CVSS: 7.5EPSS: 0%CPEs: 13EXPL: 0CVE-2011-2167 – dovecot: directory traversal due to not obeying chroot directive
https://notcve.org/view.php?id=CVE-2011-2167
24 May 2011 — script-login in Dovecot 2.0.x before 2.0.13 does not follow the chroot configuration setting, which might allow remote authenticated users to conduct directory traversal attacks by leveraging a script. Las secuencias de comandos de inicio de sesión en Dovecot v2.0.x antes de v2.0.13 no sigue las opciones de configuración de chroot, lo que podría permitir a usuarios remotos autenticados realizar ataques de directorio transversal mediante el aprovechamiento de una secuencia de comandos. • http://dovecot.org/pipermail/dovecot/2011-May/059085.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.5EPSS: 1%CPEs: 15EXPL: 0CVE-2010-3780 – Dovecot: Busy master process, receiving a lot of SIGCHLD signals rapidly while logging, could die
https://notcve.org/view.php?id=CVE-2010-3780
06 Oct 2010 — Dovecot 1.2.x before 1.2.15 allows remote authenticated users to cause a denial of service (master process outage) by simultaneously disconnecting many (1) IMAP or (2) POP3 sessions. Dovecot v1.2.x anterior a v1.2.15 permite a usuarios autenticados remotamente provocar una denegación de servicio (interrupción del proceso maestro) mediante la desconexión simultanea de varias sesiones (1) IMAP o (2) POP3 • http://secunia.com/advisories/43220 •
CVSS: 6.5EPSS: 0%CPEs: 16EXPL: 0CVE-2010-3779
https://notcve.org/view.php?id=CVE-2010-3779
06 Oct 2010 — Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.beta2 grants the admin permission to the owner of each mailbox in a non-public namespace, which might allow remote authenticated users to bypass intended access restrictions by changing the ACL of a mailbox, as demonstrated by a symlinked shared mailbox. Dovecot v1.2.x anterior a v1.2.15 y v2.0.x anterior a v2.0.beta2 proporciona permisos de administrador al propietario del cada buzón de correo en un espacio de nombres no público (non-public namespace), lo qu... • http://secunia.com/advisories/43220 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 8.1EPSS: 0%CPEs: 20EXPL: 0CVE-2010-3706
https://notcve.org/view.php?id=CVE-2010-3706
06 Oct 2010 — plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.5 interprets an ACL entry as a directive to add to the permissions granted by another ACL entry, instead of a directive to replace the permissions granted by another ACL entry, in certain circumstances involving the private namespace of a user, which allows remote authenticated users to bypass intended access restrictions via a request to read or modify a mailbox. plugins/acl/acl-backend-vfile.c en Dovecot v1.2.x anterior a ... • http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00001.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.5EPSS: 0%CPEs: 20EXPL: 0CVE-2010-3707 – Dovecot: Failed to properly update ACL cache, when multiple rules defined rights for one subject
https://notcve.org/view.php?id=CVE-2010-3707
06 Oct 2010 — plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.5 interprets an ACL entry as a directive to add to the permissions granted by another ACL entry, instead of a directive to replace the permissions granted by another ACL entry, in certain circumstances involving more specific entries that occur after less specific entries, which allows remote authenticated users to bypass intended access restrictions via a request to read or modify a mailbox. plugins/acl/acl-backend-vfile.c ... • http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00001.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 0%CPEs: 13EXPL: 0CVE-2010-3304
https://notcve.org/view.php?id=CVE-2010-3304
24 Sep 2010 — The ACL plugin in Dovecot 1.2.x before 1.2.13 propagates INBOX ACLs to newly created mailboxes in certain configurations, which might allow remote attackers to read mailboxes that have unintended weak ACLs. El complemento ACL de Dovecot v1.2.x anteriores a v1.2.13 propaga las ACLs INBOX a nuevos buzones de correo en determinadas configuraciones, lo que puede permitir a atacantes remotos leer buzones de correo que tienen ACLs débiles imprevistos. • http://lists.opensuse.org/opensuse-security-announce/2010-09/msg00006.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 5%CPEs: 11EXPL: 0CVE-2010-0745
https://notcve.org/view.php?id=CVE-2010-0745
20 May 2010 — Unspecified vulnerability in Dovecot 1.2.x before 1.2.11 allows remote attackers to cause a denial of service (CPU consumption) via long headers in an e-mail message. Vulnerabilidad sin especificar en Dovecot v1.2.x anterior a 1.2.11 permite a atacantes remotos provocar una denegación de servicio (consumo CPU) a través de una larga cabecera en un mensaje de e-mail • http://dovecot.org/list/dovecot-news/2010-March/000152.html • CWE-399: Resource Management Errors •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2009-3897
https://notcve.org/view.php?id=CVE-2009-3897
24 Nov 2009 — Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation time, which allows local users to access arbitrary user accounts by replacing the auth socket, related to the parent directories of the base_dir directory, and possibly the base_dir directory itself. Dovecot v1.2.x anterior v1.2.8 establece permisos 0777 durante la creación de ciertos directorios en el momento de la instalación, permitiendo a usuarios locales acceder a las cuentas de usuarios por reemplaz... • http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 9.8EPSS: 2%CPEs: 12EXPL: 0CVE-2009-3235 – cyrus-impad: CMU sieve buffer overflows
https://notcve.org/view.php?id=CVE-2009-3235
17 Sep 2009 — Multiple stack-based buffer overflows in the Sieve plugin in Dovecot 1.0 before 1.0.4 and 1.1 before 1.1.7, as derived from Cyrus libsieve, allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted SIEVE script, as demonstrated by forwarding an e-mail message to a large number of recipients, a different vulnerability than CVE-2009-2632. Múltiples desbordamientos de búfer basados en pila en el complemento -plugin- Sieve de Dovecot v1.0 anterior a... • http://dovecot.org/list/dovecot-news/2009-September/000135.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-121: Stack-based Buffer Overflow •
CVSS: 9.1EPSS: 0%CPEs: 21EXPL: 0CVE-2008-5301
https://notcve.org/view.php?id=CVE-2008-5301
01 Dec 2008 — Directory traversal vulnerability in the ManageSieve implementation in Dovecot 1.0.15, 1.1, and 1.2 allows remote attackers to read and modify arbitrary .sieve files via a ".." (dot dot) in a script name. Vulnerabilidad de salto de directorio en la implementación de ManageSieve en Dovecot 1.0.15, 1.1, y 1.2 permite a atacantes remotos leer y modificar arbitrariamente ficheros .sieve a través de un ".." (punto punto) en el nombre de un script. • http://secunia.com/advisories/32768 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •