https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 14 Nov 2026 19:05:00 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-126607 <p>Progressive Robot hMailServer 6.2.3 through 6.3.7 on Windows, with a MySQL or MariaDB database, hands the bundled MariaDB Connector/C the folder of its authentication plugins (the plugin folder in the installation&#39;s Bin folder) as Latin-1 bytes, which the client reads in the system&#39;s ANSI code page when it builds a plugin&#39;s path and loads the plugin with LoadLibraryExA, which allows a local authenticated user to execute code as the hMailServer service&#39;s account (LocalSystem, or the service&#39;s virtual account for a new installation from 6.3.4) by creating the folder those bytes name in the code page and placing in it a DLL with a plugin&#39;s name, when the installation folder&#39;s path holds a character between U+0080 and U+00FF whose byte the code page reads as another character, and none above U+00FF, and the user can create that other folder (by default any authenticated user may create a folder directly under the root of the system drive). The server converted the path with the C runtime&#39;s wcstombs_s in the C locale, which writes each character up to U+00FF as the byte of the same value: on code page 1252 those bytes are the same letters, while on another code page, such as 1251, or on a UTF-8 code page, they name another folder. The client loads the plugin the database server names in its greeting, unless it is built in, and any plugin the server names in an authentication switch, and tries again at each connection while a load fails, so with a MySQL 8.0 or later server, whose…</p> <p>Progressive Robot hMailServer 6.2.3 through 6.3.7 on Windows, with a MySQL or MariaDB database, hands the bundled MariaDB Connector/C the folder of its authentication plugins (the plugin folder in the installation&#39;s Bin folder) as Latin-1 bytes, which the client reads in the system&#39;s ANSI code page when it builds a plugin&#39;s path and loads the plugin with LoadLibraryExA, which allows a local authenticated user to execute code as the hMailServer service&#39;s account (LocalSystem, or the service&#39;s virtual account for a new installation from 6.3.4) by creating the folder those bytes name in the code page and placing in it a DLL with a plugin&#39;s name, when the installation folder&#39;s path holds a character between U+0080 and U+00FF whose byte the code page reads as another character, and none above U+00FF, and the user can create that other folder (by default any authenticated user may create a folder directly under the root of the system drive). The server converted the path with the C runtime&#39;s wcstombs_s in the C locale, which writes each character up to U+00FF as the byte of the same value: on code page 1252 those bytes are the same letters, while on another code page, such as 1251, or on a UTF-8 code page, they name another folder. The client loads the plugin the database server names in its greeting, unless it is built in, and any plugin the server names in an authentication switch, and tries again at each connection while a load fails, so with a MySQL 8.0 or later server, whose…</p> https://db.gcve.eu/vuln/fkie_cve-2026-126607 https://db.gcve.eu/vuln/ghsa-332h-7rh6-hg9m <p>Progressive Robot hMailServer 6.2.3 through 6.3.7 on Windows, with a MySQL or MariaDB database, hands the bundled MariaDB Connector/C the folder of its authentication plugins (the plugin folder in the installation&#39;s Bin folder) as Latin-1 bytes, which the client reads in the system&#39;s ANSI code page when it builds a plugin&#39;s path and loads the plugin with LoadLibraryExA, which allows a local authenticated user to execute code as the hMailServer service&#39;s account (LocalSystem, or the service&#39;s virtual account for a new installation from 6.3.4) by creating the folder those bytes name in the code page and placing in it a DLL with a plugin&#39;s name, when the installation folder&#39;s path holds a character between U+0080 and U+00FF whose byte the code page reads as another character, and none above U+00FF, and the user can create that other folder (by default any authenticated user may create a folder directly under the root of the system drive). The server converted the path with the C runtime&#39;s wcstombs_s in the C locale, which writes each character up to U+00FF as the byte of the same value: on code page 1252 those bytes are the same letters, while on another code page, such as 1251, or on a UTF-8 code page, they name another folder. The client loads the plugin the database server names in its greeting, unless it is built in, and any plugin the server names in an authentication switch, and tries again at each connection while a load fails, so with a MySQL 8.0 or later server, whose…</p> <p>Progressive Robot hMailServer 6.2.3 through 6.3.7 on Windows, with a MySQL or MariaDB database, hands the bundled MariaDB Connector/C the folder of its authentication plugins (the plugin folder in the installation&#39;s Bin folder) as Latin-1 bytes, which the client reads in the system&#39;s ANSI code page when it builds a plugin&#39;s path and loads the plugin with LoadLibraryExA, which allows a local authenticated user to execute code as the hMailServer service&#39;s account (LocalSystem, or the service&#39;s virtual account for a new installation from 6.3.4) by creating the folder those bytes name in the code page and placing in it a DLL with a plugin&#39;s name, when the installation folder&#39;s path holds a character between U+0080 and U+00FF whose byte the code page reads as another character, and none above U+00FF, and the user can create that other folder (by default any authenticated user may create a folder directly under the root of the system drive). The server converted the path with the C runtime&#39;s wcstombs_s in the C locale, which writes each character up to U+00FF as the byte of the same value: on code page 1252 those bytes are the same letters, while on another code page, such as 1251, or on a UTF-8 code page, they name another folder. The client loads the plugin the database server names in its greeting, unless it is built in, and any plugin the server names in an authentication switch, and tries again at each connection while a load fails, so with a MySQL 8.0 or later server, whose…</p> https://db.gcve.eu/vuln/ghsa-332h-7rh6-hg9m