CVE-2022-24732

CVE-2022-24732 affects Maddy Mail Server prior to 0.5.4, where PAM authentication does not enforce password expiry or account expiry checks. The root cause is missing expiry validation during PAM auth, enabling continued access for expired accounts unless manually filtered. The public description...

CVE-2022-24732 Maddy Mail Server does not implement account expiry

Maddy Mail Server is an open source SMTP compatible email server. Versions of maddy prior to 0.5.4 do not implement password expiry or account expiry checking when authenticating using PAM. Users are advised to upgrade. Users unable to upgrade should manually remove expired accounts via existing...

Maddy Mail Server 安全漏洞

Maddy Mail Server is a composable all-in-one mail server from the Russian individual developer Max Mazurov. A security vulnerability exists in maddy Mail Server versions prior to 0.5.4, which stems from not implementing password expiration or account expiration checks when using PAM for...

Use of a Key Past its Expiration Date and Insufficient Session Expiration in Maddy Mail Server

Impact Any configuration on any maddy version 0.5.4 using auth.pam is affected. No password expiry or account expiry checking is done when authenticating using PAM. Patches Patch is available as part of the 0.5.4 release. Workarounds If /etc/shadow authentication is used, it is possible to replac...

GHSA-6CP7-G972-W9M9 Use of a Key Past its Expiration Date and Insufficient Session Expiration in Maddy Mail Server

Impact Any configuration on any maddy version 0.5.4 using auth.pam is affected. No password expiry or account expiry checking is done when authenticating using PAM. Patches Patch is available as part of the 0.5.4 release. Workarounds If /etc/shadow authentication is used, it is possible to replac...

[SECURITY] Fedora 34 Update: cyrus-imapd-3.2.8-2.fc34

The Cyrus IMAP Internet Message Access Protocol server provides access to personal mail, system-wide bulletin boards, news-feeds, calendar and contacts through the IMAP, JMAP, NNTP, CalDAV and CardDAV protocols. The Cyrus IMAP server is a scalable enterprise groupware system designed for use from...

[SECURITY] Fedora 34 Update: clamav-0.103.5-1.fc34

Clam AntiVirus is an anti-virus toolkit for UNIX. The main purpose of this software is the integration with mail servers attachment scanning. The package provides a flexible and scalable multi-threaded daemon, a command line scanner, and a tool for automatic updating via Internet. The programs ar...

PT-2022-10299 · Exim +5 · Exim +5

Name of the Vulnerable Software and Affected Versions: libspf2 versions prior to 1.2.11 Description: The issue is related to a four-byte heap-based buffer overflow that might allow remote attackers to execute arbitrary code via an unauthenticated e-mail message from anywhere on the Internet with ...

Apache James 安全漏洞

Apache James is an open source Smtp and Pop3 mail transfer agent and Nntp news server written entirely in Java by the Apache Foundation. commands to trigger an infinite loop that can be used in denial-of-service attacks...

Dropbox: Send Fax from Anyone's HelloFax Account Due to Misconfigured Email Validation

The report demonstrates a method of using up HelloFax credits by forging email requests. A fix for the issue has been released and it was applied for existing and new users through an automatic update. An attacker could exploit this vulnerability by entering a victim’s HelloFax line number into a...

Cloudflare Public Bug Bounty: Hijack all emails sent to any domain that uses Cloudflare Email Forwarding

The Email Routing feature enables Cloudflare users to create any number of custom email addresses and route all incoming messages to the user's preferred inboxes. Due to a bug in zone ownership verification, it was possible to configure Email Routing to redirect e-mail messages for an unverified...

CVE-2021-44143

A flaw was found in mbsync in isync 1.4.0 through 1.4.3. Due to an unchecked condition, a malicious or compromised IMAP server could use a crafted mail message that lacks headers i.e., one that starts with an empty line to provoke a heap overflow, which could conceivably be exploited for remote...

Gallagher Command Centre Server信任管理问题漏洞

Gallagher Command Centre Server is a management system used by Gallagher New Zealand to monitor and manage infrastructure in buildings.Gallagher Command Centre Server has a security vulnerability that stems from incorrect certificate validation in the SMTP client, which could be exploited by an...

Microsoft Exchange Server Spoofing Vulnerability (CNVD-2021-101659)

Microsoft Exchange Server is a mail server and calendar server developed by Microsoft. A spoofing vulnerability exists in Microsoft Exchange Server. No detailed vulnerability details are provided at this time...

CVE-2021-41590

In Gradle Enterprise through 2021.3, probing of the server-side network environment can occur via an SMTP configuration test. The installation configuration user interface available to administrators allows testing the configured SMTP server settings. This test function can be used to identify th...

CVE-2021-28975

WP Mailster 1.6.18.0 allows XSS when a victim opens a mail server's details in the mstservers page, for a crafted serverhost, servername, or connectionparameter parameter...

The vulnerability of the Cyrus IMAP mail server’s annotations relates to the improper assignment of permissions for critical resources, allowing a perpetrator to cause a service failure.

The vulnerability of the server annotation of the Cyrus IMAP mail server is related to the improper assignment of permissions for the critical resource. Exploiting this vulnerability can allow a malicious actor to cause service failures...

RLSA-2021:3492 Important: cyrus-imapd security update

The Cyrus IMAP server provides access to personal mail, system-wide bulletin boards, news-feeds, calendar and contacts through the IMAP, JMAP, NNTP, CalDAV and CardDAV protocols. Security Fixes: cyrus-imapd: Denial of service via string hashing algorithm collisions CVE-2021-33582 For more details...

DEBIAN-CVE-2021-33582

Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service multiple-minute daemon hang via input that is mishandled during hash-table interaction. Because there are many insertions into a single bucket, strcmp becomes slow. This is fixed in 3.4.2, 3.2.8, and 3.0.16...

Cyrus IMAP 加密问题漏洞

Cyrus IMAP is an open source mail server for the IMAP Interactive Mail Access Protocol protocol based on Unix and Linux operating systems. A cryptographic issue vulnerability exists in Cyrus IMAP that stems from the product's internal hash table not using a valid string encryption algorithm...