Fedora 43 : roundcubemail (2026-547e298156)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-547e298156 advisory. Release 1.6.13 - Managesieve: Fix handling of string-list format values for date tests in Out of Office 10075 - Fix remote image blocking bypass via SVG...

MiracleLinux 7 : dovecot-2.2.36-3.el7.1 (AXSA:2019-4341:02)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2019-4341:02 advisory. dovecot: improper NULL byte handling in IMAP and ManageSieve protocol parsers leads to out of bounds writes CVE-2019-11500 Tenable has extracted the precedin...

PT-2026-28366

Name of the Vulnerable Software and Affected Versions Dovecot versions prior to 2.4.3 Description An attacker can send a crafted message before authentication, leading to excessive memory allocation within the managesieve component. This can cause the managesieve-login process to crash, potential...

PT-2025-54919

Name of the Vulnerable Software and Affected Versions Dovecot versions prior to 2.4.3 Description A flaw exists in the ManageSieve AUTHENTICATE command that causes the service to crash when a literal value is used as the SASL initial response. This can lead to repeated crashes, resulting in a...

Fedora 40 : roundcubemail (2024-2e908e829a)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-2e908e829a advisory. Version 1.6.8 - Managesieve: Protect special scripts in managesievekolabmaster mode - Fix newmailnotifier notification focus in Chrome 9467 - Fix...

OPENSUSE-SU-2023:0345-1 Security update for roundcubemail

This update for roundcubemail fixes the following issues: Update to version 1.6.4 boo1216429: CVE-2023-5631: Fix cross-site scripting vulnerability in handling of SVG in HTML messages Fix PHP8 warnings Fix default 'mime.types' path on Windows Managesieve: Fix javascript error when relational or...

Fedora: Security Advisory for python-managesieve (FEDORA-2023-d797723a3e)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for python-managesieve (FEDORA-2023-51b4d898bb)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 37 Update: python-managesieve-0.7.1-6.fc37

This module allows accessing a Sieve-Server for managing Sieve scripts there. It is accompanied by a simple yet functional user application =EF=BF=BD=EF=BF =BD=EF=BF=BDsieveshell=EF=BF=BD=EF=BF=BD=EF=BF=BD...

Fedora 38 : python-managesieve (2023-51b4d898bb)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-51b4d898bb advisory. Fix use of ssl.wrapsocket CWE-295: Improper Certificate Validation Tenable has extracted the preceding description block directly from the Fedora security...

Fedora 37 : python-managesieve (2023-d797723a3e)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-d797723a3e advisory. Fix use of ssl.wrapsocket CWE-295: Improper Certificate Validation Tenable has extracted the preceding description block directly from the Fedora security...

SUSE CVE-2014-9587

Multiple cross-site request forgery CSRF vulnerabilities in Roundcube Webmail before 1.0.4 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to 1 address book operations or the 2 ACL or 3 Managesieve plugins...

SUSE: Security Advisory (SUSE-SU-2019:2454-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CentOS 8 : dovecot (CESA-2019:2822)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:2822 advisory. - dovecot: improper NULL byte handling in IMAP and ManageSieve protocol parsers leads to out of bounds writes CVE-2019-11500 Note that Nessus has not tested for...

openSUSE Security Update : roundcubemail (openSUSE-2020-1516)

This update for roundcubemail fixes the following issues : roundcubemail was upgraded to 1.3.15 This is a security update to the LTS version 1.3. boo1175135 - Security: Fix cross-site scripting XSS via HTML messages with malicious svg content CVE-2020-16145 - Security: Fix cross-site scripting XS...

Open-Xchange: A malicious user can upload a malicious script through managesieve and trigger its execution in order to consume almost 100% of CPU (LMTP).

Summary A malicious user can create a malicious sieve script attached as "test.sieve", upload it to the server through managesieve and set as active. Then the user can send several specially crafted messages to himself to trigger long script execution. The attacker has to send one message per...

Fedora 32 : roundcubemail (2020-d0f8f20cfc)

RELEASE 1.4.8 - Security: Fix potential XSS issue in HTML editor of the identity signature input 7507 - Managesieve: Fix too-small input field in Elastic when using custom headers 7498 - Fix support for an error as a string in messagebeforesend hook 7475 - Elastic: Fix redundant scrollbar in plai...

Fedora 31 : roundcubemail (2020-b1e023936e)

RELEASE 1.4.8 - Security: Fix potential XSS issue in HTML editor of the identity signature input 7507 - Managesieve: Fix too-small input field in Elastic when using custom headers 7498 - Fix support for an error as a string in messagebeforesend hook 7475 - Elastic: Fix redundant scrollbar in plai...

Virtuozzo 7 : dovecot / dovecot-devel / dovecot-mysql / etc (VZLSA-2019-2836)

An update for dovecot is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

CVE-2019-11500

A flaw was found in dovecot. IMAP and ManageSieve protocol parsers do not properly handle the NULL byte when scanning data in quoted strings which leads to an out of bounds heap memory write. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...