CVE-2011-3355

HighCVSS 7.3/10Last modified Jun 16, 2026

Description

evolution-data-server3 3.0.3 through 3.2.1 used insecure (non-SSL) connection when attempting to store sent email messages into the Sent folder, when the Sent folder was located on the remote server. An attacker could use this flaw to obtain login credentials of the victim.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-311

Affected software

Vendor	Product	Versions
evolution-data-server3	evolution-data-server3	3.0.3 through 3.2.1

References

https://access.redhat.com/security/cve/cve-2011-3355Third Party Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=641052Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3355Issue Tracking, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2011-3355Third Party Advisory
https://www.openwall.com/lists/oss-security/2011/09/09/1Exploit, Mailing List
https://access.redhat.com/security/cve/cve-2011-3355Third Party Advisory
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=641052Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3355Issue Tracking, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2011-3355Third Party Advisory
https://www.openwall.com/lists/oss-security/2011/09/09/1Exploit, Mailing List

Timeline

Published: Nov 25, 2019
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-33564.3Multiple cross-site scripting (XSS) vulnerabilities in config_defaults_inc.php in MantisBT before 1.2.8 allow remote attackers to inject arb CVE-2011-33576.8Directory traversal vulnerability in bug_actiongroup_ext_page.php in MantisBT before 1.2.8 allows remote attackers to include and execute ar CVE-2011-33584.3Multiple cross-site scripting (XSS) vulnerabilities in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML v CVE-2011-33597.5The dma_rx function in drivers/net/wireless/b43/dma.c in the Linux kernel before 2.6.39 does not properly allocate receive buffers, which al CVE-2011-33609.3Untrusted search path vulnerability in Wireshark 1.4.x before 1.4.9 and 1.6.x before 1.6.2 allows local users to gain privileges via a Troja CVE-2011-33614.3Cross-site scripting (XSS) vulnerability in CGI/Browse.pm in BackupPC 3.2.0 and possibly other versions before 3.2.1 allows remote attackers CVE-2011-33626.8Integer signedness error in the decode_residual_block function in cavsdec.c in libavcodec in FFmpeg before 0.7.3 and 0.8.x before 0.8.2, and CVE-2011-33636.5The setup_cifs_sb function in fs/cifs/connect.c in the Linux kernel before 2.6.39 does not properly handle DFS referrals, which allows remot CVE-2011-33646.9Incomplete blacklist vulnerability in the svEscape function in settings/plugins/ifcfg-rh/shvar.c in the ifcfg-rh plug-in for GNOME NetworkMa CVE-2011-33654.3The KDE SSL Wrapper (KSSL) API in KDE SC 4.6.0 through 4.7.1, and possibly earlier versions, does not use a certain font when rendering cert CVE-2011-33664.3Rekonq 0.7.0 and earlier does not use a certain font when rendering certificate fields in a security dialog, which allows remote attackers t CVE-2011-33675.0Arora, possibly 0.11 and other versions, does not use a certain font when rendering certificate fields in a security dialog, which allows re