CVE-2019-25364

MailCarrier 2.51 vulnerability: a buffer overflow in the POP3 USER command enables remote code execution via a crafted oversized buffer. Affects MailCarrier 2.51; impact stated as high confidentiality, integrity, and availability risks (CVSS v3.1/4.0 values shown). The document does not list a co...

PT-2026-20539

MailCarrier 2.51 contains a buffer overflow vulnerability in the POP3 USER command that allows remote attackers to execute arbitrary code. Attackers can send a crafted oversized buffer to the POP3 service, overwriting memory and potentially gaining remote system access...

[SECURITY] Fedora 42 Update: nginx-1.28.2-1.fc42

Nginx is a web server and a reverse proxy server for HTTP, SMTP, POP3 and IMAP protocols, with a strong focus on high concurrency, performance and low memory usage...

BIT-PYTHON-2025-15367 POP3 command injection in user-controlled commands

The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters...

CVE-2025-15367

A flaw was found in the poplib module in the Python standard library. The poplib module does not reject control characters, such as newlines, in user-controlled input passed to POP3 commands. This issue allows an attacker to inject additional commands to be executed in the POP3 server. Mitigation...

CVE-2025-15367

CVE-2025-15367 concerns the Python poplib module. The vulnerability allows additional commands to be injected via newlines when a user-controlled command is passed, with mitigation noting that control characters are rejected. Connected advisories from multiple distros (Ubuntu USN-8018-1, AlmaLinu...

CVE-2025-14524

When an OAuth2 bearer token is used for an HTTPS transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new target host...

CVE-2025-34427 MailEnable < 10.54 Cleartext Credential Storage in AUTH.TAB

MailEnable versions prior to 10.54 contain a cleartext storage of credentials vulnerability that can lead to local credential compromise and account takeover. The product stores user and administrative passwords in plaintext within AUTH.TAB with overly permissive filesystem access. A local...

[SECURITY] Fedora 41 Update: fetchmail-6.5.6-1.fc41

Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC for retrieval...

EUVD-2016-6697

Malware in sbrugna...

EUVD-2024-16322

Malicious code in bioql PyPI...

EUVD-2024-16323

Malicious code in bioql PyPI...

EUVD-2024-16321

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2023-5422

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The functions to fetch e-mail via POP3 or IMAP as well as sending e-mail via SMTP use OpenSSL for static SSL or TLS based communication. As the SSLgetverifyresu...

MAL-2025-9239 Malicious code in @post-office-placement/screen-space-flags (npm)

The package @post-office-placement/screen-space-flags was found to contain malicious code...

CVE-2024-0528

A vulnerability, which was classified as critical, was found in CXBSoft Post-Office 1.0. Affected is an unknown function of the file /admin/pages/updatego.php of the component HTTP POST Request Handler. The manipulation of the argument version leads to sql injection. The exploit has been disclose...

CVE-2024-0529

A vulnerability has been found in CXBSoft Post-Office up to 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /apps/loginauth.php of the component HTTP POST Request Handler. The manipulation of the argument usernamelogin leads to sql injection...

CVE-2024-0530

A vulnerability was found in CXBSoft Post-Office up to 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /apps/reggo.php of the component HTTP POST Request Handler. The manipulation of the argument usernamereg leads to sql injection. The exploit has...

CVE-2023-26434

When adding an external mail account, processing of POP3 "capabilities" responses are not limited to plausible sizes. Attacker with access to a rogue POP3 service could trigger requests that lead to excessive resource usage and eventually service unavailability. We now limit accepted POP3 server...

YahooPOPs Security Vulnerabilities

YahooPOPs is an application from YahooPOPs that emulates a POP3/SMTP mail server and provides free POP3 and SMTP access to Yahoo! A security vulnerability exists in YahooPOPs version 1.6, which originates when the POP3 service allows remote denial of service via a long string on port 110 TCP...