mailman

13 results · Feed

• High 8.8
  CVE-2021-44227

  Cross Site Request Forgery in mailman

  In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes.

  mailman mailman Ubuntu PyPI
  Dec 2, 2021
• Unscored —
  CVE-2021-43332

  In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the l…

  mailman Ubuntu
  Nov 12, 2021
• Unscored —
  CVE-2021-43331

  In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript fo…

  mailman Ubuntu
  Nov 12, 2021
• Unscored —
  CVE-2021-42097

  GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not specific to a single user ac…

  mailman Ubuntu
  Oct 21, 2021
• Unscored —
  CVE-2021-42096

  GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A certain csrf_token value is derived from the admin p…

  mailman Ubuntu
  Oct 21, 2021
• Unscored —
  CVE-2020-15011

  GNU Mailman before 2.1.33 allows arbitrary content injection via the Cgi/private.py private archive login page.

  mailman Ubuntu
  Jun 24, 2020
• Unscored —
  CVE-2020-12108

  /options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection.

  mailman Ubuntu
  May 6, 2020
• Unscored —
  CVE-2020-12137

  GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior m…

  mailman Ubuntu
  Apr 24, 2020
• Unscored —
  CVE-2018-0618

  Cross-site scripting vulnerability in Mailman 2.1.26 and earlier allows remote authenticated attackers to inject arbitr…

  GNU Mailman Mailman mailman Ubuntu
  Jul 26, 2018
• Medium 6.5
  CVE-2018-13796

  Moderate severity vulnerability that affects mailman

  An issue was discovered in GNU Mailman before 2.1.28. A crafted URL can cause arbitrary text to be displayed on a web page from a trusted site.

  mailman mailman Ubuntu PyPI
  Jul 12, 2018
• Unscored —
  CVE-2018-5950

  Cross-site scripting (XSS) vulnerability in the web UI in Mailman before 2.1.26 allows remote attackers to inject arbit…

  mailman Ubuntu
  Jan 23, 2018
• Unscored —
  CVE-2016-6893

  Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remo…

  mailman Ubuntu
  Sep 2, 2016
• Unscored —
  CVE-2015-2775

  Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers …

  mailman Ubuntu
  Apr 13, 2015