CVE-2021-38372

In KDE Trojita 0.7, man-in-the-middle attackers can create new folders because untagged responses from an IMAP server are accepted before STARTTLS...

CVE-2021-38373

In KDE KMail 19.12.3 aka 5.13.3, the SMTP STARTTLS option is not honored and cleartext messages are sent unless "Server requires authentication" is checked...

UBUNTU-CVE-2021-38371

The STARTTLS feature in Exim through 4.94.2 allows response injection buffering during MTA SMTP sending...

UBUNTU-CVE-2021-38373

In KDE KMail 19.12.3 aka 5.13.3, the SMTP STARTTLS option is not honored and cleartext messages are sent unless "Server requires authentication" is checked...

Design/Logic Flaw

The STARTTLS feature in Exim through 4.94.2 allows response injection buffering during MTA SMTP sending...

Code injection

In KDE Trojita 0.7, man-in-the-middle attackers can create new folders because untagged responses from an IMAP server are accepted before STARTTLS...

CVE-2021-38370

In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS...

CVE-2021-38370

In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS...

UBUNTU-CVE-2021-38370

In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS...

CVE-2021-38371

The STARTTLS feature in Exim through 4.94.2 allows response injection buffering during MTA SMTP sending...

Design/Logic Flaw

In Alpine before 2.25, untagged responses from an IMAP server are accepted before STARTTLS...

CVE-2021-38373

In KDE KMail 19.12.3 aka 5.13.3, the SMTP STARTTLS option is not honored and cleartext messages are sent unless "Server requires authentication" is checked...

CVE-2021-38373

In KDE KMail 19.12.3 (aka 5.13.3), the SMTP STARTTLS option is not honored and cleartext messages are sent unless the server requires authentication is checked. This CVE-2021-38373 description is supported by multiple connected sources (SUSe/RHEL/Nessus mappings) indicating the same behavior; no ...

CVE-2021-38373

In KDE KMail 19.12.3 aka 5.13.3, the SMTP STARTTLS option is not honored and cleartext messages are sent unless "Server requires authentication" is checked...

CVE-2021-38372

CVE-2021-38372 affects KDE Trojita 0.7. The issue arises because untagged IMAP responses are accepted before STARTTLS, enabling man-in-the-middle attackers to create new folders. Root cause stated as untagged responses being processed prior to STARTTLS. No exploitation details or patch/version in...

CVE-2021-38372

In KDE Trojita 0.7, man-in-the-middle attackers can create new folders because untagged responses from an IMAP server are accepted before STARTTLS...

CVE-2021-38371

The STARTTLS feature in Exim through 4.94.2 allows response injection buffering during MTA SMTP sending...

CVE-2021-38371

The STARTTLS feature in Exim through 4.94.2 allows response injection buffering during MTA SMTP sending...

CVE-2021-38371

CVE-2021-38371 affects Exim (STARTTLS) up to version 4.94.2. The vulnerability allows response injection (buffering) during MTA SMTP sending due to how STARTTLS sync point is enforced on the client side. Affected products include Exim in various distributions (Debian/Ubuntu/Amazon Linux/Alpine/Op...

fetchmail -- STARTTLS bypass vulnerabilities

Problem: In certain circumstances, fetchmail 6.4.21 and older would not encrypt the session using STARTTLS/STLS, and might not have cleared session state across the TLS negotiation...