Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6

Export CSV
CVE-2026-2604

Evolution-data-server: evolution data server: arbitrary file deletion via inconsistent uri handling

A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or modification. Later, during contact deletion, the URI is processed with a less strict check, leading to the deletion of arbitrary files on the host filesystem. This could potentially include critical Flatpak override files.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Gnome Redhat
Products
Evolution-data-server Enterprise Linux Rhel Els
CVE-2026-110777

Evolution-data-server: local file disclosure via attach file:// uris

A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. There are no file path restrictions or checks to verify whether the attachment originally came from the server or was added locally. This allows an attacker with access to a shared CalDAV calendar to exfiltrate arbitrary files the user has access to when interacting with malicious calendar events.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Gnome Red Hat Redhat
Products
Evolution-data-server Enterprise Linux Enterprise Linux and 1 more
CVE-2009-0582

evolution-data-server: insufficient checking of NTLM authentication challenge packets

The ntlm_challenge function in the NTLM SASL authentication mechanism in camel/camel-sasl-ntlm.c in Camel in Evolution Data Server (aka evolution-data-server) 2.24.5 and earlier, and 2.25.92 and earlier 2.25.x versions, does not validate whether a certain length value is consistent with the amount of data in a challenge packet, which allows remote mail servers to read information from the process memory of a client, or cause a denial of service (client crash), via an NTLM authentication type 2 packet with a length value that exceeds the amount of packet data.

CVSS 2.0 · 5.8 Medium EPSS 2.3% KEV · Not listed
Vendors
Gnome Redhat
Products
Evolution-data-server Enterprise Linux
CVE-2020-16117

evolution-data-server: NULL pointer dereference related to imapx_free_capability and imapx_connect_to_server

In GNOME evolution-data-server before 3.35.91, a malicious server can crash the mail client with a NULL pointer dereference by sending an invalid (e.g., minimal) CAPABILITY line on a connection attempt. This is related to imapx_free_capability and imapx_connect_to_server.

CVSS 3.1 · 5.9 Medium EPSS 2.0% KEV · Not listed
Vendors
Debian Gnome Redhat
Products
Debian Linux Evolution-data-server Enterprise Linux
CVE-2020-14928

evolution-data-server: Response injection via STARTTLS in SMTP and POP3

evolution-data-server (eds) through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3. When a server sends a "begin TLS" response, eds reads additional data and evaluates it in a TLS context, aka "response injection."

CVSS 3.1 · 5.9 Medium EPSS 2.6% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 2 more
CVE-2011-3355

evolution: IMAP does non-SSL connection when storing to Sent folder

evolution-data-server3 3.0.3 through 3.2.1 used insecure (non-SSL) connection when attempting to store sent email messages into the Sent folder, when the Sent folder was located on the remote server. An attacker could use this flaw to obtain login credentials of the victim.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Gnome Linux
Products
Evolution-data-server3 Linux Kernel