CVE-2026-27855

Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache is enabled, and username is altered in passdb, then OTP credentials can be cached so that same OTP reply is valid. An attacker able to observe an OTP exchange is able to log in as the user. If...

Open-Xchange OX Dovecot Pro 安全漏洞

Open-Xchange OX Dovecot Pro is a mail storage and delivery system provided by the German company Open-Xchange. Open-Xchange OX Dovecot Pro has a security vulnerability. This vulnerability allows attackers to send specially crafted messages before authentication, thereby allocating a large amount ...

Open-Xchange OX Dovecot Pro 安全漏洞

Open-Xchange OX Dovecot Pro is a mail storage and delivery system provided by the German company Open-Xchange. Open-Xchange OX Dovecot Pro has a security vulnerability; this vulnerability arises from the possibility of additional memory allocation when specific NOOP commands are sent, which could...

Open-Xchange OX Dovecot Pro 安全漏洞

Open-Xchange OX Dovecot Pro is a mail storage and delivery system provided by the German company Open-Xchange. Open-Xchange OX Dovecot Pro has a security vulnerability that can be exploited under certain conditions, leading to a replay attack, which may allow attackers to log in as users...

Open-Xchange OX Dovecot Pro 安全漏洞

Open-Xchange OX Dovecot Pro is a mail storage and delivery system provided by the German company Open-Xchange. Open-Xchange OX Dovecot Pro has a security vulnerability. This vulnerability stems from the ManageSieve AUTHENTICATE command failing when literal values are used as SASL initial response...

UBUNTU-CVE-2026-27855

Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache is enabled, and username is altered in passdb, then OTP credentials can be cached so that same OTP reply is valid. An attacker able to observe an OTP exchange is able to log in as the user. If...

UBUNTU-CVE-2025-59031

Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachments. Attacker can use specially crafted OOXML documents to cause unintended files on the system to be indexed and subsequently ending up in FTS indexes. Do not use the provided...

OPENSUSE-SU-2026:10442-1 dovecot24-2.4.3-1.1 on GA media

These are all security issues fixed in the dovecot24-2.4.3-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2025-59031

Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachments. Attacker can use specially crafted OOXML documents to cause unintended files on the system to be indexed and subsequently ending up in FTS indexes. Do not use the provided...

MiracleLinux 8 : dovecot-2.3.8-9.el8 (AXSA:2021-2023:02)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-2023:02 advisory. dovecot: IMAP hibernation function allows mail access CVE-2020-24386 dovecot: Denial of service via mail MIME parsing CVE-2020-25275 Tenable has...

MiracleLinux 8 : dovecot-2.3.16-3.el8 (AXSA:2022-4213:02)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-4213:02 advisory. dovecot: Privilege escalation when similar master and non-master passdbs are used CVE-2022-30550 Tenable has extracted the preceding description block direct...

MiracleLinux 8 : dovecot-2.3.16-6.el8_10 (AXSA:2024-8878:05)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-8878:05 advisory. dovecot: using a large number of address headers may trigger a denial of service CVE-2024-23184 dovecot: very large headers can cause resource...

MiracleLinux 7 : dovecot-2.2.36-6.el7.1 (AXSA:2020-288:02)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-288:02 advisory. dovecot: Resource exhaustion via deeply nested MIME parts CVE-2020-12100 dovecot: Out of bound reads in dovecot NTLM implementation CVE-2020-12673...

MiracleLinux 8 : dovecot-2.3.16-2.el8 (AXSA:2022-3412:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2022-3412:01 advisory. dovecot: plaintext commands injection CVE-2021-33515 Tenable has extracted the preceding description block directly from the MiracleLinux security advisory...

MiracleLinux 8 : dovecot-2.3.8-2.el8.2 (AXSA:2020-546:03)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-546:03 advisory. dovecot: Resource exhaustion via deeply nested MIME parts CVE-2020-12100 dovecot: Out of bound reads in dovecot NTLM implementation CVE-2020-12673...

MiracleLinux 9 : dovecot-2.3.16-11.el9_4.1 (AXSA:2024-8803:04)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-8803:04 advisory. dovecot: using a large number of address headers may trigger a denial of service CVE-2024-23184 dovecot: very large headers can cause resource...

MiracleLinux 9 : dovecot-2.3.16-7.el9 (AXSA:2023-4711:01)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2023-4711:01 advisory. dovecot: Privilege escalation when similar master and non-master passdbs are used CVE-2022-30550 Tenable has extracted the preceding description block direct...

MiracleLinux 7 : dovecot-2.2.36-6.el7 (AXSA:2020-4708:01)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2020-4708:01 advisory. dovecot: Improper certificate validation CVE-2019-3814 dovecot: Buffer overflow in indexer-worker process results in privilege escalation...

MiracleLinux 8 : dovecot-2.3.8-4.el8 (AXSA:2021-1195:01)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-1195:01 advisory. dovecot: command followed by sufficient number of newlines leads to use-after-free CVE-2020-10958 dovecot: sending mail with empty quoted localpart...

MiracleLinux 4 : dovecot-2.0.9-5.AXS4 (AXSA:2013-272:01)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2013-272:01 advisory. Dovecot is an IMAP server for Linux/UNIX-like systems, written with security primarily in mind. It also contains a small POP3 server. It supports mai...