WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product smtp✕
Overview 14 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 1 EPSS ≥ 0.5
14matches 0in Waratek scope0.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 1EPSS ≥ 0.57.1%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 14 100.0% Withdrawn CVE 0 0.0%
Critical 1 7.1% High 8 57.1% Medium 4 28.6% Low 1 7.1% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 14 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 14 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 4 / year
Not applicable: 14 Low: 1Medium: 4High: 8Critical: 1 not blocked: 14 Working exploit published: 14
20001 Not applicable1 High1 not blocked1 Working exploit published1 20011 Not applicable1 Medium1 not blocked1 Working exploit published1 20020 20030 20041 Not applicable1 High1 not blocked1 Working exploit published1 20054 Not applicable4 High3 Medium1 not blocked4 Working exploit published4 20062 Not applicable2 High2 not blocked2 Working exploit published2 20070 20081 Not applicable1 High1 not blocked1 Working exploit published1 20090 20101 Not applicable1 Low1 not blocked1 Working exploit published1 20110 20120 20130 20140 20150 20160 20170 20180 20191 Not applicable1 Medium1 not blocked1 Working exploit published1 20202 Not applicable2 Critical1 Medium1 not blocked2 Working exploit published2
20002002200420062008201020122014201620182020
14 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2020-8794 Critical 2020-02-25 Not applicable Working exploit published OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is possible to attack a server because the server code launches the client code during bounce handling.
CVE-2020-8793 Medium 2020-02-25 Not applicable Working exploit published OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux distributions) because of a combination of an untrusted search path in makemap.c and race conditions in the offline functionality in smtpd.c.
CVE-2017-18518 Medium 2019-08-20 Not applicable Working exploit published The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues.
CVE-2008-7258 Low 2010-08-20 Not applicable Working exploit published The standardise function in Anibal Monsalve Salazar sSMTP 2.61 and 2.62 allows local users to cause a denial of service (application exit) via an e-mail message containing a long line that begins with a . (dot) character. NOTE: CVE disputes this issue because it is solely a usability problem for senders of messages with certain long lines, and has no security impact
CVE-2008-0394 High 2008-01-23 Not applicable Working exploit published Buffer overflow in Citadel SMTP server 7.10 and earlier allows remote attackers to execute arbitrary code via a long RCPT TO command, which is not properly handled by the makeuserkey function. NOTE: some of these details were obtained from third party information.
CVE-2006-5551 High 2006-10-26 Not applicable Working exploit published Stack-based buffer overflow in QK SMTP 3.01 and earlier might allow remote attackers to execute arbitrary code via a long argument to the RCPT TO command.
CVE-2006-2107 High 2006-04-29 Not applicable Working exploit published Buffer overflow in BL4 SMTP Server 0.1.4 and earlier allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a long argument to the (1) EHLO, (2) MAIL FROM, and (3) RCPT TO commands.
CVE-2005-2857 High 2005-09-08 Not applicable Working exploit published Free SMTP Server 2.2 allows remote attackers to use the server as an open mail relay (spam proxy).
CVE-2005-2409 High 2005-08-01 Not applicable Working exploit published Format string vulnerability in util.c in nbsmtp 0.99 and earlier, while running in debug mode, allows remote attackers to execute arbitrary code via format string specifiers that are not properly handled in a syslog call.
CVE-2005-1931 Medium 2005-07-05 Not applicable Working exploit published GoodTech SMTP Server 5.14 allows remote attackers to cause a denial of service (application crash) via a RCPT TO command with an invalid argument, as demonstrated using an "A" character.
CVE-2004-1291 High 2005-01-10 Not applicable Working exploit published Buffer overflow in qwik-smtpd allows remote attackers to use the server as an SMTP spam relay via a long HELO command, which overwrites the adjacent localIP data buffer.
CVE-2004-2677 High 2004-12-31 Not applicable Working exploit published Format string vulnerability in qwik-smtpd.c in QwikMail SMTP (qwik-smtpd) 0.3 and earlier allows remote attackers to execute arbitrary code via format specifiers in the (1) clientRcptTo array, and the (2) Received and (3) messageID variables, possibly involving HELO and hostname arguments.
CVE-2000-1129 Medium 2001-01-09 Not applicable Working exploit published McAfee WebShield SMTP 4.5 allows remote attackers to cause a denial of service via a malformed recipient field.
CVE-2000-0833 High 2000-11-14 Not applicable Working exploit published Buffer overflow in WinSMTP 1.06f and 2.X allows remote attackers to cause a denial of service via a long (1) USER or (2) HELO command.