CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-40110 – Apache James IMAP vulnerable to a ReDoS
https://notcve.org/view.php?id=CVE-2021-40110
In Apache James, using Jazzer fuzzer, we identified that an IMAP user can craft IMAP LIST commands to orchestrate a Denial Of Service using a vulnerable Regular expression. This affected Apache James prior to 3.6.1 We recommend upgrading to Apache James 3.6.1 or higher , which enforce the use of RE2J regular expression engine to execute regex in linear time without back-tracking. En Apache James, usando Jazzer fuzzer, identificamos que un usuario de IMAP puede diseñar comandos IMAP LIST para orquestar una denegación de servicio usando una expresión regular vulnerable. Esto afectaba a Apache James versiones anteriores a 3.6.1. Recomendamos actualizar a Apache James versión 3.6.1 o superior, que refuerza el uso del motor de expresiones regulares RE2J para ejecutar regex en tiempo lineal sin retroceso • http://www.openwall.com/lists/oss-security/2022/01/04/2 https://www.openwall.com/lists/oss-security/2022/01/04/2 •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2021-38542 – Apache James vulnerable to STARTTLS command injection (IMAP and POP3)
https://notcve.org/view.php?id=CVE-2021-38542
Apache James prior to release 3.6.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. This can result in Man-in -the-middle command injection attacks, leading potentially to leakage of sensible information. Apache James versiones anteriores a 3.6.1, es vulnerable a un ataque de buffering que es basado en el uso del comando STARTTLS. Esto puede resultar en ataques de inyección de comandos de tipo "Man-in-the-middle", conllevando potencialmente a un filtrado de información confidencial • http://www.openwall.com/lists/oss-security/2022/01/04/1 http://www.openwall.com/lists/oss-security/2022/09/20/1 https://www.openwall.com/lists/oss-security/2022/01/04/1 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 9.8EPSS: 0%CPEs: 32EXPL: 0CVE-2019-0228
https://notcve.org/view.php?id=CVE-2019-0228
Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF. Apache PDFBox versión 2.0.14 no inicializa correctamente el analizador XML, lo que permite a los atacantes dependientes del contexto realizar ataques de Entidades Externas XML (XXE) por medio de un XFDF creado. • https://lists.apache.org/thread.html/1a3756557f8cb02790b7183ccf7665ae23f608a421c4f723113bca79%40%3Cusers.pdfbox.apache.org%3E https://lists.apache.org/thread.html/8a19bd6d43e359913341043c2a114f91f9e4ae170059539ad1f5673c%40%3Ccommits.tika.apache.org%3E https://lists.apache.org/thread.html/bc8db1bf459f1ad909da47350ed554ee745abe9f25f2b50cad4e06dd%40%3Cserver-dev.james.apache.org%3E https://lists.apache.org/thread.html/be86fcd7cd423a3fe6b73a3cb9d7cac0b619d0deb99e6b5d172c98f4%40%3Ccommits.tika.apache.org%3E https://lists.apache.org/thread.html/r0a2141abeddae66dd57025f1681c8425834062b7c0c7e0b1d830a95d&# • CWE-611: Improper Restriction of XML External Entity Reference •