2061 matches found
PT-2026-89140
Name of the Vulnerable Software and Affected Versions Cyrus IMAP versions prior to 3.12.4 Description An issue exists where the Mailbox/set function allows a sharee to modify a special-use role on shared mailboxes. An authenticated user possessing the maySetKeywords permission on another user's...
PT-2026-89141
Name of the Vulnerable Software and Affected Versions Cyrus IMAP versions prior to 3.12.4 Description A Sieve mailbox existence oracle exists where an authenticated user can install a Sieve script to determine if another user's private mailbox exists or read the value of shared mailbox annotation...
CVE-2026-61910
An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with maySetKeywords on another user's mailbox could change that mailbox's specialuse annotation. This could allow the sharee to change the shared...
CVE-2026-61907
This vulnerability affects Cyrus IMAP prior to version 3.12.4 , where the JMAP snooze operation bypasses the destination-mailbox ACL . An authenticated user who holds insert permissions on another user's snoozed mailbox can force mail insertion into that user's inbox or any other mailbox whose ID...
CVE-2026-61910
An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with maySetKeywords on another user's mailbox could change that mailbox's specialuse annotation. This could allow the sharee to change the shared...
CVE-2026-61910: Incorrect Authorization
An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with maySetKeywords on another user's mailbox could change that mailbox's specialuse annotation. This could allow the sharee to change the shared...
CVE-2026-61911
An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed whether another user's private mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto branch fired...
CVE-2026-61911
Cyrus IMAP before 3.12.4 is affected by a Sieve mailbox existence oracle . An authenticated user can install a Sieve script that probes whether another user's private mailbox exists, or read the value of shared mailbox annotations , by observing which fileinto branch fires during LMTP delivery. T...
CVE-2026-61910
Cyrus IMAP before 3.12.4 is affected by a flaw in the Mailbox/set command, where an authenticated user holding the maySetKeywords privilege on another user's mailbox can alter its special-use annotation . This allows the sharee to reassign the shared mailbox to roles such as archived or snoozed ,...
CVE-2026-61910
An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with maySetKeywords on another user's mailbox could change that mailbox's specialuse annotation. This could allow the sharee to change the shared...
CVE-2026-61910
An issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with maySetKeywords on another user's mailbox could change that mailbox's specialuse annotation. This could allow the sharee to change the shared...
CVE-2026-61911
An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed whether another user's private mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto branch fired...
Vulnerabilities in Microsoft Exchange servers
Microsoft has identified 9 vulnerabilities in Exchange Server. A malicious individual can exploit these vulnerabilities to carry out Denial-of-Service attacks, impersonate other users, gain elevated privileges, execute arbitrary code, and/or access sensitive data. The most severe vulnerability,...
Security Bulletin: IBM Sterling Global Availability Mailbox affected by a vulnerability in Bouncy Castle 1.84
Summary Bouncy Castle for Java before 1.85 was affected with the CVE-2026-59641 Vulnerability Details CVEID:CVE-2026-59641 DESCRIPTION: In Bouncy Castle for Java before 1.85, S/MIME validator trusts signer-asserted signingTime for path validation. This issue also affects Bouncy Castle for Java LT...
SUSE CVE-2026-80822
In the Linux kernel, the following vulnerability has been resolved: mailbox: mchp-ipc-sbi: Add null check for devmkasprintf Add a check to see if devmkasprintf is not NULL in mchpipcgetclusteraggrirq, returning -ENOMEM if the function failed...
CVE-2026-86497
In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials...
CVE-2026-86497
In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without re-authentication allowed a project administrator to exfiltrate stored mailbox credentials...
CVE-2026-86497
JetBrains YouTrack versions before 2026.2.18769 contained a vulnerability in the mailbox configuration flow. Changing a mailbox host did not require re-authentication, allowing a project administrator to exfiltrate stored mailbox credentials . The CVSS 3.1 score is 6.8 (MEDIUM) with a network att...
