All CVEs — page 254 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
A local user can bypass authorization on COM objects in hMailServer to read and write arbitrary files as the service account, queue mail as any sender, and manipulate fetch accounts without authentication. This allows privilege escalation and data compromise.
The Progressive Robot hMailServer has a critical flaw in its REST API listener that allows remote attackers to brute-force administrator passwords through DNS rebinding attacks. The vulnerability occurs because the server accepts requests regardless of Host header values and doesn't throttle failed login attempts, enabling attackers to send authenticated requests from the victim's browser at full speed.
A privilege escalation flaw exists in hMailServer's live-update helper that allows an attacker with the hmailserver service account to execute arbitrary code as root, affecting versions 6.3.4 and 6.3.5.
The Linux builds of Progressive Robot hMailServer are vulnerable to a denial-of-service attack due to missing network timeouts that cause server threads to hang indefinitely during outbound mail delivery. This affects all outbound email processing and can be triggered by attackers who control domains that receive mail through the server.
A cross-site scripting vulnerability in Progressive Robot hMailServer's webmail allows remote attackers to execute scripts in the context of a user's session when they open decrypted email attachments. This occurs because the webmail renders text/html attachments as documents from the webmail's origin, enabling script execution that can access the user's mailbox and perform actions through the REST API.
A heap-based buffer overflow exists in Progressive Robot hMailServer's legacy Blowfish decryption routine that allows a local user to write beyond a 255-byte heap buffer, potentially leading to service crashes or code execution with LocalSystem privileges.
A high-privilege user can inject arguments into troubleshooting commands, leading to privilege escalation.
Apache DolphinScheduler contains an authorization bypass vulnerability that allows authenticated users to stop or create savepoints for task instances in projects they don't have access to. This flaw enables unauthorized operations on critical workflow components, potentially leading to data corruption or process disruption.
An authorization bypass flaw in Apache DolphinScheduler allows authenticated users to modify task definitions in projects they shouldn't have access to by exploiting a missing validation check on the project-task relationship. This can lead to unauthorized workflow modifications and execution disruptions.