CVSS: 7.5EPSS: 8%CPEs: 82EXPL: 0CVE-2014-3430 – dovecot: denial of service through maxxing out SSL connections
https://notcve.org/view.php?id=CVE-2014-3430
14 May 2014 — Dovecot 1.1 before 2.2.13 and dovecot-ee before 2.1.7.7 and 2.2.x before 2.2.12.12 does not properly close old connections, which allows remote attackers to cause a denial of service (resource consumption) via an incomplete SSL/TLS handshake for an IMAP/POP3 connection. Dovecot 1.1 anterior a 2.2.13 y dovecot-ee anterior a 2.1.7.7 y 2.2.x anterior a 2.2.12.12 no cierra debidamente conexiones antiguas, lo que permite a atacantes remotos causar una denegación de servicio (consumo de recursos) a través de una ... • http://advisories.mageia.org/MGASA-2014-0223.html • CWE-287: Improper Authentication CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.8EPSS: 0%CPEs: 51EXPL: 0CVE-2013-6171 – Ubuntu Security Notice USN-3556-2
https://notcve.org/view.php?id=CVE-2013-6171
09 Dec 2013 — checkpassword-reply in Dovecot before 2.2.7 performs setuid operations to a user who is authenticating, which allows local users to bypass authentication and access virtual email accounts by attaching to the process and using a restricted file descriptor to modify account information in the response to the dovecot-auth server. checkpassword-reply en Dovecot anteriores a 2.2.7 ejecuta operaciones setuid a usuarios que se están autenticando, lo cual permite a usuarios locales sortear la autenticación y accede... • http://cpanel.net/tsr-2013-0010-full-disclosure • CWE-287: Improper Authentication •
CVSS: 5.9EPSS: 0%CPEs: 16EXPL: 0CVE-2011-4318 – dovecot: proxy destination host name not checked against SSL certificate name
https://notcve.org/view.php?id=CVE-2011-4318
07 Mar 2013 — Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate for a different hostname. Dovecot v2.0.x antes de v2.0.16, cuando ssl o starttls está disponible y hostname se usa para definir la destinación del proxy, que no verifica que el servidor ho... • http://hg.dovecot.org/dovecot-2.0/rev/5e9eaf63a6b1 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 6%CPEs: 31EXPL: 0CVE-2011-1929 – dovecot: potential crash when parsing header names that contain NUL characters
https://notcve.org/view.php?id=CVE-2011-1929
24 May 2011 — lib-mail/message-header-parser.c in Dovecot 1.2.x before 1.2.17 and 2.0.x before 2.0.13 does not properly handle '\0' characters in header names, which allows remote attackers to cause a denial of service (daemon crash or mailbox corruption) via a crafted e-mail message. lib-mail/message-header-parser.c en Dovecot v1.2.x antes de v1.2.17 y v2.0.x antes de v2.0.13 no controla correctamente los caracteres '\ 0 ' en los nombres de cabecera, lo que permite a atacantes remotos provocar una denegación de servicio... • http://dovecot.org/pipermail/dovecot/2011-May/059085.html • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 13EXPL: 0CVE-2011-2166 – dovecot: authenticated remote bypass of intended access restrictions
https://notcve.org/view.php?id=CVE-2011-2166
24 May 2011 — script-login in Dovecot 2.0.x before 2.0.13 does not follow the user and group configuration settings, which might allow remote authenticated users to bypass intended access restrictions by leveraging a script. La secuencia de comandos de inicio de sesión en Dovecot v2.0.x antes de v2.0.13 no sigue la configuración del usuario y grupo, lo que podría permitir a usuarios remotos autenticados eludir las restricciones de acceso destinados al aprovechar una secuencia de comandos. • http://dovecot.org/pipermail/dovecot/2011-May/059085.html • CWE-16: Configuration •
CVSS: 7.5EPSS: 0%CPEs: 13EXPL: 0CVE-2011-2167 – dovecot: directory traversal due to not obeying chroot directive
https://notcve.org/view.php?id=CVE-2011-2167
24 May 2011 — script-login in Dovecot 2.0.x before 2.0.13 does not follow the chroot configuration setting, which might allow remote authenticated users to conduct directory traversal attacks by leveraging a script. Las secuencias de comandos de inicio de sesión en Dovecot v2.0.x antes de v2.0.13 no sigue las opciones de configuración de chroot, lo que podría permitir a usuarios remotos autenticados realizar ataques de directorio transversal mediante el aprovechamiento de una secuencia de comandos. • http://dovecot.org/pipermail/dovecot/2011-May/059085.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.5EPSS: 0%CPEs: 16EXPL: 0CVE-2010-3779
https://notcve.org/view.php?id=CVE-2010-3779
06 Oct 2010 — Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.beta2 grants the admin permission to the owner of each mailbox in a non-public namespace, which might allow remote authenticated users to bypass intended access restrictions by changing the ACL of a mailbox, as demonstrated by a symlinked shared mailbox. Dovecot v1.2.x anterior a v1.2.15 y v2.0.x anterior a v2.0.beta2 proporciona permisos de administrador al propietario del cada buzón de correo en un espacio de nombres no público (non-public namespace), lo qu... • http://secunia.com/advisories/43220 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.5EPSS: 1%CPEs: 15EXPL: 0CVE-2010-3780 – Dovecot: Busy master process, receiving a lot of SIGCHLD signals rapidly while logging, could die
https://notcve.org/view.php?id=CVE-2010-3780
06 Oct 2010 — Dovecot 1.2.x before 1.2.15 allows remote authenticated users to cause a denial of service (master process outage) by simultaneously disconnecting many (1) IMAP or (2) POP3 sessions. Dovecot v1.2.x anterior a v1.2.15 permite a usuarios autenticados remotamente provocar una denegación de servicio (interrupción del proceso maestro) mediante la desconexión simultanea de varias sesiones (1) IMAP o (2) POP3 • http://secunia.com/advisories/43220 •
CVSS: 8.1EPSS: 0%CPEs: 20EXPL: 0CVE-2010-3706
https://notcve.org/view.php?id=CVE-2010-3706
06 Oct 2010 — plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.5 interprets an ACL entry as a directive to add to the permissions granted by another ACL entry, instead of a directive to replace the permissions granted by another ACL entry, in certain circumstances involving the private namespace of a user, which allows remote authenticated users to bypass intended access restrictions via a request to read or modify a mailbox. plugins/acl/acl-backend-vfile.c en Dovecot v1.2.x anterior a ... • http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00001.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.5EPSS: 0%CPEs: 20EXPL: 0CVE-2010-3707 – Dovecot: Failed to properly update ACL cache, when multiple rules defined rights for one subject
https://notcve.org/view.php?id=CVE-2010-3707
06 Oct 2010 — plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.5 interprets an ACL entry as a directive to add to the permissions granted by another ACL entry, instead of a directive to replace the permissions granted by another ACL entry, in certain circumstances involving more specific entries that occur after less specific entries, which allows remote authenticated users to bypass intended access restrictions via a request to read or modify a mailbox. plugins/acl/acl-backend-vfile.c ... • http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00001.html • CWE-264: Permissions, Privileges, and Access Controls •