claws-mail records
9 published records for vendor claws-mail.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 77.8%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer2
- CWE-310 Cryptographic Issues1
- CWE-319 Cleartext Transmission of Sensitive Information1
- CWE-522 Insufficiently Protected Credentials1
- CWE-601 URL Redirection to Untrusted Site ('Open Redirect')1
- CWE-674 Uncontrolled Recursion1
The weakness classes this vendor ships most often: where to look.
CWEAll records
9 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
40Plan | CVE-2020-15917No exploit | common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after STARTTLS is mishandled.claws-mail · claws-mail | Critical9.8 | — | 2.6% | Jul 23, 2020 |
31Monitor | CVE-2020-16094No exploit | In imap_scan_tree_recursive in Claws Mail through 3.17.6, a malicious IMAP server can trigger stack consumption because of unlimited recursiclaws-mail · claws-mail · CWE-674 | High7.5 | — | 1.7% | Jul 28, 2020 |
30Monitor | CVE-2015-8614No exploit | Multiple stack-based buffer overflows in the (1) conv_jistoeuc, (2) conv_euctojis, and (3) conv_sjistoeuc functions in codeconv.c in Claws Mclaws-mail · claws-mail · CWE-119 | High7.3 | — | 2.5% | Apr 11, 2016 |
29Monitor | CVE-2015-8708No exploit | Stack-based buffer overflow in the conv_euctojis function in codeconv.c in Claws Mail 3.13.1 allows remote attackers to have unspecified impclaws-mail · claws-mail · CWE-119 | High7.3 | — | 1.5% | Apr 11, 2016 |
28Monitor | CVE-2014-2576No exploit | plugins/rssyl/feed.c in Claws Mail before 3.10.0 disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it eaclaws-mail · claws-mail · CWE-310 | Medium6.8 | — | 1.9% | Oct 15, 2014 |
24Monitor | CVE-2021-37746No exploit | textview_uri_security_check in textview.c in Claws Mail before 3.18.0, and Sylpheed through 3.7.0, does not have sufficient link checks befoclaws-mail · claws-mail · CWE-601 | Medium6.1 | — | 1.1% | Jul 30, 2021 |
22Monitor | CVE-2012-5527No exploit | Claws Mail vCalendar plugin: credentials exposed on interfaceclaws-mail · vcalendar · CWE-522 | Medium5.5 | — | 0.5% | Nov 25, 2019 |
21Monitor | CVE-2012-4507No exploit | The strchr function in procmime.c in Claws Mail (aka claws-mail) 3.8.1 allows remote attackers to cause a denial of service (NULL pointer declaws-mail · claws-mail | Medium5.0 | — | 2.7% | Oct 22, 2012 |
17Monitor | CVE-2019-10735No exploit | In Claws Mail 3.14.1, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart emaiclaws-mail · mail · CWE-319 | Medium4.3 | — | 0.6% | Apr 7, 2019 |
- CVE-2020-1591740Plan
common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after STARTTLS is mishandled.
CriticalCVSS 9.8No exploitEPSS 2%claws-mail · claws-mailJul 23, 2020
- CVE-2020-1609431Monitor
In imap_scan_tree_recursive in Claws Mail through 3.17.6, a malicious IMAP server can trigger stack consumption because of unlimited recursi
HighCVSS 7.5No exploitEPSS 1%claws-mail · claws-mailJul 28, 2020
- CVE-2015-861430Monitor
Multiple stack-based buffer overflows in the (1) conv_jistoeuc, (2) conv_euctojis, and (3) conv_sjistoeuc functions in codeconv.c in Claws M
HighCVSS 7.3No exploitEPSS 2%claws-mail · claws-mailApr 11, 2016
- CVE-2015-870829Monitor
Stack-based buffer overflow in the conv_euctojis function in codeconv.c in Claws Mail 3.13.1 allows remote attackers to have unspecified imp
HighCVSS 7.3No exploitEPSS 1%claws-mail · claws-mailApr 11, 2016
- CVE-2014-257628Monitor
plugins/rssyl/feed.c in Claws Mail before 3.10.0 disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it ea
MediumCVSS 6.8No exploitEPSS 1%claws-mail · claws-mailOct 15, 2014
- CVE-2021-3774624Monitor
textview_uri_security_check in textview.c in Claws Mail before 3.18.0, and Sylpheed through 3.7.0, does not have sufficient link checks befo
MediumCVSS 6.1No exploitEPSS 1%claws-mail · claws-mailJul 30, 2021
- CVE-2012-552722Monitor
Claws Mail vCalendar plugin: credentials exposed on interface
MediumCVSS 5.5No exploitEPSS 0%claws-mail · vcalendarNov 25, 2019
- CVE-2012-450721Monitor
The strchr function in procmime.c in Claws Mail (aka claws-mail) 3.8.1 allows remote attackers to cause a denial of service (NULL pointer de
MediumCVSS 5.0No exploitEPSS 2%claws-mail · claws-mailOct 22, 2012
- CVE-2019-1073517Monitor
In Claws Mail 3.14.1, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart emai
MediumCVSS 4.3No exploitEPSS 0%claws-mail · mailApr 7, 2019