CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 0CVE-2008-4577 – dovecot: incorrect handling of negative rights in the ACL plugin
https://notcve.org/view.php?id=CVE-2008-4577
15 Oct 2008 — The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access restrictions. El plugin ACL en Dovecot anterior a 1.1.4 amenaza los derechos del acceso negativo como si fueran derechos de acceso positivos, lo que permite a atacantes evitar las restricciones de acceso previstas. • http://bugs.gentoo.org/show_bug.cgi?id=240409 • CWE-863: Incorrect Authorization •
CVSS: 9.1EPSS: 0%CPEs: 57EXPL: 0CVE-2008-4578
https://notcve.org/view.php?id=CVE-2008-4578
15 Oct 2008 — The ACL plugin in Dovecot before 1.1.4 allows attackers to bypass intended access restrictions by using the "k" right to create unauthorized "parent/child/child" mailboxes. El plugin ACL en Dovecot anterior a 1.1.4 permite a atacantes remotos evitar las restricciones de acceso previstas utilizando la "k" derecha para crear buzones de correo "parent/child/child" no autorizados. • http://bugs.gentoo.org/show_bug.cgi?id=240409 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 10%CPEs: 2EXPL: 1CVE-2008-1218 – Dovecot IMAP 1.0.10 < 1.1rc2 - Remote Email Disclosure
https://notcve.org/view.php?id=CVE-2008-1218
10 Mar 2008 — Argument injection vulnerability in Dovecot 1.0.x before 1.0.13, and 1.1.x before 1.1.rc3, when using blocking passdbs, allows remote attackers to bypass the password check via a password containing TAB characters, which are treated as argument delimiters that enable the skip_password_check field to be specified. Vulnerabilidad de inyección de argumentos en Dovecot 1.0.x anterior a 1.0.13, y 1.1.x anterior a 1.1.rc3, cuando se utiliza passdbs con bloqueo, permite a atacantes remotos evitar la comprobación d... • https://www.exploit-db.com/exploits/5257 • CWE-255: Credentials Management Errors •
CVSS: 5.5EPSS: 0%CPEs: 32EXPL: 0CVE-2008-1199 – dovecot: insecure mail_extra_groups option
https://notcve.org/view.php?id=CVE-2008-1199
06 Mar 2008 — Dovecot before 1.0.11, when configured to use mail_extra_groups to allow Dovecot to create dotlocks in /var/mail, might allow local users to read sensitive mail files for other users, or modify files or directories that are writable by group, via a symlink attack. Dovecot antes de 1.0.11, cuando se configura para utilizar mail_extra_groups para permitir a Dovecot crear dotlocks en /var/mail, podría permitir a usuarios locales leer archivos de mail sensibles para otros usuarios, o modificar archivos o direct... • http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00004.html • CWE-16: Configuration CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2007-6598 – dovecot LDAP+auth cache user login mixup
https://notcve.org/view.php?id=CVE-2007-6598
04 Jan 2008 — Dovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which might allow remote authenticated users to login as a different user who has the same password. Dovecot anterior a 1.0.10, con determinadas opciones de configuración incluyendo el uso de %variables, no mantiene adecuadamente la caché LDAP+auth, lo cual podría permitir a permite a usuarios autenticados remotamente identificarse como un usuario diferente que tiene la mism... • http://dovecot.org/list/dovecot-news/2007-December/000057.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2007-4211 – Dovecot possible privilege ascalation in ACL plugin
https://notcve.org/view.php?id=CVE-2007-4211
08 Aug 2007 — The ACL plugin in Dovecot before 1.0.3 allows remote authenticated users with the insert right to save certain flags via a (1) COPY or (2) APPEND command. La extensión ACL del Dovecot anterior a la 1.0.3 permite a usuarios remotos autenticados, con derechos de inserción, guardar ciertos indicadores a través de los comandos (1) COPY o (2) APPEND. • http://secunia.com/advisories/26320 •
CVSS: 7.5EPSS: 0%CPEs: 37EXPL: 0CVE-2007-2231 – Directory traversal in dovecot with zlib plugin
https://notcve.org/view.php?id=CVE-2007-2231
25 Apr 2007 — Directory traversal vulnerability in index/mbox/mbox-storage.c in Dovecot before 1.0.rc29, when using the zlib plugin, allows remote attackers to read arbitrary gzipped (.gz) mailboxes (mbox files) via a .. (dot dot) sequence in the mailbox name. Vulnerabilidad de escalado de directorio en index/mbox/mbox-storage.c de Dovecot versiones anteriores a 1.0.rc29, cuando se usa la extensión (plugin) zlib, permite a atacantes remotos leer buzones de correo (mbox files) comprimidos con gzip (.gz) de su elección med... • http://dovecot.org/doc/NEWS •
CVSS: 6.5EPSS: 7%CPEs: 57EXPL: 0CVE-2006-5973
https://notcve.org/view.php?id=CVE-2006-5973
20 Nov 2006 — Off-by-one buffer overflow in Dovecot 1.0test53 through 1.0.rc14, and possibly other versions, when index files are used and mmap_disable is set to "yes," allows remote authenticated IMAP or POP3 users to cause a denial of service (crash) via unspecified vectors involving the cache file. Desbordamiento de búfer (off-by-one) en Dovecot 1.0test53 hasta 1.0.rc14, y posiblemente otras versiones, cuando se utilizan los archivos de índice y mmap_disable tiene el valor "Sí", permite a usuarios IMAP o POP3 remotos ... • http://dovecot.org/list/dovecot-news/2006-November/000023.html •
CVSS: 5.3EPSS: 0%CPEs: 4EXPL: 0CVE-2006-2414
https://notcve.org/view.php?id=CVE-2006-2414
16 May 2006 — Directory traversal vulnerability in Dovecot 1.0 beta and 1.0 allows remote attackers to list files and directories under the mbox parent directory and obtain mailbox names via ".." sequences in the (1) LIST or (2) DELETE IMAP command. • http://dovecot.org/list/dovecot-cvs/2006-May/005563.html •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2006-0730
https://notcve.org/view.php?id=CVE-2006-0730
16 Feb 2006 — Multiple unspecified vulnerabilities in Dovecot before 1.0beta3 allow remote attackers to cause a denial of service (application crash or hang) via unspecified vectors involving (1) "potential hangs" in the APPEND command and "potential crashes" in (2) dovecot-auth and (3) imap/pop3-login. NOTE: vector 2 might be related to a double free vulnerability. • http://secunia.com/advisories/18870 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •