Search CVE reports
521 – 530 of 45341 results
An attacker that can get Dovecot to relay a message, for example through Sieve redirect or submission relay, can use a crafted line ending in the message body to bypass the outbound protection that prevents message content from...
1 affected package
dovecot
| Package | 24.04 LTS |
|---|---|
| dovecot | Needs evaluation |
When mail_max_userip_connections is set (default 10) and reached, submission-login can crash with epoll() panic caused by file descriptor handling issues. If running in high-security mode (default for community releases), only the...
1 affected package
dovecot
| Package | 24.04 LTS |
|---|---|
| dovecot | Needs evaluation |
An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive memory usage when the message is later parsed. The message is...
1 affected package
dovecot
| Package | 24.04 LTS |
|---|---|
| dovecot | Needs evaluation |
Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute...
1 affected package
redis
| Package | 24.04 LTS |
|---|---|
| redis | Needs evaluation |
A flaw was found in gdk-pixbuf. When loading a specially crafted JPEG image containing chunked ICC profile markers, an error during ICC profile parsing can leave stale size metadata after the profile buffer is freed. A subsequent...
1 affected package
gdk-pixbuf
| Package | 24.04 LTS |
|---|---|
| gdk-pixbuf | Needs evaluation |
The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application...
1 affected package
php-mongodb
| Package | 24.04 LTS |
|---|---|
| php-mongodb | Needs evaluation |
A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application that...
1 affected package
mongo-c-driver
| Package | 24.04 LTS |
|---|---|
| mongo-c-driver | Needs evaluation |
A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema...
1 affected package
libmongocrypt
| Package | 24.04 LTS |
|---|---|
| libmongocrypt | Needs evaluation |
Not in release
A weakness in the MongoDB C++ Driver's handling of caller-supplied namespace identifiers allows special characters embedded in those identifiers. An application that builds a namespace identifier from untrusted input without...
1 affected package
mongo-cxx-driver
| Package | 24.04 LTS |
|---|---|
| mongo-cxx-driver | Not in release |
The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the...
1 affected package
golang-mongodb-mongo-driver
| Package | 24.04 LTS |
|---|---|
| golang-mongodb-mongo-driver | Needs evaluation |