CVSS: 7.5EPSS: 1%CPEs: 11EXPL: 0CVE-2010-0745
https://notcve.org/view.php?id=CVE-2010-0745
20 May 2010 — Unspecified vulnerability in Dovecot 1.2.x before 1.2.11 allows remote attackers to cause a denial of service (CPU consumption) via long headers in an e-mail message. Vulnerabilidad sin especificar en Dovecot v1.2.x anterior a 1.2.11 permite a atacantes remotos provocar una denegación de servicio (consumo CPU) a través de una larga cabecera en un mensaje de e-mail • http://dovecot.org/list/dovecot-news/2010-March/000152.html • CWE-399: Resource Management Errors •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2009-3897
https://notcve.org/view.php?id=CVE-2009-3897
24 Nov 2009 — Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of certain directories at installation time, which allows local users to access arbitrary user accounts by replacing the auth socket, related to the parent directories of the base_dir directory, and possibly the base_dir directory itself. Dovecot v1.2.x anterior v1.2.8 establece permisos 0777 durante la creación de ciertos directorios en el momento de la instalación, permitiendo a usuarios locales acceder a las cuentas de usuarios por reemplaz... • http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 9.8EPSS: 3%CPEs: 12EXPL: 0CVE-2009-3235 – cyrus-impad: CMU sieve buffer overflows
https://notcve.org/view.php?id=CVE-2009-3235
17 Sep 2009 — Multiple stack-based buffer overflows in the Sieve plugin in Dovecot 1.0 before 1.0.4 and 1.1 before 1.1.7, as derived from Cyrus libsieve, allow context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted SIEVE script, as demonstrated by forwarding an e-mail message to a large number of recipients, a different vulnerability than CVE-2009-2632. Múltiples desbordamientos de búfer basados en pila en el complemento -plugin- Sieve de Dovecot v1.0 anterior a... • http://dovecot.org/list/dovecot-news/2009-September/000135.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-121: Stack-based Buffer Overflow •
CVSS: 9.1EPSS: 0%CPEs: 21EXPL: 0CVE-2008-5301
https://notcve.org/view.php?id=CVE-2008-5301
01 Dec 2008 — Directory traversal vulnerability in the ManageSieve implementation in Dovecot 1.0.15, 1.1, and 1.2 allows remote attackers to read and modify arbitrary .sieve files via a ".." (dot dot) in a script name. Vulnerabilidad de salto de directorio en la implementación de ManageSieve en Dovecot 1.0.15, 1.1, y 1.2 permite a atacantes remotos leer y modificar arbitrariamente ficheros .sieve a través de un ".." (punto punto) en el nombre de un script. • http://secunia.com/advisories/32768 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 13%CPEs: 2EXPL: 1CVE-2008-4907 – Dovecot 1.1.x - Invalid Message Address Parsing Denial of Service
https://notcve.org/view.php?id=CVE-2008-4907
04 Nov 2008 — The message parsing feature in Dovecot 1.1.4 and 1.1.5, when using the FETCH ENVELOPE command in the IMAP client, allows remote attackers to cause a denial of service (persistent crash) via an email with a malformed From address, which triggers an assertion error, aka "invalid message address parsing bug." La característica de análisis sintáctico en Dovecot v1.1.4 y v1.1.5, cuando usa el comando FETCH ENVELOPE en el cliente IMAP, permite a atacantes remotos causar denegación de servicio (caída persistente) ... • https://www.exploit-db.com/exploits/32551 • CWE-20: Improper Input Validation •
CVSS: 7.1EPSS: 0%CPEs: 2EXPL: 0CVE-2008-4870 – dovecot: ssl_key_password disclosure due to an insecure dovecot.conf permissions
https://notcve.org/view.php?id=CVE-2008-4870
31 Oct 2008 — dovecot 1.0.7 in Red Hat Enterprise Linux (RHEL) 5, and possibly Fedora, uses world-readable permissions for dovecot.conf, which allows local users to obtain the ssl_key_password parameter value. dovecot 1.0.7 en Red Hat Enterprise Linux (RHEL) 5 y posiblemente Fedora, utiliza permisos leíbles por todo el mundo para dovecot.conf, lo que permite a usuarios locales obtener el valor del parámetro ssl_key_password. • http://secunia.com/advisories/32164 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 7.5EPSS: 1%CPEs: 7EXPL: 0CVE-2008-4577 – dovecot: incorrect handling of negative rights in the ACL plugin
https://notcve.org/view.php?id=CVE-2008-4577
15 Oct 2008 — The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access restrictions. El plugin ACL en Dovecot anterior a 1.1.4 amenaza los derechos del acceso negativo como si fueran derechos de acceso positivos, lo que permite a atacantes evitar las restricciones de acceso previstas. • http://bugs.gentoo.org/show_bug.cgi?id=240409 • CWE-863: Incorrect Authorization •
CVSS: 9.1EPSS: 0%CPEs: 57EXPL: 0CVE-2008-4578
https://notcve.org/view.php?id=CVE-2008-4578
15 Oct 2008 — The ACL plugin in Dovecot before 1.1.4 allows attackers to bypass intended access restrictions by using the "k" right to create unauthorized "parent/child/child" mailboxes. El plugin ACL en Dovecot anterior a 1.1.4 permite a atacantes remotos evitar las restricciones de acceso previstas utilizando la "k" derecha para crear buzones de correo "parent/child/child" no autorizados. • http://bugs.gentoo.org/show_bug.cgi?id=240409 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 16%CPEs: 2EXPL: 1CVE-2008-1218 – Dovecot IMAP 1.0.10 < 1.1rc2 - Remote Email Disclosure
https://notcve.org/view.php?id=CVE-2008-1218
10 Mar 2008 — Argument injection vulnerability in Dovecot 1.0.x before 1.0.13, and 1.1.x before 1.1.rc3, when using blocking passdbs, allows remote attackers to bypass the password check via a password containing TAB characters, which are treated as argument delimiters that enable the skip_password_check field to be specified. Vulnerabilidad de inyección de argumentos en Dovecot 1.0.x anterior a 1.0.13, y 1.1.x anterior a 1.1.rc3, cuando se utiliza passdbs con bloqueo, permite a atacantes remotos evitar la comprobación d... • https://www.exploit-db.com/exploits/5257 • CWE-255: Credentials Management Errors •
CVSS: 5.5EPSS: 0%CPEs: 32EXPL: 0CVE-2008-1199 – dovecot: insecure mail_extra_groups option
https://notcve.org/view.php?id=CVE-2008-1199
06 Mar 2008 — Dovecot before 1.0.11, when configured to use mail_extra_groups to allow Dovecot to create dotlocks in /var/mail, might allow local users to read sensitive mail files for other users, or modify files or directories that are writable by group, via a symlink attack. Dovecot antes de 1.0.11, cuando se configura para utilizar mail_extra_groups para permitir a Dovecot crear dotlocks en /var/mail, podría permitir a usuarios locales leer archivos de mail sensibles para otros usuarios, o modificar archivos o direct... • http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00004.html • CWE-16: Configuration CWE-59: Improper Link Resolution Before File Access ('Link Following') •