323 matches found
CVE-2020-12674: Out-of-bounds Read
In Dovecot before 2.3.11.3, sending a specially formatted RPA request will crash the auth service because a length of zero is mishandled...
PT-2020-5171 · Dovecot +6 · Dovecot +6
Name of the Vulnerable Software and Affected Versions: Dovecot versions prior to 2.3.11.3 Description: The issue is related to incorrect input validation in the Dovecot mail server. It can be exploited by a remote attacker who sends a specially formatted RPA request, leading to a crash in the...
Open-Xchange: Pre-auth Denial-of-Service in Dovecot RPA implementation
Hi, Dovecot security team. I am Orange from DEVCORE security team. We just did a little security audit on the authentication mechanism of Dovecot, and found a buffer over-read in RPA implementation. In the mech-rpa.c, the function rpareadbuffer doesn't check that the length could be zero, and pas...
mail/dovecot -- multiple vulnerabilities
Aki Tuomi reports: Parsing mails with a large number of MIME parts could have resulted in excessive CPU usage or a crash due to running out of stack memory.. Dovecot's NTLM implementation does not correctly check message buffer size, which leads to reading past allocation which can lead to crash...
CVE-2019-4336
IBM Robotic Process Automation with Automation Anywhere 11 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 161411...
CVE-2019-4297
IBM Robotic Process Automation with Automation Anywhere 11 could allow a remote authenticated attacker to conduct an LDAP injection. By using a specially crafted request, an attacker could exploit this vulnerability to make unauthorized queries or modify the LDAP content. IBM X-Force ID: 160761...
CVE-2019-4337
IBM Robotic Process Automation with Automation Anywhere 11 could allow an attacker to obtain sensitive information due to missing authentication in Ignite nodes. IBM X-Force ID: 161412...
CVE-2019-4298
IBM Robotic Process Automation with Automation Anywhere 11 uses a high privileged PostgreSQL account for database access which could allow a local user to perform actions they should not have privileges to execute. IBM X-Force ID: 160764...
Information disclosure
IBM Robotic Process Automation with Automation Anywhere 11 information disclosure could allow a local user to obtain e-mail contents from the client debug log file. IBM X-Force ID: 160759...
Code injection
IBM Robotic Process Automation with Automation Anywhere 11 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 161411...
Code injection
IBM Robotic Process Automation with Automation Anywhere 11 uses a high privileged PostgreSQL account for database access which could allow a local user to perform actions they should not have privileges to execute. IBM X-Force ID: 160764...
Design/Logic Flaw
IBM Robotic Process Automation with Automation Anywhere 11 could allow a local user to obtain highly sensitive information from log files when debugging is enabled. IBM X-Force ID: 160765...
Authentication flaw
IBM Robotic Process Automation with Automation Anywhere 11 could allow an attacker to obtain sensitive information due to missing authentication in Ignite nodes. IBM X-Force ID: 161412...
CVE-2019-4337
CVE-2019-4337 affects IBM Robotic Process Automation with Automation Anywhere (version 11). The IBM bulletin documents an information-disclosure vulnerability caused by missing authentication in Ignite cluster nodes, enabling an attacker to obtain sensitive information. CVSS details in the entry ...
CVE-2019-4298
Summary of CVE-2019-4298 / IBM RPA with Automation Anywhere 11 : The vulnerability stems from using a high-privilege PostgreSQL admin account for application database access, enabling a local user to perform actions beyond their privileges. Affected product/version: IBM Robotic Process Automation...
CVE-2019-4298
IBM Robotic Process Automation with Automation Anywhere 11 uses a high privileged PostgreSQL account for database access which could allow a local user to perform actions they should not have privileges to execute. IBM X-Force ID: 160764...
CVE-2019-4337
IBM Robotic Process Automation with Automation Anywhere 11 could allow an attacker to obtain sensitive information due to missing authentication in Ignite nodes. IBM X-Force ID: 161412...
CVE-2019-4336
CVE-2019-4336 affects IBM Robotic Process Automation with Automation Anywhere (v11). The vulnerability stems from an inadequate account lockout setting in the Forgot-Password/authentication flow, enabling a remote attacker to brute-force credentials. This is supported by multiple sources (NVD ent...
CVE-2019-4336
IBM Robotic Process Automation with Automation Anywhere 11 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials. IBM X-Force ID: 161411...