DO
Product
Dovecot
69
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 20Medium 23Low 1
Watch
Add Dovecot to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2011-2167 | – | May 24 | script-login in Dovecot 2.0.x before 2.0.13 does not follow the chroot configuration setting, which might allow remote authenticated users to conduct directory traversal attacks… Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +7 more |
| CVE-2011-2166 | – | May 24 | script-login in Dovecot 2.0.x before 2.0.13 does not follow the user and group configuration settings, which might allow remote authenticated users to bypass intended access… Affected: 2.0.0; 2.0.1; 2.0.2; 2.0.3; 2.0.4; 2.0.5; +7 more |
| CVE-2011-1929 | – | May 24 | lib-mail/message-header-parser.c in Dovecot 1.2.x before 1.2.17 and 2.0.x before 2.0.13 does not properly handle '\0' characters in header names, which allows remote attackers to… Affected: 1.2.0; 1.2.1; 1.2.2; 1.2.3; 1.2.4; 1.2.5; +25 more |
| CVE-2010-3780 | – | Oct 6 | Dovecot 1.2.x before 1.2.15 allows remote authenticated users to cause a denial of service (master process outage) by simultaneously disconnecting many (1) IMAP or (2) POP3… Affected: 1.2.0; 1.2.1; 1.2.2; 1.2.3; 1.2.4; 1.2.5; +9 more |
| CVE-2010-3779 | – | Oct 6 | Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.beta2 grants the admin permission to the owner of each mailbox in a non-public namespace, which might allow remote authenticated… Affected: 1.2.0; 1.2.1; 1.2.2; 1.2.3; 1.2.4; 1.2.5; +10 more |
| CVE-2010-3707 | – | Oct 6 | plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.5 interprets an ACL entry as a directive to add to the permissions granted by another ACL… Affected: 1.2.0; 1.2.1; 1.2.2; 1.2.3; 1.2.4; 1.2.5; +14 more |
| CVE-2010-3706 | – | Oct 6 | plugins/acl/acl-backend-vfile.c in Dovecot 1.2.x before 1.2.15 and 2.0.x before 2.0.5 interprets an ACL entry as a directive to add to the permissions granted by another ACL… Affected: 1.2.0; 1.2.1; 1.2.2; 1.2.3; 1.2.4; 1.2.5; +14 more |
| CVE-2010-3304 | – | Sep 24 | The ACL plugin in Dovecot 1.2.x before 1.2.13 propagates INBOX ACLs to newly created mailboxes in certain configurations, which might allow remote attackers to read mailboxes that… Affected: 1.2.0; 1.2.1; 1.2.2; 1.2.3; 1.2.4; 1.2.5; +7 more |
| CVE-2010-0745 | – | May 20 | Unspecified vulnerability in Dovecot 1.2.x before 1.2.11 allows remote attackers to cause a denial of service (CPU consumption) via long headers in an e-mail message Affected: 1.2.0; 1.2.1; 1.2.2; 1.2.3; 1.2.4; 1.2.5; +5 more |
| CVE-2009-3235 | – | Sep 17 | Multiple stack-based buffer overflows in the Sieve plugin in Dovecot 1.0 before 1.0.4 and 1.1 before 1.1.7, as derived from Cyrus libsieve, allow context-dependent attackers to… Affected: 1.0; 1.0.1; 1.0.2; 1.0.3; 1.1; 1.1.0; +6 more |
| CVE-2008-5301 | – | Dec 1 | Directory traversal vulnerability in the ManageSieve implementation in Dovecot 1.0.15, 1.1, and 1.2 allows remote attackers to read and modify arbitrary .sieve files via a ".."… Affected: 0.99.13; 0.99.14; 1.0; 1.0.2; 1.0.3; 1.0.4; +15 more |
| CVE-2008-4907 | – | Nov 4 | The message parsing feature in Dovecot 1.1.4 and 1.1.5, when using the FETCH ENVELOPE command in the IMAP client, allows remote attackers to cause a denial of service (persistent… Affected: 1.1.4; 1.1.5 |
| CVE-2008-4870 | – | Nov 1 | dovecot 1.0.7 in Red Hat Enterprise Linux (RHEL) 5, and possibly Fedora, uses world-readable permissions for dovecot.conf, which allows local users to obtain the ssl_key_password… Affected: 1.0.7 |
| CVE-2008-4578 | – | Oct 15 | The ACL plugin in Dovecot before 1.1.4 allows attackers to bypass intended access restrictions by using the "k" right to create unauthorized "parent/child/child" mailboxes Affected: through 1.1.3; 0.99.13; 0.99.14; 1.0; 1.0.2; 1.0.3; +34 more |
| CVE-2008-1218 | – | Mar 10 | Argument injection vulnerability in Dovecot 1.0.x before 1.0.13, and 1.1.x before 1.1.rc3, when using blocking passdbs, allows remote attackers to bypass the password check via a… Affected: through 1.0.12; through 1.1 |
| CVE-2008-1199 | – | Mar 6 | Dovecot before 1.0.11, when configured to use mail_extra_groups to allow Dovecot to create dotlocks in /var/mail, might allow local users to read sensitive mail files for other… Affected: 0.99.13; 0.99.14; 1.0; 1.0.2; 1.0.3; 1.0.4; +26 more |
| CVE-2007-6598 | – | Jan 4 | Dovecot before 1.0.10, with certain configuration options including use of %variables, does not properly maintain the LDAP+auth cache, which might allow remote authenticated users… Affected: through 1.0.9 |
| CVE-2007-4211 | – | Aug 8 | The ACL plugin in Dovecot before 1.0.3 allows remote authenticated users with the insert right to save certain flags via a (1) COPY or (2) APPEND command Affected: through 1.0.2 |
| CVE-2007-2231 | – | Apr 25 | Directory traversal vulnerability in index/mbox/mbox-storage.c in Dovecot before 1.0.rc29, when using the zlib plugin, allows remote attackers to read arbitrary gzipped (.gz)… Affected: 1.0.beta1; 1.0.beta2; 1.0.beta3; 1.0.beta4; 1.0.beta5; 1.0.beta6; +31 more |