CVE Vulnerability Catalog

Missing authorization in the REST role-management routes of Progressive Robot hMailServer 6.3.4 through 6.3.6 allows a remote authenticated user whose credential is confined to named domains to modify a custom role that accounts in other domains hold, and to create custom roles and delete any that no account holds. The routes that create, update and delete a custom role require the manage_roles permission, which only the serveradmin role holds; but a full-scope API key issued for named domains, and serveradmin assigned with a domain list, are serveradmin confined to those domains and hold manage_roles. The server's authorization gate did not refuse the three role routes to a confined credential and the route named no domain, so a credential issued to one tenant could raise or lower the permissions of a custom role assigned across other tenants.

Use of a less trusted source for the envelope sender in the external-account download of hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to have mail they write in the name of a domain the server hosts sent on by the server with an envelope sender at that domain, so that it passes the domain's SPF and DMARC at other receivers. A message the server downloads from an external POP3 or IMAP account has no SMTP envelope of its own, and the server took the address in its From header as its envelope sender, whatever that address was. A forward or redirect of the downloaded message to an outside address then left with that address as its envelope sender, which the Sender Rewriting Scheme leaves alone for a hosted domain, so that the receiver's SPF check passed for the forged domain, aligned even under strict alignment, with no non-default setting, host name record or DMARC policy needed.

Incorrect authorization in the Sender Rewriting Scheme (SRS) of Progressive Robot hMailServer 6.2.1 through 6.3.6 allows a remote attacker to relay mail through the server to outside addresses. With SRS enabled, the server rewrites the envelope sender of mail it forwards to a signed SRS address at the forwarding domain, and passes a bounce to that address back to the original sender; but it took every message to a valid SRS address, whatever its sender, as delivery to a local recipient, so the relay rules and the SMTP authentication they require were not applied, and the message was delivered to the outside address the SRS address encodes. Anyone holding a valid SRS address of the server could have the server relay mail to the address it encodes for 21 days.

The SMTP server in hMailServer 6.0.0 through 6.3.6 logs credentials that should be hidden, including AUTH PLAIN passwords in certain forms, OAuth 2.0 bearer tokens (XOAUTH2, OAUTHBEARER), the SCRAM-SHA-256 client proof, and the GSSAPI authenticator. A local user able to read the logs, or anyone with a copy, can obtain credentials.

A CSRF vulnerability exists in the REST API of hMailServer 6.0.0 through 6.3.6 because cross-site protection covers only the cookie session, not HTTP Basic authentication. A browser holding cached Basic credentials can be tricked into performing a state-changing request (e.g., creating a domain, account, or API key) from an attacker-controlled site.

Velneo vServer contains an improper link resolution before file access ('link following') vulnerability. This issue affects vServer from 32.3 before 36.6 and from 37.1 before 37.2.

A vulnerability was determined in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. The impacted element is the function include of the file index.php. Executing a manipulation of the argument page can lead to file inclusion. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.

pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, accessing a crafted PDF stream with a large number of filters or multiple filters that pass around large amounts of data can cause large memory consumption. This issue is fixed in version 6.20.0.

pypdf is a free and open-source pure-python PDF library. Prior to 6.20.0, an attacker can craft an incomplete PDF that ends inside a standard cross-reference table, causing pypdf to mishandle the unexpected end of file and enter an infinite loop. This issue is fixed in version 6.20.0.

pypdf before version 6.20.1 can enter an infinite loop when removing an object from a crafted cyclic PDF tree, such as an outline item, blocking the current process. The issue is fixed in version 6.20.1.

pypdf before version 6.20.1 can enter an infinite loop when calling PdfWriter.find_outline_item on a crafted PDF with a cyclic outline hierarchy, blocking the current process. The issue is fixed in version 6.20.1.

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing a content stream with many small operations, causing parsing to consume large amounts of memory. This issue is fixed in version 6.21.0.

pypdf is a free and open-source pure-python PDF library. Prior to 6.21.0, an attacker can craft a PDF containing arrays or dictionaries with many elements, causing parsing to consume large amounts of memory. This issue is fixed in version 6.21.0.

The odf-kit library versions 0.6.0 through 0.14.2 has an escapeHtml() helper applied to text content and attributes but not to inline CSS strings. In renderTextSpan and roughly ten other emission sites, values such as fo:color are copied verbatim from the document and concatenated raw into the style attribute, allowing injection via a quote character in the value.

Out-of-bounds read in the Motorola Oncore refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the GPS receiver's serial data to crash ntpd or disclose memory via a PPS Control (@@Gc) reply with an out-of-range mode byte.

Heap-based buffer overflow in the JJY refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the Telephone JJY time source to corrupt memory or crash ntpd via more than six time replies.

A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.

A NULL pointer dereference in the gf_ac4_presentation_ch_mode function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.

A SQL injection vulnerability was found in itsourcecode Sales-and-Inventory-System in /pages/cust_searchfrm.php via manipulation of the ID argument. The attack can be launched remotely and a public exploit is already available. The product uses a rolling release model, so specific affected versions are not provided.

A SQL injection vulnerability was found in itsourcecode Sales-and-Inventory-System in the file /pages/cust_edit.php, caused by manipulation of the ID argument. The attack can be performed remotely and a public exploit is already available.