CVSS: 9.8EPSS: 3%CPEs: 12EXPL: 0CVE-2009-3235 – cyrus-impad: CMU sieve buffer overflows
https://notcve.org/view.php?id=CVE-2009-3235
17 Sep 2009 — Multiple stack-based buffer overflows in the Sieve plugin in Dovecot 1.0 before 1.0.4 and 1.1 before 1.1.7, as derived from Cyrus libsieve, allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted SIEVE script, as demonstrated by forwarding an e-mail message to a large number of recipients, a different vulnerability than CVE-2009-2632. Múltiples desbordamientos de búfer basados en pila en el complemento -plugin- Sieve de Dovecot v1.0 anterior a... • http://dovecot.org/list/dovecot-news/2009-September/000135.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-121: Stack-based Buffer Overflow •
CVSS: 9.1EPSS: 0%CPEs: 21EXPL: 0CVE-2008-5301
https://notcve.org/view.php?id=CVE-2008-5301
01 Dec 2008 — Directory traversal vulnerability in the ManageSieve implementation in Dovecot 1.0.15, 1.1, and 1.2 allows remote attackers to read and modify arbitrary .sieve files via a ".." (dot dot) in a script name. Vulnerabilidad de salto de directorio en la implementación de ManageSieve en Dovecot 1.0.15, 1.1, y 1.2 permite a atacantes remotos leer y modificar arbitrariamente ficheros .sieve a través de un ".." (punto punto) en el nombre de un script. • http://secunia.com/advisories/32768 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 1%CPEs: 7EXPL: 0CVE-2008-4577 – dovecot: incorrect handling of negative rights in the ACL plugin
https://notcve.org/view.php?id=CVE-2008-4577
15 Oct 2008 — The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access restrictions. El plugin ACL en Dovecot anterior a 1.1.4 amenaza los derechos del acceso negativo como si fueran derechos de acceso positivos, lo que permite a atacantes evitar las restricciones de acceso previstas. • http://bugs.gentoo.org/show_bug.cgi?id=240409 • CWE-863: Incorrect Authorization •
CVSS: 9.1EPSS: 0%CPEs: 57EXPL: 0CVE-2008-4578
https://notcve.org/view.php?id=CVE-2008-4578
15 Oct 2008 — The ACL plugin in Dovecot before 1.1.4 allows attackers to bypass intended access restrictions by using the "k" right to create unauthorized "parent/child/child" mailboxes. El plugin ACL en Dovecot anterior a 1.1.4 permite a atacantes remotos evitar las restricciones de acceso previstas utilizando la "k" derecha para crear buzones de correo "parent/child/child" no autorizados. • http://bugs.gentoo.org/show_bug.cgi?id=240409 • CWE-264: Permissions, Privileges, and Access Controls •