Page 8 of 47 results (0.011 seconds)

CVSS: 4.3EPSS: 16%CPEs: 2EXPL: 1

CVE-2008-4907 – Dovecot 1.1.x - Invalid Message Address Parsing Denial of Service

https://notcve.org/view.php?id=CVE-2008-4907

The message parsing feature in Dovecot 1.1.4 and 1.1.5, when using the FETCH ENVELOPE command in the IMAP client, allows remote attackers to cause a denial of service (persistent crash) via an email with a malformed From address, which triggers an assertion error, aka "invalid message address parsing bug." La característica de análisis sintáctico en Dovecot v1.1.4 y v1.1.5, cuando usa el comando FETCH ENVELOPE en el cliente IMAP, permite a atacantes remotos causar denegación de servicio (caída persistente) a través de un correo electrónico con una dirección From mal formada, que dispara una error de aserción, también conocido como "error de análisis de dirección de mensaje inválido". • https://www.exploit-db.com/exploits/32551 http://secunia.com/advisories/32479 http://secunia.com/advisories/32677 http://secunia.com/advisories/33149 http://security.gentoo.org/glsa/glsa-200812-16.xml http://www.dovecot.org/list/dovecot-news/2008-October/000089.html http://www.securityfocus.com/bid/31997 http://www.ubuntu.com/usn/usn-666-1 https://exchange.xforce.ibmcloud.com/vulnerabilities/46227 • CWE-20: Improper Input Validation •

CVSS: 2.1EPSS: 0%CPEs: 2EXPL: 0

CVE-2008-4870 – dovecot: ssl_key_password disclosure due to an insecure dovecot.conf permissions

https://notcve.org/view.php?id=CVE-2008-4870

dovecot 1.0.7 in Red Hat Enterprise Linux (RHEL) 5, and possibly Fedora, uses world-readable permissions for dovecot.conf, which allows local users to obtain the ssl_key_password parameter value. dovecot 1.0.7 en Red Hat Enterprise Linux (RHEL) 5 y posiblemente Fedora, utiliza permisos leíbles por todo el mundo para dovecot.conf, lo que permite a usuarios locales obtener el valor del parámetro ssl_key_password. • http://secunia.com/advisories/32164 http://secunia.com/advisories/33149 http://secunia.com/advisories/33624 http://security.gentoo.org/glsa/glsa-200812-16.xml http://www.openwall.com/lists/oss-security/2008/10/29/10 http://www.redhat.com/support/errata/RHSA-2009-0205.html https://bugzilla.redhat.com/show_bug.cgi?id=436287 https://exchange.xforce.ibmcloud.com/vulnerabilities/46323 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10776 https: • CWE-732: Incorrect Permission Assignment for Critical Resource •

CVSS: 5.0EPSS: 0%CPEs: 57EXPL: 0

CVE-2008-4578

https://notcve.org/view.php?id=CVE-2008-4578

The ACL plugin in Dovecot before 1.1.4 allows attackers to bypass intended access restrictions by using the "k" right to create unauthorized "parent/child/child" mailboxes. El plugin ACL en Dovecot anterior a 1.1.4 permite a atacantes remotos evitar las restricciones de acceso previstas utilizando la "k" derecha para crear buzones de correo "parent/child/child" no autorizados. • http://bugs.gentoo.org/show_bug.cgi?id=240409 http://secunia.com/advisories/32164 http://secunia.com/advisories/33149 http://security.gentoo.org/glsa/glsa-200812-16.xml http://www.dovecot.org/list/dovecot-news/2008-October/000085.html http://www.mandriva.com/security/advisories?name=MDVSA-2008:232 http://www.securityfocus.com/archive/1/498498/100/0/threaded http://www.securityfocus.com/bid/31587 http://www.vupen.com/english/advisories/2008/2745 https://exchange.xforce • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 0

CVE-2008-4577 – dovecot: incorrect handling of negative rights in the ACL plugin

https://notcve.org/view.php?id=CVE-2008-4577

The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access restrictions. El plugin ACL en Dovecot anterior a 1.1.4 amenaza los derechos del acceso negativo como si fueran derechos de acceso positivos, lo que permite a atacantes evitar las restricciones de acceso previstas. • http://bugs.gentoo.org/show_bug.cgi?id=240409 http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html http://secunia.com/advisories/32164 http://secunia.com/advisories/32471 http://secunia.com/advisories/33149 http://secunia.com/advisories/33624 http://secunia.com/advisories/36904 http://security.gentoo.org/glsa/glsa-200812-16.xml http://www.dovecot.org/list/dovecot-news/2008-October/000085.html http://www.mandriva.com/security/advisories?name=MDVSA-2008:232& • CWE-863: Incorrect Authorization •

CVSS: 6.8EPSS: 7%CPEs: 2EXPL: 1

CVE-2008-1218 – Dovecot IMAP 1.0.10 < 1.1rc2 - Remote Email Disclosure

https://notcve.org/view.php?id=CVE-2008-1218

Argument injection vulnerability in Dovecot 1.0.x before 1.0.13, and 1.1.x before 1.1.rc3, when using blocking passdbs, allows remote attackers to bypass the password check via a password containing TAB characters, which are treated as argument delimiters that enable the skip_password_check field to be specified. Vulnerabilidad de inyección de argumentos en Dovecot 1.0.x anterior a 1.0.13, y 1.1.x anterior a 1.1.rc3, cuando se utiliza passdbs con bloqueo, permite a atacantes remotos evitar la comprobación de contraseña a través de una contraseña que contenga caracteres TAB, los cuales son tratados como delimitadores de los argumentos que permiten que el fichero skip_password_check sea especificado. • https://www.exploit-db.com/exploits/5257 http://lists.opensuse.org/opensuse-security-announce/2008-10/msg00004.html http://secunia.com/advisories/29226 http://secunia.com/advisories/29295 http://secunia.com/advisories/29364 http://secunia.com/advisories/29385 http://secunia.com/advisories/29396 http://secunia.com/advisories/29557 http://secunia.com/advisories/32151 http://security.gentoo.org/glsa/glsa-200803-25.xml http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0108 http:&# • CWE-255: Credentials Management Errors •