1505 matches found
CVE-2025-43919-POC
🚨 CVE-2025-43919：GNU Mailman 2.1.39 中的目录遍历漏洞（cPanel/WHM） 在随 cPanel/WHM 捆绑发布的 GNU Mailman 2.1.39 中发现了一个新漏洞，允许未经身份验证的远程攻击者通过目录遍历缺陷读取服务器上的任意文件。 📌 漏洞摘要： 类型 ：目录遍历（未认证） 组件 ：private.py CGI 脚本 受影响端点 ：/mailman/private/mailman 影响 ：泄露 /etc/passwd、.mbox 存档和 Mailman 配置文件等文件 CVSS 评分 ：5.8（中危） CVE ID...
CVE-2025-43920
CVE-2025-43920: Inyección de Comandos a través del Asunto del Correo Electrónico en GNU Mailman 2.1.39 Paquete cPanel/WHM Descubierto por: Firudin Davudzada y Musazada Aydan Fecha de Divulgación: Abril de 2025 CVE ID: CVE-2025-43920 Severidad: 5.4 Medio CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:...
CVE-2025-43919
CVE-2025-43919：GNU Mailman 2.1.39 中的目录遍历漏洞（cPanel/WHM 捆绑版） 发现者： Firudin Davudzada & Musazada Aydan 披露日期： 2025年4月 CVE ID： CVE-2025-43919 严重性： 5.8 中等（CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N） 攻击类型： 远程 受影响软件： GNU Mailman 2.1.39（与 cPanel/WHM 捆绑） 概述 与 cPanel 和 WHM 捆绑的 GNU Mailman 2.1.39 在...
CVE-2025-43921
CVE-2025-43921: Unauthenticated Mailing List Creation in GNU Mailman 2.1.39 cPanel/WHM Bundle Discovered by: Firudin Davudzada & Musazada Aydan Disclosure Date: April 2025 CVE ID: CVE-2025-43921 Severity: 5.3 Medium CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Attack Type: Remote Affected Softwar...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093198)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093198 advisory. In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potentially be...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093203)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093203 advisory. In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request using that token to set a new admin password or make other...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093171)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093171 advisory. GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093157)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093157 advisory. GNU Mailman before 2.1.33 allows arbitrary content injection via the Cgi/private.py private archive login page. Tenable has extracted the preceding description block...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093193)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093193 advisory. In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS. Tenable has extracted the preceding...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093164)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093164 advisory. /options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection. Tenable has extracted the preceding description block directly from the Unity Linux...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093166)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093166 advisory. GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrftoken value is not specific to a single user account. An attacker can obtain a value within th...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093169)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093169 advisory. GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A certain csrftoken value is derived from the admin password, and may be useful in conducting a...
PYSEC-2026-658 Mailman Sensitive Information Disclosure
Mailman before 2.1.5 allows remote attackers to obtain user passwords via a crafted email request to the Mailman server...
Mailman Cross-site scripting (XSS) vulnerability
Cross-site scripting XSS vulnerability in options.py for Mailman 2.1 allows remote attackers to inject script or HTML into web pages via the 1 email or 2 language parameters...
PYSEC-2026-659 mailman Cross-site scripting (XSS) vulnerability
Cross-site scripting XSS vulnerability in the driver script in mailman before 2.1.5 allows remote attackers to inject arbitrary web script or HTML via a URL, which is not properly escaped in the resulting error page...
PYSEC-2026-657 Mailman Cross-site scripting (XSS) vulnerability
Cross-site scripting XSS vulnerability in options.py for Mailman 2.1 allows remote attackers to inject script or HTML into web pages via the 1 email or 2 language parameters...
PYSEC-2026-660 Cross Site Request Forgery in mailman
In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request using that token to set a new admin password or make other changes...
PYSEC-2026-661 Moderate severity vulnerability that affects mailman
An issue was discovered in GNU Mailman before 2.1.28. A crafted URL can cause arbitrary text to be displayed on a web page from a trusted site...
