CVE-2020-15917

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after STARTTLS is mishandled.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Jul 23, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-159185.4Multiple Stored Cross Site Scripting (XSS) vulnerabilities were discovered in Mida eFramework through 2.9.0.CVE-2020-159196.1A Reflected Cross Site Scripting (XSS) vulnerability was discovered in Mida eFramework through 2.9.0.CVE-2020-15924.4<p>An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory.</p> <p>To exploit this vCVE-2020-159209.8There is an OS Command Injection in Mida eFramework through 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with adminiCVE-2020-159219.8Mida eFramework through 2.9.0 has a back door that permits a change of the administrative password and access to restricted functionalities,CVE-2020-159229.8There is an OS Command Injection in Mida eFramework 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrativeCVE-2020-159237.5Mida eFramework through 2.9.0 allows unauthenticated ../ directory traversal.CVE-2020-159247.5There is a SQL Injection in Mida eFramework through 2.9.0 that leads to Information Disclosure. No authentication is required. The injectionCVE-2020-159258.8A SQL injection vulnerability at a tpf URI in Loway QueueMetrics before 19.10.21 allows remote authenticated attackers to execute arbitrary CVE-2020-159266.1Rocket.Chat through 3.4.2 allows XSS where an attacker can send a specially crafted message to a channel or in a direct message to the clienCVE-2020-159278.8Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp request in the SAP moCVE-2020-159285.3In Ortus TestBox 2.4.0 through 4.1.0, unvalidated query string parameters to test-browser/index.cfm allow directory traversal.
CVE-2020-15917: Critical severity, CVSS 9.8 | Vulnix