Apache James Server (Apache Software Foundation) - vulnerabilities (CVEs)

6 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2025-02-06. Vendor: Apache Software Foundation.

CVEs of Apache James Server

• CVE-2024-45626 - CVSS 7.5 (high), 2025-02-06: Apache James server JMAP HTML to text plain implementation in versions below 3.8.2 and 3.7.6 is subject to unbounded memory consumption that can result in a…
• CVE-2024-37358 - CVSS 8.6 (high), 2025-02-06: Similarly to CVE-2024-34055, Apache James is vulnerable to denial of service through the abuse of IMAP literals from both authenticated and unauthenticated…
• CVE-2023-51747 - CVSS 7.1 (high), 2024-02-27: Apache James prior to versions 3.8.1 and 3.7.5 is vulnerable to SMTP smuggling. A lenient behaviour in line delimiter handling might create a difference of…
• CVE-2023-51518 - CVSS 9.8 (critical), 2024-02-27: Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data. Given a…
• CVE-2023-26269 - CVSS 7.8 (high), 2023-04-03: Apache James server version 3.7.3 and earlier provides a JMX management service without authentication by default. This allows privilege escalation by a…
• CVE-2022-45935 - CVSS 5.5 (medium), 2023-01-06: Usage of temporary files with insecure permissions by the Apache James server allows an attacker with local access to access private user data in transit.…