Vulnerabilities (CVE)

Join the Common Vulnerabilities and Exposures (CVE) community and start to get notified about new vulnerabilities.

Filtered by vendor Cyrusimap Subscribe
Filtered by product Cyrus-sasl
Total 2 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2022-24407 5 Cyrusimap, Debian, Fedoraproject and 2 more 8 Cyrus-sasl, Debian Linux, Fedora and 5 more 2022-11-07 6.5 MEDIUM 8.8 HIGH
In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement.
CVE-2019-19906 8 Apache, Apple, Canonical and 5 more 20 Bookkeeper, Ipados, Iphone Os and 17 more 2022-04-12 5.0 MEDIUM 7.5 HIGH
cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl.