James

This hub aggregates every CVE we track for James, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 15 most recently published vulnerabilities affecting James.

• CVE-2024-37358Apache James: denial of service through the use of IMAP literals8.6Feb 6, 2025
• CVE-2024-45626Apache James: denial of service through JMAP HTML to text conversion6.5Feb 6, 2025
• CVE-2023-51747SMTP smuggling in Apache James7.1Feb 27, 2024
• CVE-2023-51518Apache James server: Privilege escalation via JMX pre-authentication deserialisation9.8Feb 27, 2024
• CVE-2023-26269Apache James server: Privilege escalation through unauthenticated JMX7.8Apr 3, 2023
• CVE-2022-45935Apache James server: Temporary File Information Disclosure5.5Jan 6, 2023
• CVE-2022-45787Apache James MIME4J: Temporary File Information Disclosure in MIME4J TempFileStorageProvider5.5Jan 6, 2023
• CVE-2022-28220STARTTLS command injection in Apache JAMES7.5Sep 8, 2022
• CVE-2022-22931Path traversal in Apache James 3.6.14.3Feb 7, 2022
• CVE-2021-40525Sieve file storage vulnerable to path traversal attacks9.1Jan 4, 2022
• CVE-2021-40111Apache James IMAP parsing Denial Of Service6.5Jan 4, 2022
• CVE-2021-40110Apache James IMAP vulnerable to a ReDoS7.5Jan 4, 2022
• CVE-2021-38542Apache James vulnerable to STARTTLS command injection (IMAP and POP3)5.9Jan 4, 2022
• CVE-2019-0228Apache PDFBox 2.0.14 does not properly initialize the XML parser, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XFDF.9.8Apr 17, 2019
• CVE-2006-2806The SMTP server in Apache Java Mail Enterprise Server (aka Apache James) 2.2.0 allows remote attackers to cause a denial of service (CPU consumption) via a long argument to the MAIL command.7.8Jun 5, 2006