Sun Javamail vulnerabilities

4 CVEs affecting Sun Javamail, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2007-6059, published 2007-11-20.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2005-1105, published 2005-05-02. Medium severity, CVSS 5.0. EPSS: 5.8% chance of exploitation in the next 30 days. Directory traversal vulnerability in the MimeBodyPart.getFileName method in JavaMail 1.3.2 allows remote attackers to write arbitrary files via a .. (dot dot) in the filename in the…
CVE-2005-1754, published 2005-12-31. Medium severity, CVSS 5.0. EPSS: 2.8% chance of exploitation in the next 30 days. JavaMail API 1.1.3 through 1.3, as used by Apache Tomcat 5.0.16, allows remote attackers to read arbitrary files via a full pathname in the argument to the Download parameter. NOTE: Sun and Apache…
CVE-2007-6059, published 2007-11-20. Medium severity, CVSS 5.0. EPSS: 1.8% chance of exploitation in the next 30 days. Javamail does not properly handle a series of invalid login attempts in which the same e-mail address is entered as username and password, and the domain portion of this address yields a Java…
CVE-2005-1753, published 2005-12-31. Medium severity, CVSS 5.0. EPSS: 1.2% chance of exploitation in the next 30 days. ReadMessage.jsp in JavaMail API 1.1.3 through 1.3, as used by Apache Tomcat 5.0.16, allows remote attackers to view other users' e-mail attachments via a direct request to…