WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Vendor apache✕Product james server✕
Overview 4 matches · 2 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 1 EPSS ≥ 0.5
4matches 2protected50.0% 0exploited0.0% 0CISA KEV0.0% 1public PoC25.0% 1EPSS ≥ 0.525.0%
Protected by Waratek 2 50.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 2 50.0% Outside Waratek scope 0 0.0% Not applicable 0 0.0% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 4 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 50.0% partly blocked 0 0.0% not blocked 2 50.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 1 25.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 3 75.0%
split by peak 2 / year
No exploit published: 2Protected by Waratek: 2 High: 4 not blocked: 2blocked by ARMR today: 2 No public exploit: 3Working exploit published: 1
20161 Protected by Waratek1 High1 blocked by ARMR today1 Working exploit published1 20171 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 20180 20190 20200 20210 20220 20230 20240 20252 No exploit published2 High2 not blocked2 No public exploit2
2016201720182019202020212022202320242025
4 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2024-45626 High 2025-02-06 No exploit published No public exploit Apache James server JMAP HTML to text plain implementation in versions below 3.8.2 and 3.7.6 is subject to unbounded memory consumption that can result in a denial of service. Users are recommended to upgrade to version 3.7.6 and 3.8.2, which fix this issue.
CVE-2024-37358 High 2025-02-06 No exploit published No public exploit Similarly to CVE-2024-34055, Apache James is vulnerable to denial of service through the abuse of IMAP literals from both authenticated and unauthenticated users, which could be used to cause unbounded memory allocation and very long computations Version 3.7.6 and 3.8.2 restrict such illegitimate use of IMAP literals.
CVE-2017-12628 High 2017-10-20 Protected by Waratek No public exploit The JMX server embedded in Apache James, also used by the command line client is exposed to a java de-serialization issue, and thus can be used to execute arbitrary commands. As James exposes JMX socket by default only on local-host, this vulnerability can only be used for privilege escalation. Release 3.0.1 upgrades the incriminated library.
CVE-2015-7611 High 2016-06-07 Protected by Waratek Working exploit published Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified vectors.