1366 matches found
PT-2021-22500
Name of the Vulnerable Software and Affected Versions Fetchmail versions prior to 6.4.22 Description The issue is related to Fetchmail's failure to enforce STARTTLS session encryption under certain circumstances, such as with IMAP and PREAUTH. Recommendations For versions prior to 6.4.22, update ...
CVE-2021-39272: Cleartext Transmission of Sensitive Information
Fetchmail before 6.4.22 fails to enforce STARTTLS session encryption in some circumstances, such as a certain situation with IMAP and PREAUTH...
FreeBSD : fetchmail -- STARTTLS bypass vulnerabilities (1d6410e8-06c1-11ec-a35d-03ca114d16d6)
Problem : In certain circumstances, fetchmail 6.4.21 and older would not encrypt the session using STARTTLS/STLS, and might not have cleared session state across the TLS negotiation. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...
The vulnerability in the implementation of the Net::IMAP class in the Ruby interpreter allows a attacker to execute a “man-in-the-middle” attack.
The vulnerability in the implementation of the Net::IMAP class in the Ruby interpreter is related to errors in the process of verifying the authenticity of certificates when processing the STARTTLS command. Exploiting this vulnerability could allow a remote attacker to execute a “man-in-the-middl...
Mozilla Thunderbird Command Injection Vulnerability
Mozilla Thunderbird is an open source email client. A command injection vulnerability exists in the Mozilla Thunderbird product, which stems from a problem in the way Thunderbird handles IMAP server responses sent prior to the STARTTLS process. An attacker could exploit this vulnerability to send...
CVE-2021-38373
In KDE KMail 19.12.3 aka 5.13.3, the SMTP STARTTLS option is not honored and cleartext messages are sent unless "Server requires authentication" is checked...
CVE-2020-15955
In s/qmail through 4.0.07, an active MitM can inject arbitrary plaintext commands into a STARTTLS encrypted session between an SMTP client and s/qmail. This allows e-mail messages and user credentials to be sent to the MitM attacker...
CVE-2020-15955
In s/qmail through 4.0.07, an active MitM can inject arbitrary plaintext commands into a STARTTLS encrypted session between an SMTP client and s/qmail. This allows e-mail messages and user credentials to be sent to the MitM attacker...
Command injection
In s/qmail through 4.0.07, an active MitM can inject arbitrary plaintext commands into a STARTTLS encrypted session between an SMTP client and s/qmail. This allows e-mail messages and user credentials to be sent to the MitM attacker...
CVE-2020-15955
In s/qmail through 4.0.07, an active MitM can inject arbitrary plaintext commands into a STARTTLS encrypted session between an SMTP client and s/qmail. This allows e-mail messages and user credentials to be sent to the MitM attacker...
CVE-2020-15955
The CVE-2020-15955 issue affects s/qmail up to version 4.0.07, where an active MitM can inject arbitrary plaintext commands into a STARTTLS session between an SMTP client and s/qmail. This allows e-mail messages and user credentials to be sent to the attacker. The root cause is the ability to tam...
PT-2021-9848
Name of the Vulnerable Software and Affected Versions s/qmail versions prior to 4.0.08 Description The issue allows an active Man-in-the-Middle MitM to inject arbitrary plaintext commands into a STARTTLS encrypted session between an SMTP client and s/qmail. This enables the attacker to intercept...
CVE-2020-15955: Improper Neutralization of Special Elements used in a Command
In s/qmail through 4.0.07, an active MitM can inject arbitrary plaintext commands into a STARTTLS encrypted session between an SMTP client and s/qmail. This allows e-mail messages and user credentials to be sent to the MitM attacker...
Dozens of STARTTLS Related Flaws Found Affecting Popular Email Clients
Security researchers have disclosed as many as 40 different vulnerabilities associated with an opportunistic encryption mechanism in mail clients and servers that could open the door to targeted man-in-the-middle MitM attacks, permitting an intruder to forge mailbox content and steal credentials...
An issue was discovered in Ruby through 2.6.7 2.7.x through 2.7.3 and 3.x through 3.0.1. Net::IMAP does not raise an exception when StartTLS fails with an an unknown response which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command aka a "StartTLS stripping attack."
...
Exim <= 4.96 STARTTLS Vulnerability
Exim is prone to a vulnerability in STARTTLS. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:exim:exim"; if description...
CVE-2021-38372
In KDE Trojita 0.7, man-in-the-middle attackers can create new folders because untagged responses from an IMAP server are accepted before STARTTLS...
CVE-2021-38371
The STARTTLS feature in Exim through 4.94.2 allows response injection buffering during MTA SMTP sending...