6 results · Clear filters · Feed
-
Low 3.1
Sieve CPU resource usage is tracked in the compiled script, so an attacker that has valid credentials can reset the acc…
-
Low 3.1
The comparison used for the doveadm password and API key is not fully timing safe and can reveal the length of the conf…
-
Low 3.7
When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes…
-
Low 3.1
Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_al…
-
Low 3.7
If auth_username_chars is empty, it is possible to inject arbitrary LDAP filter to Dovecot's LDAP authentication. This …
-
Low 3.1
The IMAP and LMTP components in Dovecot 2.3.9 before 2.3.9.3 mishandle snippet generation when many characters must be …