James (Apache) - vulnerabilities (CVEs)
14 CVEs, 0 in the last 30 days, 13 known versions, newest CVE from 2024-02-27. Vendor: Apache.
CVEs of James
- CVE-2023-51747 - CVSS 7.1 (high), 2024-02-27: Apache James prior to versions 3.8.1 and 3.7.5 is vulnerable to SMTP smuggling. A lenient behaviour in line delimiter handling might create a difference of…
- CVE-2023-51518 - CVSS 9.8 (critical), 2024-02-27: Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data. Given a…
- CVE-2023-26269 - CVSS 7.8 (high), 2023-04-03: Apache James server version 3.7.3 and earlier provides a JMX management service without authentication by default. This allows privilege escalation by a…
- CVE-2022-45787 - CVSS 5.5 (medium), 2023-01-06: Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local users. This issue…
- CVE-2022-45935 - CVSS 5.5 (medium), 2023-01-06: Usage of temporary files with insecure permissions by the Apache James server allows an attacker with local access to access private user data in transit.…
- CVE-2022-28220 - CVSS 7.5 (high), 2022-09-08: Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. Fix of CVE-2021-38542, which…
- CVE-2022-22931 - CVSS 4.3 (medium), 2022-02-07: Fix of CVE-2021-40525 do not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file…
- CVE-2021-38542 - CVSS 5.9 (medium), 2022-01-04: Apache James prior to release 3.6.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. This can result in Man-in -the-middle…
- CVE-2021-40525 - CVSS 9.1 (critical), 2022-01-04: Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path traversal, allowing reading and writing any…
- CVE-2021-40111 - CVSS 6.5 (medium), 2022-01-04: In Apache James, while fuzzing with Jazzer the IMAP parsing stack, we discover that crafted APPEND and STATUS IMAP command could be used to trigger infinite…
- CVE-2021-40110 - CVSS 7.5 (high), 2022-01-04: In Apache James, using Jazzer fuzzer, we identified that an IMAP user can craft IMAP LIST commands to orchestrate a Denial Of Service using a vulnerable…
- CVE-2019-0228 - CVSS 9.8 (critical), 2019-04-17: Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a…
- CVE-2006-2806 - CVSS 7.8 (high), 2006-06-05: The SMTP server in Apache Java Mail Enterprise Server (aka Apache James) 2.2.0 allows remote attackers to cause a denial of service (CPU consumption) via a…
- CVE-2004-2650 - CVSS 4.9 (medium), 2004-12-31: Spooler in Apache Foundation James 2.2.0 allows local users to cause a denial of service (memory consumption) by triggering various error conditions in the…
