Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 30

Export CSV
CVE-2020-14928

evolution-data-server: Response injection via STARTTLS in SMTP and POP3

evolution-data-server (eds) through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3. When a server sends a "begin TLS" response, eds reads additional data and evaluates it in a TLS context, aka "response injection."

CVSS 3.1 · 5.9 Medium EPSS 2.6% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 2 more
CVE-2020-11879

evolution: attaching local filed/directories to composed email can lead to unintended information disclosure

An issue was discovered in GNOME Evolution before 3.35.91. By using the proprietary (non-RFC6068) "mailto?attach=..." parameter, a website (or other source of mailto links) can make Evolution attach local files or directories to a composed email message without showing a warning to the user, as demonstrated by an attach=. value.

CVSS 3.1 · 6.5 Medium EPSS 2.8% KEV · Not listed
Vendors
Gnome
Products
Evolution
CVE-2019-3890

evolution-ews: all certificate errors ignored if error is ignored during initial account setup in gnome-online-accounts

It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse this flaw to get confidential information by tricking the user into connecting to a fake server without the user noticing the difference.

CVSS 3.0 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Gnome Redhat
Products
Evolution-ews Enterprise Linux
CVE-2018-15587

evolution: specially crafted email leading to OpenPGP signatures being spoofed for arbitrary messages

GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a specially crafted email that contains a valid signature from the entity to be impersonated as an attachment.

CVSS 3.0 · 6.5 Medium EPSS 2.4% KEV · Not listed
Vendors
Debian Gnome Redhat
Products
Debian Linux Evolution Enterprise Linux
CVE-2018-12422

evolution-data-server: Unsafe use of strcat allows buffer overflow in addressbook/backends/ldap/e-book-backend-ldap.c

addressbook/backends/ldap/e-book-backend-ldap.c in Evolution-Data-Server in GNOME Evolution through 3.29.2 might allow attackers to trigger a Buffer Overflow via a long query that is processed by the strcat function. NOTE: the software maintainer disputes this because "the code had computed the required string length first, and then allocated a large-enough buffer on the heap.

CVSS 3.0 · 9.8 Critical EPSS 1.8% KEV · Not listed
Vendors
Gnome
Products
Evolution
CVE-2017-17689

S/MIME: CBC gadget attacks allows to exfiltrate plaintext out of encrypted emails

The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL.

CVSS 3.0 · 5.9 Medium EPSS 4.1% KEV · Not listed
Vendors
9folders Apple Bloop and 13 more
Products
Nine Mail Airmail and 14 more
CVE-2016-10727

evolution-data-server: IMAPx Component Information Disclosure

camel/providers/imapx/camel-imapx-server.c in the IMAPx component in GNOME evolution-data-server before 3.21.2 proceeds with cleartext data containing a password if the client wishes to use STARTTLS but the server will not use STARTTLS, which makes it easier for remote attackers to obtain sensitive information by sniffing the network. The server code was intended to report an error and not proceed, but the code was written incorrectly.

CVSS 3.0 · 9.8 Critical EPSS 2.9% KEV · Not listed
Vendors
Canonical Gnome Redhat
Products
Ubuntu Linux Evolution Enterprise Linux
CVE-2013-4166

evolution: incorrect selection of recipient gpg public key for encrypted mail

The gpg_ctx_add_recipient function in camel/camel-gpg-context.c in GNOME Evolution 3.8.4 and earlier and Evolution Data Server 3.9.5 and earlier does not properly select the GPG key to use for email encryption, which might cause the email to be encrypted with the wrong key and allow remote attackers to obtain sensitive information.

CVSS 3.1 · 7.5 High EPSS 1.9% KEV · Not listed
Vendors
Gnome Redhat
Products
Evolution Evolution Data Server Enterprise Linux and 3 more
CVE-2011-3355

evolution: IMAP does non-SSL connection when storing to Sent folder

evolution-data-server3 3.0.3 through 3.2.1 used insecure (non-SSL) connection when attempting to store sent email messages into the Sent folder, when the Sent folder was located on the remote server. An attacker could use this flaw to obtain login credentials of the victim.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Gnome Linux
Products
Evolution-data-server3 Linux Kernel
CVE-2009-3721

evolution: TNEF attachment decoder input sanitization errors (oCERT-2009-013)

Multiple directory traversal and buffer overflow vulnerabilities were discovered in yTNEF, and in Evolution's TNEF parser that is derived from yTNEF. A crafted email could cause these applications to write data in arbitrary locations on the filesystem, crash, or potentially execute arbitrary code when decoding attachments.

CVSS 3.1 · 7.8 High EPSS 1.6% KEV · Not listed
Vendors
Gnome Ytnef Project
Products
Evolution Ytnef