110 matches found
Mailman mailing lists manager directory traversal
It's possible to bypass filtering with URL like .../..../// and retrieve any file from from the system...
Mailman private.py true_path Function Traversal Arbitrary File Access
According to its version number, the remote installation of Mailman reportedly is affected by a directory traversal vulnerability in 'Cgi/private.py'. The flaw comes into play only on web servers that don't strip extraneous slashes from URLs, such as Apache 1.3.x, and allows a list subscriber,...
GNU Mailman < 2.1.6 Directory Traversal Arbitrary File Access
Binary data 2607.prm...
[Full-Disclosure] Administrivia: List Compromised due to Mailman Vulnerability
Hi On 7th February 2005 I was notified of a number of potentially - compromised Full-Disclosure subscriber accounts. Following an investigation it appears that the Mailman configuration database was obtained from lists.netsys.com on 2nd January 2005 using a remote directory traversal exploit for ...
CVE-2005-0202
Directory traversal vulnerability in the truepath function in private.py for Mailman 2.1.5 and earlier allows remote attackers to read arbitrary files via ".../....///" sequences, which are not properly cleansed by regular expressions that are intended to remove "../" and "./" sequences...
CVE-2005-0080
The 55optionstraceback.dpatch patch for mailman 2.1.5 in Ubuntu 4.10 displays a different error message depending on whether the e-mail address is subscribed to a private list, which allows remote attackers to determine the list membership for a given e-mail address...
CVE-2004-1143
The password generation in mailman before 2.1.5 generates only 5 million unique passwords, which makes it easier for remote attackers to guess passwords via a brute force attack...
CVE-2004-1177
Removed by vendor...
CVE-2004-1143
Removed by vendor...
CVE-2004-1177
Cross-site scripting XSS vulnerability in the driver script in mailman before 2.1.5 allows remote attackers to inject arbitrary web script or HTML via a URL, which is not properly escaped in the resulting error page...
mailman -- directory traversal vulnerability
A directory traversal vulnerability in mailman allow remote attackers to read arbitrary files due to inadequate input sanitizing. This could, among other things, lead remote attackers to gaining access to the mailman configuration database which contains subscriber email addresses and passwords o...
CVE-2004-1143
The password generation in mailman before 2.1.5 generates only 5 million unique passwords, which makes it easier for remote attackers to guess passwords via a brute force attack...
Debian DSA-147-1 : mailman - XSS
A cross-site scripting vulnerability was discovered in mailman, a software to manage electronic mailing lists. When a properly crafted URL is accessed with Internet Explorer other browsers don't seem to be affected, the resulting webpage is rendered similar to the real one, but the JavaScript...
CVE-2003-0991
Unknown vulnerability in the mail command handler in Mailman before 2.0.14 allows remote attackers to cause a denial of service crash via malformed e-mail commands...
CVE-2003-0991
Removed by vendor...
GLSA-200406-04 : Mailman: Member password disclosure vulnerability
The remote host is affected by the vulnerability described in GLSA-200406-04 Mailman: Member password disclosure vulnerability Mailman contains an unspecified vulnerability in the handling of request emails. Impact : By sending a carefully crafted email request to the mailman server an attacker...
CVE-2004-0412
Mailman before 2.1.5 allows remote attackers to obtain user passwords via a crafted email request to the Mailman server...
Mandrake Linux Security Advisory : mailman (MDKSA-2004:013)
A cross-site scripting vulnerability was discovered in mailman's administration interface CVE-2003-0965. This affects version 2.1 earlier than 2.1.4. Certain malformed email commands could cause the mailman process to crash. CVE-2003-0991. This affects version 2.0 earler than 2.0.14. Another...