CVE Intelligence

OfflineIMAP vulnerabilities

🔔 Create alert RSS

Published CVEs affecting OfflineIMAP products: 1 record(s), with severity, exploitation and fixes.

OfflineIMAP 1

Exploited only (KEV) →

CVE-2020-37248 Medium · 6.5 CWE-348 Jun 8, 2026
OfflineIMAP before 8.0.3 trusts the server with their STARTTLS capability prior to…
OfflineIMAP before 8.0.3 trusts the server with their STARTTLS capability prior to authentication, which allows STRIPTLS/man-in-the-middle attacks, taking over the connection and extracting account credentials in cleartext.