Apache Apache James
7 CVEs affecting Apache Apache James. Latest disclosed: 2022-09-08. Critical: 1, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-40525 | Critical | 9.1 | 2022-01-04 | Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path traversal, allowing reading and writing any fi… |
CVE-2017-12628 | High | 7.8 | 2017-10-20 | The JMX server embedded in Apache James, also used by the command line client is exposed to a java de-serialization issue, and thus can be used to execute arbi… |
CVE-2022-28220 | High | 7.5 | 2022-09-08 | Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. Fix of CVE-2021-38542, which solv… |
CVE-2021-40110 | High | 7.5 | 2022-01-04 | In Apache James, using Jazzer fuzzer, we identified that an IMAP user can craft IMAP LIST commands to orchestrate a Denial Of Service using a vulnerable Regula… |
CVE-2021-40111 | Medium | 6.5 | 2022-01-04 | In Apache James, while fuzzing with Jazzer the IMAP parsing stack, we discover that crafted APPEND and STATUS IMAP command could be used to trigger infinite lo… |
CVE-2021-38542 | Medium | 5.9 | 2022-01-04 | Apache James prior to release 3.6.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. This can result in Man-in -the-middle comma… |
CVE-2022-22931 | Medium | 4.3 | 2022-02-07 | Fix of CVE-2021-40525 do not prepend delimiters upon valid directory validations. Affected implementations include: - maildir mailbox store - Sieve file reposi… |