205 matches found
EUVD-2026-94832
The Linux live-update apply helper hmailserver-update of Progressive Robot hMailServer 6.3.4 and 6.3.5 runs as root on a request file written by the unprivileged hmailserver service account, and took from that request the program used to verify an AppImage update's signature and the systemd unit ...
CVE-2026-104658 Reliance on Untrusted Inputs in a Security Decision in hMailServer
The Linux live-update apply helper hmailserver-update of Progressive Robot hMailServer 6.3.4 and 6.3.5 runs as root on a request file written by the unprivileged hmailserver service account, and took from that request the program used to verify an AppImage update's signature and the systemd unit ...
CVE-2026-104704 Cleartext Transmission of Sensitive Information in hMailServer
Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger whose DNSSEC-validated TLSA records contain no DANE-EE usage 3 record, contrary to RFC 7672 section 2.2. The server used only DANE-EE records and treated a validated TLSA record s...
EUVD-2026-94831
Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger whose DNSSEC-validated TLSA records contain no DANE-EE usage 3 record, contrary to RFC 7672 section 2.2. The server used only DANE-EE records and treated a validated TLSA record s...
CVE-2026-104704 Cleartext Transmission of Sensitive Information in hMailServer
Progressive Robot hMailServer 6.0.0 through 6.3.5 does not enforce TLS for outbound SMTP delivery to a mail exchanger whose DNSSEC-validated TLSA records contain no DANE-EE usage 3 record, contrary to RFC 7672 section 2.2. The server used only DANE-EE records and treated a validated TLSA record s...
CVE-2026-104704
Progressive Robot hMailServer versions 6.0.0 through 6.3.5 are vulnerable to a flaw where the server fails to enforce TLS for outbound SMTP delivery when DNSSEC-validated TLSA records lack a DANE-EE (usage 3) record. Instead of strictly adhering to RFC 7672, the server treats certain unusable rec...
PT-2026-107906
Inefficient algorithmic complexity in the webmail's message view of the REST API in Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message. The route that renders ...
CVE-2026-100741
Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows, allows a remote, unauthenticated attacker to run arbitrary JScript inside the hMailServer service process, with the privileges of the service account, via a...
CVE-2026-100741
Progressive Robot Ltd's hMailServer (versions 6.0.0 through 6.3.3 on Windows) is vulnerable to Eval injection in the JScript event-script dispatcher. An unauthenticated remote attacker can execute arbitrary JScript within the hMailServer service process by sending a password containing a backslas...
EUVD-2026-87904
Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows, allows a remote, unauthenticated attacker to run arbitrary JScript inside the hMailServer service process, with the privileges of the service account, via a...
CVE-2026-100741 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServer
Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows, allows a remote, unauthenticated attacker to run arbitrary JScript inside the hMailServer service process, with the privileges of the service account, via a...
CVE-2026-100741 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServer
Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows, allows a remote, unauthenticated attacker to run arbitrary JScript inside the hMailServer service process, with the privileges of the service account, via a...
CVE-2026-100741 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServer
Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows, allows a remote, unauthenticated attacker to run arbitrary JScript inside the hMailServer service process, with the privileges of the service account, via a...
PT-2026-99509
Name of the Vulnerable Software and Affected Versions hMailServer versions 6.0.0 through 6.3.3 Description An eval injection exists in the JScript event-script dispatcher on Windows. A remote, unauthenticated attacker can execute arbitrary JScript within the service process using the privileges o...
CVE-2026-100741: Improper Neutralization of Directives in Dynamically Evaluated Code
Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows, allows a remote, unauthenticated attacker to run arbitrary JScript inside the hMailServer service process, with the privileges of the service account, via a...
EUVD-2008-3662
Malware in sbrugna...
EUVD-2013-5411
Malware in sbrugna...
EUVD-2025-22115
Malicious code in bioql PyPI...