Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
mailman vulnerabilities and exploits
(subscribe to this query)
6.5
CVSSv3
CVE-2021-43332
In GNU Mailman prior to 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potentially be cracked by a moderator via an offline brute-force attack.
Gnu Mailman
Debian Debian Linux 9.0
8.8
CVSSv3
CVE-2021-44227
In GNU Mailman prior to 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes.
Gnu Mailman
Debian Debian Linux 9.0
7.8
CVSSv3
CVE-2019-3693
A symlink following vulnerability in the packaging of mailman in SUSE Linux Enterprise Server 11, SUSE Linux Enterprise Server 12; openSUSE Leap 15.1 allowed local malicious users to escalate their privileges from user wwwrun to root. Additionally arbitrary files could be changed...
Suse Mailman
Opensuse Backports Sle 15.0
NA
CVE-2005-0080
The 55_options_traceback.dpatch patch for mailman 2.1.5 in Ubuntu 4.10 displays a different error message depending on whether the e-mail address is subscribed to a private list, which allows remote malicious users to determine the list membership for a given e-mail address.
Gnu Mailman 2.1.5
Ubuntu Ubuntu Linux 4.10
5.4
CVSSv3
CVE-2018-0618
Cross-site scripting vulnerability in Mailman 2.1.26 and previous versions allows remote authenticated malicious users to inject arbitrary web script or HTML via unspecified vectors.
Gnu Mailman
Debian Debian Linux 9.0
Debian Debian Linux 8.0
NA
CVE-2000-0701
The wrapper program in mailman 2.0beta3 and 2.0beta4 does not properly cleanse untrusted format strings, which allows local users to gain privileges.
Gnu Mailman 2.0
Conectiva Linux 4.2
Conectiva Linux 4.1
Conectiva Linux 5.1
Conectiva Linux 5.0
Redhat Linux
4.3
CVSSv3
CVE-2020-15011
GNU Mailman prior to 2.1.33 allows arbitrary content injection via the Cgi/private.py private archive login page.
Gnu Mailman
Canonical Ubuntu Linux 16.04
Canonical Ubuntu Linux 18.04
Debian Debian Linux 8.0
Debian Debian Linux 9.0
Debian Debian Linux 10.0
6.5
CVSSv3
CVE-2020-12108
/options/mailman in GNU Mailman prior to 2.1.31 allows Arbitrary Content Injection.
Gnu Mailman
Debian Debian Linux 9.0
Debian Debian Linux 10.0
Fedoraproject Fedora 31
Opensuse Leap 15.1
Opensuse Backports Sle 15.0
Opensuse Leap 15.2
Canonical Ubuntu Linux 18.04
Canonical Ubuntu Linux 16.04
6.1
CVSSv3
CVE-2020-12137
GNU Mailman 2.x prior to 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perfor...
Gnu Mailman
Debian Debian Linux 9.0
Debian Debian Linux 10.0
Fedoraproject Fedora 31
Fedoraproject Fedora 32
Debian Debian Linux 8.0
Canonical Ubuntu Linux 18.04
Canonical Ubuntu Linux 16.04
Opensuse Leap 15.2
Opensuse Backports Sle 15.0
7.5
CVSSv3
CVE-2021-33038
An issue exists in management/commands/hyperkitty_import.py in HyperKitty up to and including 1.3.4. When importing a private mailing list's archives, these archives are publicly visible for the duration of the import. For example, sensitive information might be available on...
Hyperkitty Project Hyperkitty
Debian Debian Linux 10.0
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2022-48693
CVE-2024-30851
CVE-2024-34460
CVE-2024-2887
local
CVE-2024-27956
remote code execution
CVE-2024-34475
privilege
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
NEXT »