Lucene search

K

9 matches found

CVE
CVE
added 2019/11/15 4:15 a.m.216 views

CVE-2019-18928

Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentication context of an unrelated previous request that arrived over the same connection.

9.8CVSS9.6AI score0.005EPSS
CVE
CVE
added 2019/06/03 8:29 p.m.158 views

CVE-2019-11356

The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name.

9.8CVSS9.4AI score0.25844EPSS
CVE
CVE
added 2021/09/01 6:15 a.m.118 views

CVE-2021-33582

Cyrus IMAP before 3.4.2 allows remote attackers to cause a denial of service (multiple-minute daemon hang) via input that is mishandled during hash-table interaction. Because there are many insertions into a single bucket, strcmp becomes slow. This is fixed in 3.4.2, 3.2.8, and 3.0.16.

7.5CVSS7.1AI score0.0373EPSS
CVE
CVE
added 2019/12/16 2:15 p.m.90 views

CVE-2019-19783

An issue was discovered in Cyrus IMAP before 2.5.15, 3.0.x before 3.0.13, and 3.1.x through 3.1.8. If sieve script uploading is allowed (3.x) or certain non-default sieve options are enabled (2.x), a user with a mail account on the service can use a sieve script containing a fileinto directive to c...

6.5CVSS6.3AI score0.01032EPSS
CVE
CVE
added 2015/12/03 8:59 p.m.67 views

CVE-2015-8076

The index_urlfetch function in index.c in Cyrus IMAP 2.3.x before 2.3.19, 2.4.x before 2.4.18, 2.5.x before 2.5.4 allows remote attackers to obtain sensitive information or possibly have unspecified other impact via vectors related to the urlfetch range, which triggers an out-of-bounds heap read.

7.5CVSS4.3AI score0.02628EPSS
CVE
CVE
added 2021/05/10 2:15 p.m.67 views

CVE-2021-32056

Cyrus IMAP before 3.2.7, and 3.3.x and 3.4.x before 3.4.1, allows remote authenticated users to bypass intended access restrictions on server annotations and consequently cause replication to stall.

4.3CVSS4.6AI score0.00208EPSS
CVE
CVE
added 2015/12/03 8:59 p.m.53 views

CVE-2015-8078

Integer overflow in the index_urlfetch function in imap/index.c in Cyrus IMAP 2.3.19, 2.4.18, and 2.5.6 allows remote attackers to have unspecified impact via vectors related to urlfetch range checks and the section_offset variable. NOTE: this vulnerability exists because of an incomplete fix for C...

7.5CVSS4.3AI score0.02628EPSS
CVE
CVE
added 2015/12/03 8:59 p.m.48 views

CVE-2015-8077

Integer overflow in the index_urlfetch function in imap/index.c in Cyrus IMAP 2.3.19, 2.4.18, and 2.5.6 allows remote attackers to have unspecified impact via vectors related to urlfetch range checks and the start_octet variable. NOTE: this vulnerability exists because of an incomplete fix for CVE-...

7.5CVSS4.3AI score0.03429EPSS
CVE
CVE
added 2017/09/10 7:29 a.m.44 views

CVE-2017-14230

In the mboxlist_do_find function in imap/mboxlist.c in Cyrus IMAP before 3.0.4, an off-by-one error in prefix calculation for the LIST command caused use of uninitialized memory, which might allow remote attackers to obtain sensitive information or cause a denial of service (daemon crash) via a 'LI...

9.1CVSS8.8AI score0.00935EPSS