1722 matches found
CVE-2022-24407
CVE-2022-24407 affects Cyrus SASL 2.1.17–2.1.27 (before 2.1.28); the SQL plugin (plugins/sql.c) fails to escape passwords in SQL INSERT/UPDATE, allowing a remote attacker to execute arbitrary SQL commands. This can enable privilege/escalation scenarios as described in vendor advisories. The mitig...
CVE-2022-24407
In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement...
Ubuntu 16.04 ESM : Cyrus SASL vulnerability (USN-5301-2)
The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5301-2 advisory. USN-5301-1 fixed a vulnerability in Cyrus. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Tenable has extracted the...
USN-5301-2 cyrus-sasl2 vulnerability
USN-5301-1 fixed a vulnerability in Cyrus. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Original advisory details: It was discovered that the Cyrus SASL SQL plugin incorrectly handled SQL input. A remote attacker could use this issue to execute arbitrar...
USN-5301-2: Cyrus SASL vulnerability
USN-5301-1 fixed a vulnerability in Cyrus. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Original advisory details: It was discovered that the Cyrus SASL SQL plugin incorrectly handled SQL input. A remote attacker could use this issue to execute arbitrar...
USN-5301-1: Cyrus SASL vulnerability
It was discovered that the Cyrus SASL SQL plugin incorrectly handled SQL input. A remote attacker could use this issue to execute arbitrary SQL commands...
USN-5301-1 cyrus-sasl2 vulnerability
It was discovered that the Cyrus SASL SQL plugin incorrectly handled SQL input. A remote attacker could use this issue to execute arbitrary SQL commands...
CVE-2022-24407
In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement...
UBUNTU-CVE-2022-24407
In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement...
PT-2022-1907 · Unknown +10 · Cyrus-Sasl +10
Name of the Vulnerable Software and Affected Versions: Cyrus SASL versions 2.1.17 through 2.1.27 Description: The issue is related to the implementation of the authentication mechanism in Cyrus SASL, where the SQL query structure is not properly protected. This could allow a remote attacker to...
FreeBSD : cyrus-sasl -- Escape password for SQL insert/update commands (022dde12-8f4a-11ec-83ac-080027415d17)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 022dde12-8f4a-11ec-83ac-080027415d17 advisory. - In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a S...
Cyrus Sasl SQL注入漏洞
Cyrus Sasl is a simple authentication from The Cyrus Team team. Enables application developers to easily integrate authentication mechanisms into applications in a generic way. Cyrus SASL A SQL injection vulnerability exists that stems from the Cyrus SASL SQL plugin incorrectly handling SQL input...
Ubuntu 18.04 LTS / 20.04 LTS : Cyrus SASL vulnerability (USN-5301-1)
The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5301-1 advisory. It was discovered that the Cyrus SASL SQL plugin incorrectly handled SQL input. A remote attacker could use this issue to execute arbitrary SQL...
[SECURITY] Fedora 34 Update: cyrus-imapd-3.2.8-2.fc34
The Cyrus IMAP Internet Message Access Protocol server provides access to personal mail, system-wide bulletin boards, news-feeds, calendar and contacts through the IMAP, JMAP, NNTP, CalDAV and CardDAV protocols. The Cyrus IMAP server is a scalable enterprise groupware system designed for use from...
Fedora: Security Advisory for cyrus-imapd (FEDORA-2022-d45bcc5447)
The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
[SECURITY] Fedora 35 Update: cyrus-imapd-3.2.8-2.fc35
The Cyrus IMAP Internet Message Access Protocol server provides access to personal mail, system-wide bulletin boards, news-feeds, calendar and contacts through the IMAP, JMAP, NNTP, CalDAV and CardDAV protocols. The Cyrus IMAP server is a scalable enterprise groupware system designed for use from...
Fedora: Security Advisory for cyrus-imapd (FEDORA-2022-c30b1a8aa3)
The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
AlmaLinux 8 : cyrus-sasl (ALSA-2020:4497)
The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2020:4497 advisory. - cyrus-sasl aka Cyrus SASL 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of- service in OpenLDAP via a malformed LDAP packet. The...
Rocky Linux 8 : cyrus-imapd (RLSA-2021:3492)
The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:3492 advisory. - Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service multiple-minute daemon hang via input that is mishandled during hash-table...
