GLSA-202310-19 : Dovecot: Privilege Escalation

The remote host is affected by the vulnerability described in GLSA-202310-19 Dovecot: Privilege Escalation - An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect...

CVE-2021-33515 affecting package dovecot for versions less than 2.3.20-1

CVE-2021-33515 affecting package dovecot for versions less than 2.3.20-1. An upgraded version of the package is available that resolves this issue...

CVE-2021-29157 affecting package dovecot for versions less than 2.3.20-1

CVE-2021-29157 affecting package dovecot for versions less than 2.3.20-1. An upgraded version of the package is available that resolves this issue...

CVE-2022-30550 affecting package dovecot for versions less than 2.3.20-1

CVE-2022-30550 affecting package dovecot for versions less than 2.3.20-1. A patched version of the package is available...

CVE-2020-28200 affecting package dovecot for versions less than 2.3.20-1

CVE-2020-28200 affecting package dovecot for versions less than 2.3.20-1. An upgraded version of the package is available that resolves this issue...

Oracle Linux 6 : dovecot (ELSA-2011-0600)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0600 advisory. 2.0.9-2 - fix issues and assert crashes found in 2.0.9 lmtp,dotlock,zlib 2.0.9-1 - dovecot updated to 2.0.9 - fixed a high system CPU usage / high...

Oracle Linux 5 : dovecot (ELSA-2009-0205)

The remote Oracle Linux 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2009-0205 advisory. - Resolves: 436287, CVE-2008-4870 - Resolves: 469015, CVE-2008-4577 Tenable has extracted the preceding description block directly from the Oracle Linu...

Oracle Linux 7 : dovecot (ELSA-2020-1062)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1062 advisory. - fix CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory...

Oracle Linux 5 : dovecot (ELSA-2008-0297)

The remote Oracle Linux 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2008-0297 advisory. - LDAP+auth cache user login mixup CVE-2007-6598, 427575 - insecure mailextragroups option CVE-2008-1199, 436927 - update to latest upstream, fixes a f...

Oracle Linux 8 : dovecot (ELSA-2019-3467)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-3467 advisory. - fix CVE-2019-11500: IMAP protocol parser does not properly handle NUL byte when scanning data in quoted strings, leading to out of bounds heap memory writes...

CVE-2023-34108

mailcow is a mail server suite based on Dovecot, Postfix and other open source software, that provides a modern web UI for user/server administration. A vulnerability has been discovered in mailcow which allows an attacker to manipulate internal Dovecot variables by using specially crafted...

CVE-2023-34108 Manipulation of Internal Dovecot Variables in mailcow via crafted Passwords

mailcow is a mail server suite based on Dovecot, Postfix and other open source software, that provides a modern web UI for user/server administration. A vulnerability has been discovered in mailcow which allows an attacker to manipulate internal Dovecot variables by using specially crafted...

CVE-2023-34108 Manipulation of Internal Dovecot Variables in mailcow via crafted Passwords

mailcow is a mail server suite based on Dovecot, Postfix and other open source software, that provides a modern web UI for user/server administration. A vulnerability has been discovered in mailcow which allows an attacker to manipulate internal Dovecot variables by using specially crafted...

CVE-2023-34108 Manipulation of Internal Dovecot Variables in mailcow via crafted Passwords

mailcow is a mail server suite based on Dovecot, Postfix and other open source software, that provides a modern web UI for user/server administration. A vulnerability has been discovered in mailcow which allows an attacker to manipulate internal Dovecot variables by using specially crafted...

CVE-2023-34108

CVE-2023-34108 affects mailcow (Dovecot-based) where the passwd-verify.lua password verification can be exploited by authenticated attackers who can set their own password to craft a response like password= and inject key-value pairs that alter Dovecot internal variables. Technical details across...

PT-2023-24679 · Dovecot +1 · Dovecot +1

Name of the Vulnerable Software and Affected Versions: mailcow versions prior to 2023-05a Description: A vulnerability has been discovered in mailcow that allows an attacker to manipulate internal Dovecot variables by using specially crafted passwords during the authentication process. The issue...

mailcow 操作系统命令注入漏洞

mailcow is a mail server suite. mailcow suffers from an operating system command injection vulnerability that originates from allowing an attacker to manipulate internal Dovecot variables during authentication using a specially crafted password...

Debian: Security Advisory (DLA-0004-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-26490

mailcow is a dockerized email package, with multiple containers linked in one bridged network. The Sync Job feature - which can be made available to standard users by assigning them the necessary permission - suffers from a shell command injection. A malicious user can abuse this vulnerability to...

Command injection

mailcow is a dockerized email package, with multiple containers linked in one bridged network. The Sync Job feature - which can be made available to standard users by assigning them the necessary permission - suffers from a shell command injection. A malicious user can abuse this vulnerability to...