10 results · Feed
-
Medium 5.7
Evolution-data-server: local file disclosure via attach file:// uris
A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. There are no file pat…
-
Medium 5.6
Evolution-data-server: evolution data server: arbitrary file deletion via inconsistent uri handling
A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper valida…
-
Unscored —
In GNOME evolution-data-server before 3.35.91, a malicious server can crash the mail client with a NULL pointer derefer…
-
Unscored —
evolution-data-server (eds) through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3. When a server sen…
-
Unscored —
camel/providers/imapx/camel-imapx-server.c in the IMAPx component in GNOME evolution-data-server before 3.21.2 proceeds…
-
Unscored —
addressbook/backends/ldap/e-book-backend-ldap.c in Evolution-Data-Server in GNOME Evolution through 3.29.2 might allow …
-
Unscored —
Multiple integer overflows in Evolution Data Server (aka evolution-data-server) before 2.24.5 allow context-dependent a…
-
Unscored —
The ntlm_challenge function in the NTLM SASL authentication mechanism in camel/camel-sasl-ntlm.c in Camel in Evolution …
-
Unscored —
Evolution 2.22.3.1 checks S/MIME signatures against a copy of the e-mail text within a signed-data blob, not the copy o…
-
Unscored —
Camel (camel-imap-folder.c) in the mailer component for Evolution Data Server 1.11 allows remote IMAP servers to execut…