CVE Vulnerability Catalog

Path Traversal vulnerability in Joomla extension Gridbox (before 2.20.4.0) in the showImage action allows reading files from sibling directories if image decoding fails, due to insufficient containment checks.

AKINSOFT WOLVOX Control Panel by AKIN Software contains a sensitive information insertion vulnerability into sent data, allowing Pull Data from System Resources. The issue affects versions from 26.02.25 before 26.02.26.

OctoCloud (by AKIN Software) versions from 1.12.06 before 1.12.07 contain an authorization bypass through User-Controlled key vulnerability, allowing access to functionality not properly constrained by ACLs.

Improper certificate validation in the webmail of hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to have S/MIME-encrypted mail that the account later sends to another correspondent also encrypted to the attacker's key. The webmail kept the signer's certificate for encrypting replies whether or not the server found its chain trusted, under the first e-mail address the certificate listed rather than the message's From address, and beside any certificate already held for that address.

hMailServer (by Progressive Robot) versions 6.0.0 through 6.3.5 fail open when applying DANE (RFC 7672) to outbound SMTP delivery, allowing an attacker to disable DANE for a DNSSEC-signed recipient domain and intercept or modify messages.

Inefficient algorithmic complexity in the webmail's message view of the REST API in hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message. The route that renders a received message's HTML replaced each reference to an embedded image in place, with work that grew with the square of the number of references, and wrote the image out for every reference while counting it against its size limit only once.

Inefficient algorithmic complexity in the REST API (6.3.3 through 6.3.5) and the IMAP PREVIEW response (6.2.22 through 6.3.5) of hMailServer allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message. To show a snippet of each message in a folder's message list, the server decoded the character entity references of a message that has an HTML part and no text part with a string replacement whose work grew with the square of their number.

hMailServer 6.0.0 through 6.3.5 processes several IMAP commands from a signed-in account in time quadratic in the command's length or in the number of elements it names, and can be made to hold memory out of proportion to a command. The FETCH data-item parser normalised a BODY[] section with a case-insensitive string replacement that copied the whole item per occurrence and split the item list by repeatedly copying the remainder of the command; the server's case-insensitive search compared a needle afresh at every position.

Inefficient algorithmic complexity in the decoding of message header fields in hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make the IMAP, SMTP and POP3 services, or the webmail, unavailable by sending a message. The server unfolded a decoded header value by finding each line break from the end of the value and removing it, moving the rest of the value each time, so its work grew with the square of the number of line breaks.

hMailServer (by Progressive Robot) versions 6.3.4 and 6.3.5 have inefficient algorithmic complexity in bounce and complaint processing, allowing a remote unauthenticated attacker to stop mail delivery.

Improper link resolution and external control of file paths in the administrative command-line operations of hMailServer.exe in hMailServer 6.3.4 and 6.3.5 allow a local attacker who already runs code as the low-privilege service account to escalate privilege. On Windows, operations run with administrator rights by the installer, DBSetup, the Control Panel or an administrator wrote log entries and crash records into the log folder, created, deleted and changed the permissions of the self-signed certificate and private key in the data folder, and rewrote message files in the data folder, all by path in folders the service account can modify, following junctions and mount points.

hMailServer (by Progressive Robot) versions 6.0.0 through 6.3.5 have inefficient algorithmic complexity and a non-terminating loop in MIME processing, allowing a remote unauthenticated attacker to make mail services unavailable.

Inefficient algorithmic complexity in the inbound DKIM and ARC signature verification of hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make mail services unavailable by sending a message. Building the canonical header and choosing the header fields named in a signature's h= tag took time growing with the square of the message's header. A message with many header fields or a field folded over many lines, with a DKIM-Signature for a domain the attacker controls, keeps a worker thread busy for tens of seconds per signature; up to ten signatures are evaluated per message by each of the DKIM and DMARC tests.

Inefficient algorithmic complexity in SPF macro expansion in hMailServer 6.3.4 and 6.3.5 allows a remote unauthenticated attacker to consume worker-thread time by publishing a crafted SPF record. RFC 7208 requires losing whole labels from the left, but the server did this by removing one label at a time and copying the rest, causing quadratic work. An attacker can make SPF checks take several seconds, but SPF limits bound the expansion, so availability loss is partial.

Inefficient algorithmic complexity in the JSON reader of hMailServer allows a remote unauthenticated attacker to make mail services unavailable. Reading a JSON object kept the first of each duplicated member name by searching the members already read, so an object of N distinct member names cost O(N^2): 1 MB took 8.9 seconds and 4 MB took 300 seconds. A remote attacker reaches the reader without an account by mailing a crafted TLS-RPT report (up to 16 MB after decompression) to a hosted domain's published report mailbox, which is read on a delivery thread; a few such reports hold every delivery thread (ten by default), so the server delivers no mail for over an hour per report.

Incorrect default permissions in the Windows installer of hMailServer 6.0.0 through 6.3.5 allow a local authenticated user to read the mail server's data. The installer created the data, log, temp, database and event folders and the hMailServer.INI configuration file with permissions inherited from the installation folder, by default under Program Files, which give the local Users group read access. Any user who can sign in to the computer could read every stored message, the logs, the built-in database with the accounts' password hashes whenever the service is stopped, and the configuration file, including the database password, which is sealed only with the machine's DPAPI key and can be unsealed by any local account; with an external database that password gives full control of it.

Inefficient complexity in Sieve filter evaluation in hMailServer 6.2.24 through 6.3.5 allows an authenticated account holder to make mail services unavailable with their own filter. ':matches' patterns were matched by backtracking descent with time growing exponentially with wildcards, and 'deleteheader' removed fields one at a time, causing O(N^2) cost. Sieve filters run on the small shared delivery thread pool, so an account holder can empty the pool and stop delivery for the whole server.

heap OOB write in convert_file_from_to() via a crafted Content-Type header allows attacker to OOB write when email is used as a template.

@fastify/jwt is a JSON Web Token plugin for Fastify. In versions before 10.2.3, a time span passed to expiresIn, notBefore, or maxAge that the parser cannot read is silently dropped instead of refused. This produces tokens with no expiration on signing, and on verification maxAge stops being enforced, so tokens that should be rejected are accepted. The issue is fixed in 10.2.3.

The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient. This allows an authenticated attacker with Subscriber-level access to mint wallet funds for themselves or drain a specific victim's balance into their own account.