Filtered by vendor Apache
Subscriptions
Filtered by product James Server
Subscriptions
Total
4 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-26269 | 1 Apache | 2 James, James Server | 2025-02-13 | 7.8 High |
| Apache James server version 3.7.3 and earlier provides a JMX management service without authentication by default. This allows privilege escalation by a malicious local user. Administrators are advised to disable JMX, or set up a JMX password. Note that version 3.7.4 onward will set up a JMX password automatically for Guice users. | ||||
| CVE-2024-45626 | 1 Apache | 1 James Server | 2025-02-12 | 6.5 Medium |
| Apache James server JMAP HTML to text plain implementation in versions below 3.8.2 and 3.7.6 is subject to unbounded memory consumption that can result in a denial of service. Users are recommended to upgrade to version 3.7.6 and 3.8.2, which fix this issue. | ||||
| CVE-2017-12628 | 1 Apache | 1 James Server | 2024-11-21 | N/A |
| The JMX server embedded in Apache James, also used by the command line client is exposed to a java de-serialization issue, and thus can be used to execute arbitrary commands. As James exposes JMX socket by default only on local-host, this vulnerability can only be used for privilege escalation. Release 3.0.1 upgrades the incriminated library. | ||||
| CVE-2015-7611 | 1 Apache | 1 James Server | 2024-11-21 | N/A |
| Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified vectors. | ||||
Page 1 of 1.