https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 19:24:25 +0000 https://vulnerability.circl.lu/vuln/cve-2026-42008 <p><strong>Affected:</strong> Open-Xchange GmbH OX Dovecot Pro, Open-Xchange GmbH OX Dovecot CE</p> <p>Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot&#39;s own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without knowing that user&#39;s password. This affects deployments whose password database honours a field that permits authentication without a password. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are known.</p> <p><strong>Affected:</strong> Open-Xchange GmbH OX Dovecot Pro, Open-Xchange GmbH OX Dovecot CE</p> <p>Forwarding information received from a host listed as a trusted proxy is not kept separate from Dovecot&#39;s own authentication fields, so a value sent by that host can be injected as an internal authentication field. Any host permitted to act as a trusted proxy can authenticate as any user without knowing that user&#39;s password. This affects deployments whose password database honours a field that permits authentication without a password. Deployments that do not configure trusted proxies are not affected. Restrict the list of trusted proxy networks to hosts that are fully under your control. Update to non-vulnerable version. No publicly available exploits are known.</p> https://vulnerability.circl.lu/vuln/cve-2026-42008