CVE-2023-25194

CVE-2023-25194 https://hackerone.com/reports/1529790 Poc POST /connectors HTTP/1.1 Host: xxxx:8083 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10157 AppleWebKit/537.36 KHTML, like Gecko Chrome/109.0.0.0 Safari/537.36 Accept:...

cyrus-sasl

Cyrus SASL This is the Cyrus SASL API implementation. It can be used on the client or server side to provide authentication and authorization services. See RFC 4422 for more information. The latest version is available at: https://github.com/cyrusimap/cyrus-sasl/releases There are mailing lists f...

Critical: Red Hat Security Advisory: OpenJDK 8u512 Security Update for Portable Linux Builds

An update is now available for OpenJDK. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References...

Important: Red Hat Security Advisory: java-1.8.0-openjdk security update for RHEL 8

An update for java-1.8.0-openjdk is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 8...

CVE-2026-126616

The auto-ban of Progressive Robot hMailServer 6.2.0 through 6.3.3, with a MySQL or MariaDB database, can be kept from banning an address after repeated failed logons, which allows a remote unauthenticated attacker to go on guessing account passwords from a single address without being banned. The...

CVE-2026-126616

Progressive Robot hMailServer versions 6.2.0 through 6.3.3 using a MySQL or MariaDB database are vulnerable to an improper restriction of excessive authentication attempts. The root cause involves a character encoding mismatch where the server decodes SASL PLAIN usernames as UTF-8 but the databas...

CVE-2026-126616 Improper Restriction of Excessive Authentication Attempts in hMailServer

The auto-ban of Progressive Robot hMailServer 6.2.0 through 6.3.3, with a MySQL or MariaDB database, can be kept from banning an address after repeated failed logons, which allows a remote unauthenticated attacker to go on guessing account passwords from a single address without being banned. The...

EUVD-2026-123333

The auto-ban of Progressive Robot hMailServer 6.2.0 through 6.3.3, with a MySQL or MariaDB database, can be kept from banning an address after repeated failed logons, which allows a remote unauthenticated attacker to go on guessing account passwords from a single address without being banned. The...

CVE-2026-126616: Improper Restriction of Excessive Authentication Attempts

The auto-ban of Progressive Robot hMailServer 6.2.0 through 6.3.3, with a MySQL or MariaDB database, can be kept from banning an address after repeated failed logons, which allows a remote unauthenticated attacker to go on guessing account passwords from a single address without being banned. The...

Amazon Linux 2 : tomcat (ALAS-2026-4089)

The version of tomcat installed on the remote host is prior to 7.0.76-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-4089 advisory. A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI...

CVE-2026-100252

Improper Authorization vulnerability in Apache ZooKeeper. When SASL authentication is enabled on the client port, the server's SASL callback handler grants every authorization identity authzid that a client requests, without checking it against the principal the client authenticated as. The serve...

CVE-2025-66621

Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD claim of JWT payloads when introspection is not configured. This allows an attacker with valid credentials to access the mail server even if they are not authorized to do so. We recommend users to upgrade t...

CVE-2025-66621 Apache James: SASL OAUTHBEARER do not validate aud in JWT payload if misconfigred

Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD claim of JWT payloads when introspection is not configured. This allows an attacker with valid credentials to access the mail server even if they are not authorized to do so. We recommend users to upgrade t...

CVE-2025-66621 Apache James: SASL OAUTHBEARER do not validate aud in JWT payload if misconfigred

Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD claim of JWT payloads when introspection is not configured. This allows an attacker with valid credentials to access the mail server even if they are not authorized to do so. We recommend users to upgrade t...

CVE-2025-66621

Apache James SASL OAuthBearer/XOAUTH2 versions prior to 3.9.1 are vulnerable to an authentication bypass because the system fails to correctly validate the AUD claim of JWT payloads when introspection is not configured. An attacker with valid credentials can leverage this to access the mail serve...

EUVD-2025-211271

Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD claim of JWT payloads when introspection is not configured. This allows an attacker with valid credentials to access the mail server even if they are not authorized to do so. We recommend users to upgrade t...

Apache ZooKeeper 3.8.x < 3.8.8 / 3.9.x < 3.9.7 Multiple Vulnerabilities

The version of Apache ZooKeeper listening on the remote host is 3.8.x prior to 3.8.8 or 3.9.x prior to 3.9.7. It is, therefore, affected by multiple vulnerabilities: - Incorrect authorization due to a time-of-check to time-of-use TOCTOU race condition in the setACL request handling of Apache...

CVE-2025-66621: Apache Software Foundation Apache James: Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD claim of JWT payloads when…

Apache James SASL OAuthBearer/XOAUTH2 prior versions 3.9.1 fails to validate correctly AUD claim of JWT payloads when introspection is not configured. This allows an attacker with valid credentials to access the mail server even if they are not authorized to do so. We recommend users to upgrade t...

Linux Distros Unpatched Vulnerability : CVE-2026-100252

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Authorization vulnerability in Apache ZooKeeper. When SASL authentication is enabled on the client port, the server's SASL callback handler grants ever...

CVE-2026-114230

A flaw was found in qpid-proton. When authenticating a peer connection using Simple Authentication and Security Layer SASL, the software improperly processes Advanced Message Queuing Protocol AMQP frames that falsely claim to be SASL frames. A remote attacker can exploit this flaw by sending...