CVSS: 5.9EPSS: 1%CPEs: 1EXPL: 0CVE-2016-8652
https://notcve.org/view.php?id=CVE-2016-8652
The auth component in Dovecot before 2.2.27, when auth-policy is configured, allows a remote attackers to cause a denial of service (crash) by aborting authentication without setting a username. El componente de autenticación en Dovecot en versiones anteriores a 2.2.27, cuando la política de autenticación es configurada, permite a atacantes remotos provocar una denegación de servicio (caída) abortando la autenticación sin establecer un nombre de usuario. • http://dovecot.org/pipermail/dovecot-news/2016-December/000333.html http://www.openwall.com/lists/oss-security/2016/12/02/4 http://www.openwall.com/lists/oss-security/2016/12/05/12 http://www.securityfocus.com/bid/94639 • CWE-20: Improper Input Validation •
CVSS: 5.0EPSS: 1%CPEs: 9EXPL: 0CVE-2013-2111
https://notcve.org/view.php?id=CVE-2013-2111
The IMAP functionality in Dovecot before 2.2.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via invalid APPEND parameters. La funcionalidad IMAP en Dovecot anterior a 2.2.2 permite a atacantes remotos causar una denegación de servicio (bucle infinito y consumo de CPU) a través de parámetros APPEND inválidos. • http://secunia.com/advisories/53492 http://www.dovecot.org/list/dovecot-news/2013-May/000255.html http://www.openwall.com/lists/oss-security/2013/05/24/1 http://www.securitytracker.com/id/1028585 • CWE-20: Improper Input Validation •
CVSS: 5.8EPSS: 0%CPEs: 51EXPL: 0CVE-2013-6171
https://notcve.org/view.php?id=CVE-2013-6171
checkpassword-reply in Dovecot before 2.2.7 performs setuid operations to a user who is authenticating, which allows local users to bypass authentication and access virtual email accounts by attaching to the process and using a restricted file descriptor to modify account information in the response to the dovecot-auth server. checkpassword-reply en Dovecot anteriores a 2.2.7 ejecuta operaciones setuid a usuarios que se están autenticando, lo cual permite a usuarios locales sortear la autenticación y acceder a cuentas de email virtuales adjuntandose al proceso y utilizando un descriptor de fichero restringido para modificar información de la cuenta en la respuesta al servidor dovecot-auth. • http://cpanel.net/tsr-2013-0010-full-disclosure http://secunia.com/advisories/54808 http://wiki2.dovecot.org/AuthDatabase/CheckPassword#Security http://www.dovecot.org/list/dovecot-news/2013-November/000264.html https://usn.ubuntu.com/3556-2 • CWE-287: Improper Authentication •
CVSS: 6.4EPSS: 0%CPEs: 21EXPL: 0CVE-2008-5301
https://notcve.org/view.php?id=CVE-2008-5301
Directory traversal vulnerability in the ManageSieve implementation in Dovecot 1.0.15, 1.1, and 1.2 allows remote attackers to read and modify arbitrary .sieve files via a ".." (dot dot) in a script name. Vulnerabilidad de salto de directorio en la implementación de ManageSieve en Dovecot 1.0.15, 1.1, y 1.2 permite a atacantes remotos leer y modificar arbitrariamente ficheros .sieve a través de un ".." (punto punto) en el nombre de un script. • http://secunia.com/advisories/32768 http://secunia.com/advisories/36904 http://www.dovecot.org/list/dovecot/2008-November/035259.html http://www.securityfocus.com/bid/32582 http://www.ubuntu.com/usn/USN-838-1 http://www.vupen.com/english/advisories/2008/3190 https://exchange.xforce.ibmcloud.com/vulnerabilities/46672 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.0EPSS: 0%CPEs: 57EXPL: 0CVE-2008-4578
https://notcve.org/view.php?id=CVE-2008-4578
The ACL plugin in Dovecot before 1.1.4 allows attackers to bypass intended access restrictions by using the "k" right to create unauthorized "parent/child/child" mailboxes. El plugin ACL en Dovecot anterior a 1.1.4 permite a atacantes remotos evitar las restricciones de acceso previstas utilizando la "k" derecha para crear buzones de correo "parent/child/child" no autorizados. • http://bugs.gentoo.org/show_bug.cgi?id=240409 http://secunia.com/advisories/32164 http://secunia.com/advisories/33149 http://security.gentoo.org/glsa/glsa-200812-16.xml http://www.dovecot.org/list/dovecot-news/2008-October/000085.html http://www.mandriva.com/security/advisories?name=MDVSA-2008:232 http://www.securityfocus.com/archive/1/498498/100/0/threaded http://www.securityfocus.com/bid/31587 http://www.vupen.com/english/advisories/2008/2745 https://exchange.xforce • CWE-264: Permissions, Privileges, and Access Controls •