Apache James (Apache Software Foundation) - vulnerabilities (CVEs)

7 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2022-09-08. Vendor: Apache Software Foundation.

CVEs of Apache James

• CVE-2022-28220 - CVSS 7.5 (high), 2022-09-08: Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. Fix of CVE-2021-38542, which…
• CVE-2022-22931 - CVSS 4.3 (medium), 2022-02-07: Fix of CVE-2021-40525 do not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file…
• CVE-2021-40111 - CVSS 6.5 (medium), 2022-01-04: In Apache James, while fuzzing with Jazzer the IMAP parsing stack, we discover that crafted APPEND and STATUS IMAP command could be used to trigger infinite…
• CVE-2021-40110 - CVSS 7.5 (high), 2022-01-04: In Apache James, using Jazzer fuzzer, we identified that an IMAP user can craft IMAP LIST commands to orchestrate a Denial Of Service using a vulnerable…
• CVE-2021-38542 - CVSS 5.9 (medium), 2022-01-04: Apache James prior to release 3.6.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. This can result in Man-in -the-middle…
• CVE-2021-40525 - CVSS 9.1 (critical), 2022-01-04: Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path traversal, allowing reading and writing any…
• CVE-2017-12628 - CVSS 7.8 (high), 2017-10-20: The JMX server embedded in Apache James, also used by the command line client is exposed to a java de-serialization issue, and thus can be used to execute…