154 matches found
An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocols: SMPTP(S) IMAP(S) POP3(S) and LDAP(S) (openldap only).
...
ALPINE-CVE-2022-22576
An improper authentication vulnerability exists in curl 7.33.0 to and including 7.82.0 which might allow reuse OAUTH2-authenticated connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer. This affects SASL-enabled protocol...
If you get an email saying “Item stopped due to unpaid customs fee”, it’s a fake
Our spam traps recently caught a phishing scam that neatly illustrates some of the tactics scammers use routinely to avoid both human intuition, and automatic detection. The scam starts with an unsolicited email, of course… The scam email is ostensibly from the Post Office, an instantly...
curl: Requirement to use TLS not properly enforced for IMAP, POP3, and FTP protocols
A flaw was found in curl. This flaw lies in the --ssl-reqd option or related settings in libcurl. Users specify this flag to upgrade to TLS when communicating with either IMAP, POP3 or a FTP server. An attacker controlling such servers could return a crafted response which could lead to curl clie...
curl: Requirement to use TLS not properly enforced for IMAP, POP3, and FTP protocols
A flaw was found in curl. This flaw lies in the --ssl-reqd option or related settings in libcurl. Users specify this flag to upgrade to TLS when communicating with either IMAP, POP3 or a FTP server. An attacker controlling such servers could return a crafted response which could lead to curl clie...
DEBIAN-CVE-2021-22946
A user can tell curl = 7.20.0 and = 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server --ssl-reqd on the command line orCURLOPTUSESSL set to CURLUSESSLCONTROL or CURLUSESSLALL withlibcurl. This requirement could be bypassed if the server would return a...
DEBIAN-CVE-2021-22947
When curl = 7.20.0 and = 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instea...
AZL-6365 CVE-2021-22946 affecting package curl for versions less than 7.82.0-1
A user can tell curl = 7.20.0 and = 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server --ssl-reqd on the command line orCURLOPTUSESSL set to CURLUSESSLCONTROL or CURLUSESSLALL withlibcurl. This requirement could be bypassed if the server would return a...
CVE-2021-22947
When curl = 7.20.0 and = 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instea...
PT-2021-4653 · Curl +10 · Curl +10
Name of the Vulnerable Software and Affected Versions: curl versions 7.20.0 through 7.78.0 Description: The issue concerns the implementation of the STARTTLS protocol in curl, which can lead to insufficient authentication of data. This allows a Man-In-The-Middle attacker to inject fake responses...
DEBIAN-CVE-2021-38084
An issue was discovered in the POP3 component of Courier Mail Server before 1.1.5. Meddler-in-the-middle attackers can pipeline commands after the POP3 STLS command, injecting plaintext commands into an encrypted user session...
UBUNTU-CVE-2021-38084
An issue was discovered in the POP3 component of Courier Mail Server before 1.1.5. Meddler-in-the-middle attackers can pipeline commands after the POP3 STLS command, injecting plaintext commands into an encrypted user session...
Courier Mail Server 注入漏洞
Courier Mail Server is an application. A courier mail server. A security vulnerability exists in versions of Courier Mail Server prior to 1.1.5, which can be exploited by attackers to enter malicious commands after POP3 STLS commands and inject malicious commands into an encrypted user session...
KDE KMail Information Disclosure Vulnerability
KDE KMail is an e-mail component of Kontact personal information management suite from the KDE community. An information disclosure vulnerability exists in KDE KMail version 19.12.3, which originates from unencrypted POP3 communication by the program and can be exploited by an attacker to obtain...
DEBIAN-CVE-2020-15954
KDE KMail 19.12.3 aka 5.13.3 engages in unencrypted POP3 communication during times when the UI indicates that encryption is in use...
DEBIAN-CVE-2020-15953
LibEtPan through 1.9.4, as used in MailCore 2 through 0.6.3 and other products, has a STARTTLS buffering issue that affects IMAP, SMTP, and POP3. When a server sends a "begin TLS" response, the client reads additional data e.g., from a meddler-in-the-middle attacker and evaluates it in a TLS...
DEBIAN-CVE-2020-14928
evolution-data-server eds through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3. When a server sends a "begin TLS" response, eds reads additional data and evaluates it in a TLS context, aka "response injection."...
UBUNTU-CVE-2020-14928
evolution-data-server eds through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3. When a server sends a "begin TLS" response, eds reads additional data and evaluates it in a TLS context, aka "response injection."...
Dovecot Information Disclosure Vulnerability
Dovecot is an open source based on Linux/UNIX-like systems IMAP and POP3 mail server . An information disclosure vulnerability exists in Dovecot. The vulnerability stems from a configuration or other error in the operation of a networked system or product. An unauthorized attacker could exploit t...