RSS   Podatności dla 'Sympa'   RSS

2020-12-10
 
CVE-2020-29668

CWE-287
 
 
Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired cookie) as the cookie value to authenticateAndRun.

 
2020-05-27
 
CVE-2020-10936

CWE-269
 
 
Sympa before 6.2.56 allows privilege escalation.

 
2020-02-24
 
CVE-2020-9369

CWE-400
 
 
Sympa 6.2.38 through 6.2.52 allows remote attackers to cause a denial of service (disk consumption from temporary files, and a flood of notifications to listmasters) via a series of requests with malformed parameters.

 
2018-06-26
 
CVE-2018-1000550

CWE-22
 
 
The Sympa Community Sympa version prior to version 6.2.32 contains a Directory Traversal vulnerability in wwsympa.fcgi template editing function that can result in Possibility to create or modify files on the server filesystem. This attack appear to be exploitable via HTTP GET/POST request. This vulnerability appears to have been fixed in 6.2.32.

 
2015-01-22
 
CVE-2015-1306

 
 
The newsletter posting area in the web interface in Sympa 6.0.x before 6.0.10 and 6.1.x before 6.1.24 allows remote attackers to read arbitrary files via unspecified vectors.

 
2012-05-31
 
CVE-2012-2352

CWE-264
 
 
The archive management (arc_manage) page in wwsympa/wwsympa.fcgi.in in Sympa before 6.1.11 does not check permissions, which allows remote attackers to list, read, and delete arbitrary list archives via vectors related to the (1) do_arc_manage, (2) do_arc_download, or (3) do_arc_delete functions.

 
2008-10-07
 
CVE-2008-4476

CWE-59
 
 
sympa.pl in sympa 5.3.4 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/sympa_aliases.$$ temporary file. NOTE: wwsympa.fcgi was also reported, but the issue occurred in a dead function, so it is not a vulnerability.

 
2008-04-02
 
CVE-2008-1648

CWE-20
 
 
Sympa before 5.4 allows remote attackers to cause a denial of service (daemon crash) via an e-mail message with a malformed value of the Content-Type header and unspecified other headers. NOTE: some of these details are obtained from third party information.

 
2004-08-21
 
CVE-2004-1735

 
 
Cross-site scripting (XSS) vulnerability in the create list option in Sympa 4.1.x and earlier allows remote authenticated users to inject arbitrary web script or HTML via the description field.

 

Copyright 2024, cxsecurity.com

 

Back to Top