CVE-2001-1283
HighSummary
The webmail interface for Ipswitch IMail 7.04 and earlier allows remote authenticated users to cause a denial of service (crash) via a mailbox name that contains a large number of dots or other characters, potentially leading to a buffer overflow and arbitrary code execution.
Risk Assessment
The organization may experience service outages in email services, which could lead to data loss and user trust issues.
Recommendation
It is recommended to upgrade to a newer version of Ipswitch IMail to mitigate this vulnerability and to monitor logs for potential attack attempts.
Related vulnerabilities
- CVE-2026-20279Critical
A vulnerability in Cisco IOS XR Software relates to improper access control issues (CWE-284). It was discovered during an internal security review and addressed in software hardening releases.
- CVE-2026-20274Critical
A vulnerability in Cisco IOS XR Software relates to improper resource control issues (CWE-664). It was discovered during an internal security review and addressed in software hardening releases.
- CVE-2026-20212Critical
A vulnerability in the Silicon One integration for Cisco Nexus 9000 Series Switches allows an unauthenticated remote attacker to execute code with root privileges. TCP ports 43210 and 43211 are accessible in the default L3 VRF, and crafted input can lead to code execution or crash of the S1HAL process causing device reload.
- CVE-2026-53611Critical
Looking Glass prior to version 1.3.5 contains an OS Command Injection vulnerability resulting from an unanchored regular expression in the input validation layer. This issue has been patched in version 1.3.5.
- CVE-2026-82955Critical
In the current development version of Eclipse aeriOS, the KrakenD instance in the API Gateway had disable_jwk_security hard-coded to true, disabling TLS certificate verification when retrieving JWKS. This could allow an attacker to intercept communication and provide a malicious JWKS, compromising token validation. The issue has been fixed by making the parameter configurable and defaulting to false.
- CVE-2026-77009Critical
The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code, allowing any authenticated user, such as a subscriber, to run arbitrary code on the server.
- CVE-2026-4357Critical
The Embed HTML5 Game WordPress plugin through 1.3 does not properly restrict who can upload files, making it possible for unauthenticated attackers to upload PHP backdoors on affected sites.
- CVE-2025-9314Critical
The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component.
- CVE-2026-84803Critical
SiYuan before version 3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable file types. Attackers can upload files with extensions like .xht, .ehtml, .xsl, .xbl, or .rdf that resolve to executable media types and execute JavaScript to steal API tokens and compromise workspaces.
- CVE-2026-84795Critical
Craft CMS before 5.10.11 fails to validate the admin flag during user registration, allowing it to persist from deactivated admin accounts. Attackers can register with a deactivated admin's email address to inherit administrator privileges when public registration and disabled email verification are configured.
Original NVD description (English source)
The webmail interface for Ipswitch IMail 7.04 and earlier allows remote authenticated users to cause a denial of service (crash) via a mailbox name that contains a large number of . (dot) or other characters to programs such as (1) readmail.cgi or (2) printmail.cgi, possibly due to a buffer overflow that may allow execution of arbitrary code.