Vulnerabilities > Carnegie Mellon University

DATE CVE VULNERABILITY TITLE RISK
2009-05-15 CVE-2009-0688 Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in Carnegie Mellon University Cyrus-Sasl
Multiple buffer overflows in the CMU Cyrus SASL library before 2.1.23 might allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via strings that are used as input to the sasl_encode64 function in lib/saslutil.c.
network
low complexity
carnegie-mellon-university CWE-119
7.5
2006-01-18 CVE-2006-0250 Remote Format String vulnerability in CMU SNMP SNMPTRAPD Daemon
Format string vulnerability in the snmp_input function in snmptrapd in CMU SNMP utilities (cmu-snmp) allows remote attackers to execute arbitrary code by sending crafted SNMP messages to UDP port 162.
network
low complexity
carnegie-mellon-university
6.4
2005-01-10 CVE-2004-1067 Remote Unspecified vulnerability in Cyrus IMAPD
Off-by-one error in the mysasl_canon_user function in Cyrus IMAP Server 2.2.9 and earlier leads to a buffer overflow, which may allow remote attackers to execute arbitrary code via the username.
network
low complexity
carnegie-mellon-university redhat ubuntu
critical
10.0
2005-01-10 CVE-2004-1015 Buffer overflow in proxyd for Cyrus IMAP Server 2.2.9 and earlier, with the imapmagicplus option enabled, may allow remote attackers to execute arbitrary code, a different vulnerability than CVE-2004-1011.
network
low complexity
carnegie-mellon-university redhat ubuntu
critical
10.0
2005-01-10 CVE-2004-1013 The argument parser of the FETCH command in Cyrus IMAP Server 2.2.x through 2.2.8 allows remote authenticated users to execute arbitrary code via certain commands such as (1) "body[p", (2) "binary[p", or (3) "binary[p") that cause an index increment error that leads to an out-of-bounds memory corruption. 10.0
2005-01-10 CVE-2004-1012 The argument parser of the PARTIAL command in Cyrus IMAP Server 2.2.6 and earlier allows remote authenticated users to execute arbitrary code via a certain command ("body[p") that is treated as a different command ("body.peek") and causes an index increment error that leads to an out-of-bounds memory corruption. 10.0
2005-01-10 CVE-2004-1011 Stack-based buffer overflow in Cyrus IMAP Server 2.2.4 through 2.2.8, with the imapmagicplus option enabled, allows remote attackers to execute arbitrary code via a long (1) PROXY or (2) LOGIN command, a different vulnerability than CVE-2004-1015. 10.0
2004-06-14 CVE-2002-1580 Unspecified vulnerability in Carnegie Mellon University Cyrus Imap Server
Integer overflow in imapparse.c for Cyrus IMAP server 1.4 and 2.1.10 allows remote attackers to execute arbitrary code via a large length value that facilitates a buffer overflow attack, a different vulnerability than CVE-2002-1347.
network
low complexity
carnegie-mellon-university
7.5
2001-08-30 CVE-2001-1154 Denial of Service vulnerability in Cyrus IMAP Server Potential
Cyrus 2.0.15, 2.0.16, and 1.6.24 on BSDi 4.2, with IMAP enabled, allows remote attackers to cause a denial of service (hang) using PHP IMAP clients.
network
low complexity
carnegie-mellon-university bsdi
5.0
2000-12-19 CVE-2000-0956 Unspecified vulnerability in Carnegie Mellon University Cyrus-Sasl 1.5.24
cyrus-sasl before 1.5.24 in Red Hat Linux 7.0 does not properly verify the authorization for a local user, which could allow the users to bypass specified access restrictions.
local
low complexity
carnegie-mellon-university
4.6