Mandrake Linux Security Advisory : mailman (MDKSA-2005:015)

Florian Weimer discovered a vulnerability in Mailman, which can be exploited by malicious people to conduct cross-site scripting attacks. Input is not properly sanitised by 'scripts/driver' when returning error pages. This can be exploited to execute arbitrary HTML or script code in a user's...

Mailman: Cross-site scripting vulnerability

Background Mailman is a Python-based mailing list server with an extensive web interface. Description Florian Weimer has discovered a cross-site scripting vulnerability in the error messages that are produced by Mailman. Impact By enticing a user to visiting a specially-crafted URL, an attacker c...

CVE-2005-0080

The 55optionstraceback.dpatch patch for mailman 2.1.5 in Ubuntu 4.10 displays a different error message depending on whether the e-mail address is subscribed to a private list, which allows remote attackers to determine the list membership for a given e-mail address...

CVE-2004-1177

Cross-site scripting XSS vulnerability in the driver script in mailman before 2.1.5 allows remote attackers to inject arbitrary web script or HTML via a URL, which is not properly escaped in the resulting error page...

CVE-2004-1143

The CVE-2004-1143 issue concerns Mailman prior to version 2.1.5, where auto-generated passwords are limited to about 5 million, enabling remote attackers to perform brute-force guessing of subscriber credentials. Remediation: upgrade to Mailman 2.1.5 or newer (as detailed in related advisories). ...

CVE-2004-1143

The password generation in mailman before 2.1.5 generates only 5 million unique passwords, which makes it easier for remote attackers to guess passwords via a brute force attack...

CVE-2004-1177

CVE-2004-1177 is an XSS vulnerability in Mailman’s driver script (affecting mailman up to before 2.1.5) where an unescaped URL in an error page can inject arbitrary script/HTML. Public references (GHSA advisory and multiple OpenVAS/Debian/SUSE entries) confirm the issue and link to affected Mailm...

CVE-2004-1177

Removed by vendor...

CVE-2004-1143

Removed by vendor...

CVE-2005-0080

CVE-2005-0080 affects Mailman 2.1.5 via the 55_options_traceback.dpatch patch used in Ubuntu 4.10. The patch causes the error message to differ based on whether an email address is subscribed to a private list, enabling remote attackers to determine list membership for a given address. The availa...

CVE-2005-0080

Removed by vendor...

GNU Mailman Multiple Unspecified Remote Vulnerabilities

The remote host is running GNU Mailman, a web-based application for managing mailing lists. The version running on the remote host has multiple flaws, such as information disclosure and cross-site scripting. These vulnerabilities could allow a remote attacker to gain unauthorized access...

USN-59-1: mailman vulnerabilities

Florian Weimer discovered a cross-site scripting vulnerability in mailman's automatically generated error messages. An attacker could craft an URL containing JavaScript or other content embedded into HTML which triggered a mailman error page. When an unsuspecting user followed this URL, the...

CVE-2004-1177

Cross-site scripting XSS vulnerability in the driver script in mailman before 2.1.5 allows remote attackers to inject arbitrary web script or HTML via a URL, which is not properly escaped in the resulting error page...

CVE-2004-1177

Cross-site scripting XSS vulnerability in the driver script in mailman before 2.1.5 allows remote attackers to inject arbitrary web script or HTML via a URL, which is not properly escaped in the resulting error page...

mailman -- directory traversal vulnerability

A directory traversal vulnerability in mailman allow remote attackers to read arbitrary files due to inadequate input sanitizing. This could, among other things, lead remote attackers to gaining access to the mailman configuration database which contains subscriber email addresses and passwords o...

CVE-2004-1143

The password generation in mailman before 2.1.5 generates only 5 million unique passwords, which makes it easier for remote attackers to guess passwords via a brute force attack...

CVE-2004-1143

The password generation in mailman before 2.1.5 generates only 5 million unique passwords, which makes it easier for remote attackers to guess passwords via a brute force attack...

mailman -- generated passwords are poor quality

Florian Weimer wrote: Mailman 2.1.5 uses weak auto-generated passwords for new subscribers. These passwords are assigned when members subscribe without specifying their own password either by email or the web frontend. Knowledge of this password allows an attacker to gain access to the list archi...

Debian DSA-147-1 : mailman - XSS

A cross-site scripting vulnerability was discovered in mailman, a software to manage electronic mailing lists. When a properly crafted URL is accessed with Internet Explorer other browsers don't seem to be affected, the resulting webpage is rendered similar to the real one, but the JavaScript...