Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 47

Export CSV
CVE-2021-42096

mailman: CSRF token derived from admin password allows offline brute-force attack

GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A certain csrf_token value is derived from the admin password, and may be useful in conducting a brute-force attack against that password.

CVSS 3.1 · 4.3 Medium EPSS 1.2% KEV · Not listed
Vendors
Debian Gnu Redhat
Products
Debian Linux Mailman Enterprise Linux and 1 more
CVE-2020-15011

mailman: arbitrary content injection via the private archive login page

GNU Mailman before 2.1.33 allows arbitrary content injection via the Cgi/private.py private archive login page.

CVSS 3.1 · 4.3 Medium EPSS 1.9% KEV · Not listed
Vendors
Canonical Debian Gnu and 1 more
Products
Ubuntu Linux Debian Linux Mailman and 1 more
CVE-2020-12137

mailman: XSS via file attachments in list archives

GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform MIME sniffing, conclude that the MIME type should have been text/html, and execute JavaScript code.

CVSS 3.1 · 6.1 Medium EPSS 2.3% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 3 more
Products
Ubuntu Linux Debian Linux Fedora and 4 more
CVE-2018-5950

mailman: Cross-site scripting (XSS) vulnerability in web UI

Cross-site scripting (XSS) vulnerability in the web UI in Mailman before 2.1.26 allows remote attackers to inject arbitrary web script or HTML via a user-options URL.

CVSS 3.1 · 6.1 Medium EPSS 4.6% KEV · Not listed
Vendors
Canonical Debian Gnu and 1 more
Products
Ubuntu Linux Debian Linux Mailman and 7 more
CVE-2018-13796

mailman: Mishandled URLs in Utils.py:GetPathPieces() allows attackers to display arbitrary text on trusted sites

An issue was discovered in GNU Mailman before 2.1.28. A crafted URL can cause arbitrary text to be displayed on a web page from a trusted site.

CVSS 3.0 · 6.5 Medium EPSS 2.5% KEV · Not listed
Vendors
Gnu Redhat
Products
Mailman Enterprise Linux
CVE-2018-0618

mailman: Cross-site scripting vulnerability allows malicious listowners to inject scripts into listinfo pages

Cross-site scripting vulnerability in Mailman 2.1.26 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 3.0 · 5.4 Medium EPSS 2.0% KEV · Not listed
Vendors
Debian Gnu Redhat
Products
Debian Linux Mailman Enterprise Linux