James Server (Apache) - vulnerabilities (CVEs)

6 CVEs, 0 in the last 30 days, 36 known versions, newest CVE from 2025-02-06. Vendor: Apache.

CVEs of James Server

• CVE-2024-45626 - CVSS 7.5 (high), 2025-02-06: Apache James server JMAP HTML to text plain implementation in versions below 3.8.2 and 3.7.6 is subject to unbounded memory consumption that can result in a…
• CVE-2024-37358 - CVSS 8.6 (high), 2025-02-06: Similarly to CVE-2024-34055, Apache James is vulnerable to denial of service through the abuse of IMAP literals from both authenticated and unauthenticated…
• CVE-2023-51518 - CVSS 9.8 (critical), 2024-02-27: Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data. Given a…
• CVE-2023-26269 - CVSS 7.8 (high), 2023-04-03: Apache James server version 3.7.3 and earlier provides a JMX management service without authentication by default. This allows privilege escalation by a…
• CVE-2017-12628 - CVSS 7.8 (high), 2017-10-20: The JMX server embedded in Apache James, also used by the command line client is exposed to a java de-serialization issue, and thus can be used to execute…
• CVE-2015-7611 - CVSS 8.1 (high), 2016-06-07: Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified vectors.