RSS   Podatności dla 'Mailman'   RSS

2021-12-02
 
CVE-2021-44227

CWE-352
 
 
In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes.

 
2021-11-12
 
CVE-2021-43331

CWE-79
 
 
In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS.

 
 
CVE-2021-43332

CWE-307
 
 
In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potentially be cracked by a moderator via an offline brute-force attack.

 
2021-10-21
 
CVE-2021-42096

CWE-307
 
 
GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A certain csrf_token value is derived from the admin password, and may be useful in conducting a brute-force attack against that password.

 
 
CVE-2021-42097

CWE-352
 
 
GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not specific to a single user account. An attacker can obtain a value within the context of an unprivileged user account, and then use that value in a CSRF attack against an admin (e.g., for account takeover).

 
2020-05-06
 
CVE-2020-12108

CWE-74
 
 
/options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection.

 
2020-04-24
 
CVE-2020-12137

CWE-79
 
 
GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform MIME sniffing, conclude that the MIME type should have been text/html, and execute JavaScript code.

 
2018-07-26
 
CVE-2018-0618

CWE-79
 
 
Cross-site scripting vulnerability in Mailman 2.1.26 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.

 
2018-07-12
 
CVE-2018-13796

CWE-20
 
 
An issue was discovered in GNU Mailman before 2.1.28. A crafted URL can cause arbitrary text to be displayed on a web page from a trusted site.

 
2018-01-23
 
CVE-2018-5950

CWE-79
 
 
Cross-site scripting (XSS) vulnerability in the web UI in Mailman before 2.1.26 allows remote attackers to inject arbitrary web script or HTML via a user-options URL.

 

Copyright 2024, cxsecurity.com

 

Back to Top