https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2009-4824.htmlhttps://patchthecve.com/cve/CVE-2009-4824.htmlTue, 16 Jun 2026 23:14:25 +0000HIGH 7.5: Unspecified vulnerability in Kolab Webclient before 1.2.0 in Kolab Server before 2.2.3 allows attackers to have an unspecified impact via vectors related to an "image upload form."https://patchthecve.com/cve/CVE-2008-4165.htmlhttps://patchthecve.com/cve/CVE-2008-4165.htmlTue, 16 Jun 2026 22:57:17 +0000MEDIUM 4.0: admin/user/create_user.php in Kolab Groupware Server 1.0.0 places a user password in an HTTP GET request, which allows local administrators, and possibly remote attackers, to obtain cleartext passwords by reading the ssl_access_log file or the referer string.https://patchthecve.com/cve/CVE-2007-4510.htmlhttps://patchthecve.com/cve/CVE-2007-4510.htmlTue, 16 Jun 2026 22:44:14 +0000MEDIUM 4.3: ClamAV before 0.91.2, as used in Kolab Server 2.0 through 2.2beta1 and other products, allows remote attackers to cause a denial of service (application crash) via (1) a crafted RTF file, which triggers a NULL dereference in the cli_scanrtf function in libclamav/rtf.c; or (2) a crafted HTML documenthttps://patchthecve.com/cve/CVE-2006-0213.htmlhttps://patchthecve.com/cve/CVE-2006-0213.htmlTue, 16 Jun 2026 22:20:06 +0000MEDIUM 4.6: Kolab Server 2.0.1, 2.0.2 and development versions pre-2.1-20051215 and earlier, when authenticating users via secure SMTP, stores authentication credentials in plaintext in the postfix.log file, which allows local users to gain privileges.https://patchthecve.com/cve/CVE-2005-4828.htmlhttps://patchthecve.com/cve/CVE-2005-4828.htmlTue, 16 Jun 2026 22:19:31 +0000MEDIUM 6.4: Kolab Server 2.0.0 and 2.0.1 does not properly handle when a large email is sent with a "." in the wrong place, which causes kolabfilter to add another ".", which might break clear-text signatures and attachments. NOTE: it is not clear whether this issue crosses privilege boundaries, so this might https://patchthecve.com/cve/CVE-2004-1997.htmlhttps://patchthecve.com/cve/CVE-2004-1997.htmlTue, 16 Jun 2026 22:08:47 +0000MEDIUM 4.6: Kolab stores OpenLDAP passwords in plaintext in the slapd.conf file, which may be installed world-readable, which allows local users to gain privileges.