Apache james

This hub aggregates every CVE we track for Apache james, a product in the communications space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 7 most recently published vulnerabilities affecting Apache james.

• CVE-2022-28220STARTTLS command injection in Apache JAMES7.5Sep 8, 2022
• CVE-2022-22931Path traversal in Apache James 3.6.14.3Feb 7, 2022
• CVE-2021-40525Sieve file storage vulnerable to path traversal attacks9.1Jan 4, 2022
• CVE-2021-40111Apache James IMAP parsing Denial Of Service6.5Jan 4, 2022
• CVE-2021-40110Apache James IMAP vulnerable to a ReDoS7.5Jan 4, 2022
• CVE-2021-38542Apache James vulnerable to STARTTLS command injection (IMAP and POP3)5.9Jan 4, 2022
• CVE-2017-12628The JMX server embedded in Apache James, also used by the command line client is exposed to a java de-serialization issue, and thus can be used to execute arbitrary commands. As James exposes JMX s...7.8Oct 20, 2017