| CVE-2026-85111 |
Apache James: Denial of service upon MIME parsing
|
8.7
Élevée
|
6 nov. 2026 |
| CVE-2026-76168 |
Apache James: ManageSieve file implementation cross-user path traversal
|
Non notée
|
6 nov. 2026 |
| CVE-2026-74756 |
Apache James: WebAdmin exposed without authentication on official Docker default
|
Non notée
|
6 nov. 2026 |
| CVE-2026-76171 |
Apache James: SSRF filter bypass in the JMAP PushSubscription web-push client
|
Non notée
|
6 nov. 2026 |
| CVE-2026-49939 |
Apache James: Negative IMAP ACL administer authorization bypass through JMAP protocol
|
Non notée
|
6 nov. 2026 |
| CVE-2025-66621 |
Apache James: SASL OAUTHBEARER do not validate aud in JWT payload if misconfigred
|
Non notée
|
6 nov. 2026 |
| CVE-2022-28220 |
Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS…
|
Non notée
|
8 sept. 2022 |
| CVE-2022-22931 |
Fix of CVE-2021-40525 do not prepend delimiters upon valid directory validations
|
Non notée
|
7 févr. 2022 |
| CVE-2021-40525 |
Apache James ManagedSieve implementation alongside with the file storage for sieve scripts is vulnerable to path…
|
Non notée
|
4 janv. 2022 |
| CVE-2021-40111 |
In Apache James, while fuzzing with Jazzer the IMAP parsing stack, we discover that crafted APPEND and STATUS IMAP…
|
Non notée
|
4 janv. 2022 |
| CVE-2021-40110 |
In Apache James, using Jazzer fuzzer, we identified that an IMAP user can craft IMAP LIST commands to orchestrate a…
|
Non notée
|
4 janv. 2022 |
| CVE-2021-38542 |
Apache James prior to release 3.6.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command
|
Non notée
|
4 janv. 2022 |
| CVE-2017-12628 |
The JMX server embedded in Apache James, also used by the command line client is exposed to a java de-serialization…
|
Non notée
|
20 oct. 2017 |