Threats tagged 'ghsa-2wjf-5hp3-227w'

Progressive Robot hMailServer versions 6.0.0-B1 through 6.3.7 contain a vulnerability in the auto-ban mechanism that allows an attacker to bypass IP address banning after repeated failed login attempts. This flaw arises from how the server names and stores banned IP ranges based on usernames, leading to failures in saving bans when usernames are very long or contain certain characters such as NUL. Consequently, an attacker connecting from multiple IP addresses can continue guessing passwords over various protocols without being effectively banned.