Search CVE reports
1 – 10 of 48029 results
A weakness has been identified in Orc discount up to 3.0.1.2. This issue affects the function compile of the file markdown.c of the component Markdown Handler. This manipulation causes uncontrolled recursion. The attack is...
1 affected package
discount
| Package | 16.04 LTS |
|---|---|
| discount | Needs evaluation |
v2.4/v3.1 regression: auth-ldap is not escaping usernames. If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This leads to potentially bypassing restrictions and...
1 affected package
dovecot
| Package | 16.04 LTS |
|---|---|
| dovecot | Not affected |
v3.0.2+ regression: Message headers MIME parameter parsing can cause excessive CPU usage. A mail message containing excessive amount of RFC 2231 MIME parameters causes LMTP to use too much CPU. A suitably formatted mail message...
1 affected package
dovecot
| Package | 16.04 LTS |
|---|---|
| dovecot | Vulnerable |
managesieve-login out-of-memory DoS. Attacker can send a specifically crafted message before authentication that causes managesieve to allocate large amount of memory. Attacker can force managesieve-login to be unavailable by...
1 affected package
dovecot
| Package | 16.04 LTS |
|---|---|
| dovecot | Vulnerable |
imap-login: Excessive memory usage DoS. Sending "NOOP (((...)))" command with 4000 parenthesis open+close results in ~1MB extra memory usage. Longer commands will result in client disconnection. This 1 MB can be left allocated for...
1 affected package
dovecot
| Package | 16.04 LTS |
|---|---|
| dovecot | Not affected |
doveadm: Credentials verified without timing safety. Doveadm credentials are verified using direct comparison which is susceptible to timing oracle attack. An attacker can use this to determine the configured credentials. Figuring...
1 affected package
dovecot
| Package | 16.04 LTS |
|---|---|
| dovecot | Not affected |
auth: OTP driver vulnerable to replay attack. Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache is enabled, and username is altered in passdb, then OTP credentials can be cached so...
1 affected package
dovecot
| Package | 16.04 LTS |
|---|---|
| dovecot | Vulnerable |
v2.4/v3.1 regression: SQL injection allows bypassing authentication. Dovecot SQL based authentication can be bypassed when auth_username_chars is cleared by admin. This vulnerability allows bypassing authentication for any user...
1 affected package
dovecot
| Package | 16.04 LTS |
|---|---|
| dovecot | Not affected |
auth: Path traversal in passwd-file passdb using `%d` (domain) escapes base directory and opens `/etc/passwd`Pre-auth path traversal in passwd-file passdb using `%d` (domain) escapes base directory and opens `/etc/passwd`. When...
1 affected package
dovecot
| Package | 16.04 LTS |
|---|---|
| dovecot | Vulnerable |
Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code
1 affected package
plexus-utils
| Package | 16.04 LTS |
|---|---|
| plexus-utils | Needs evaluation |