.
The vulnerability of the Dovecot mail server is related to resource management errors. Exploiting this vulnerability can allow a remote attacker to cause service interruptions...
Command Execution Vulnerability in IceWarp Mail Server
IceWarp Mail Server is an enterprise-grade email, collaboration and mobile solution for organizations of all sizes. A command execution vulnerability exists in IceWarp Mail Server, which can be exploited by an attacker to perform command execution by constructing malicious statements...
CVE-2021-31855
KDE Messagelib through 5.17.0 reveals cleartext of encrypted messages in some situations. Deleting an attachment of a decrypted encrypted message stored on a remote server e.g., an IMAP server causes KMail to upload the decrypted content of the message to the remote server. With a crafted message...
The vulnerability of the extractoption() function in the Exim message forwarding agent, related to writing beyond the buffer size in memory, allows a hacker to execute arbitrary code.
The vulnerability of the extractoption function in the Exim message forwarding agent is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code by sending a specially crafted message to the mail server...
Open-Xchange: Command Injection via STARTTLS in SMTP
During our research into the security of email servers at Münster University of Applied Sciences, we found a command injection vulnerability related to STARTTLS in Dovecot. See the attached advisory for details. The vulnerability allows a MITM attacker between a mail client and Dovecot to inject...
UBUNTU-CVE-2021-32056
Cyrus IMAP before 3.2.7, and 3.3.x and 3.4.x before 3.4.1, allows remote authenticated users to bypass intended access restrictions on server annotations and consequently cause replication to stall...
A week in security (May 3 – 9)
Last week on Malwarebytes Labs, we discussed how Spectre attacks have come back from the dead; why Facebook banned Instragram ads by Signal; we highlighted the differences between the most popular VPN protocols; pointed out that Google is about to start automatically enrolling users in two-step...
DEBIAN-CVE-2020-28025
Exim 4 before 4.94.2 allows Out-of-bounds Read because pdkimfinishbodyhash does not validate the relationship between sig-bodyhash.len and b-bh.len; thus, a crafted DKIM-Signature header might lead to a leak of sensitive information from process memory...
DEBIAN-CVE-2020-28016
Exim 4 before 4.94.2 allows an off-by-two Out-of-bounds Write because "-F ''" is mishandled by parsefixphrase...
CVE-2020-28013
Exim 4 before 4.94.2 allows Heap-based Buffer Overflow because it mishandles "-F '.'" on the command line, and thus may allow privilege escalation from any user to root. This occurs because of the interpretation of negative sizes in strncpy...
Raft of Exim Security Holes Allow Linux Mail Server Takeovers
A veritable cornucopia of security vulnerabilities in the Exim mail server have been uncovered, some of which could be chained together for unauthenticated remote code execution RCE, gaining root privileges and worm-style lateral movement, according to researchers. The Qualys Research Team has...
Exim < 4.94.2 Multiple Vulnerabilities (21Nails)
According to its banner, the version of Exim running on the remote host is prior to 4.94.2. It is, therefore, potentially affected by multiple vulnerabilities that can lead to remote code execution. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc';...
CVE-2020-28021
Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters. An authenticated remote SMTP client can insert newline characters into a spool file which indirectly leads to remote code execution as root via AUTH= in a MAIL FROM command...
CVE-2021-20501
IBM i 7.1, 7.2, 7.3, and 7.4 SMTP allows a network attacker to send emails to non-existent local-domain recipients to the SMTP server, caused by using a non-default configuration. An attacker could exploit this vulnerability to consume unnecessary network bandwidth and disk space, and allow remot...
[SECURITY] Fedora 32 Update: clamav-0.103.2-1.fc32
Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers attachment scanning. The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs ar...
[SECURITY] Fedora 33 Update: clamav-0.103.2-1.fc33
Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers attachment scanning. The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs ar...
The vulnerability of the Dovecot mail server’s components lda, lmtp, and imap, related to insufficient input data validation, allows attackers to cause service failures.
The vulnerability of the Dovecot mail server’s components lda, lmtp, and imap is related to insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to cause service interruptions...