Huawei EulerOS: Security Advisory for mailman (EulerOS-SA-2021-1096)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

NewStart CGSL CORE 5.04 / MAIN 5.04 : mailman Multiple Vulnerabilities (NS-SA-2020-0061)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has mailman packages installed that are affected by multiple vulnerabilities: - An issue was discovered in GNU Mailman before 2.1.28. A crafted URL can cause arbitrary text to be displayed on a web page from a trusted site...

NewStart CGSL CORE 5.05 / MAIN 5.05 : mailman Multiple Vulnerabilities (NS-SA-2020-0091)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has mailman packages installed that are affected by multiple vulnerabilities: - An issue was discovered in GNU Mailman before 2.1.28. A crafted URL can cause arbitrary text to be displayed on a web page from a trusted site...

Cross-site Request Forgery (CSRF)

Mailman is vulnerable to Cross Site Request Forgery CSRF, Allows an attacker to remotely hijack the authentication of arbitrary users for requests by modify an option to gain access to the credentials of a victim's account...

Content Injection

mailman is vulnerable to content injection. An attacker is able to inject arbitrary content in GNU Mailman...

Content Injection

GNU Mailman is vulnerable to content injection. An attacker is able to inject arbitrary content into the application via the Cgi/private.py private archive login page...

Oracle Linux 8 : mailman:2.1 (ELSA-2020-4667)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2020-4667 advisory. - Fix for CVE-2020-12137 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not tested...

mailman:2.1 security and bug fix update

3:2.1.29-10 - Fix match patter to reduce false allocation 3:2.1.29-9 - Fix for CVE-2020-12137 3:2.1.29-8 - Drop unversioned python from comments. 3:2.1.29-7 - Change attr of /etc/mailman 3:2.1.29-6 - Update run directory references 1805954 - fix 1188043 - set 2775 permission for /etc/mailman...

Moderate: Red Hat Security Advisory: mailman:2.1 security and bug fix update

An update for the mailman:2.1 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

mailman: XSS via file attachments in list archives

GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform MIME sniffing,...

RHEL 8 : mailman:2.1 (RHSA-2020:4667)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:4667 advisory. Mailman is a program used to help manage e-mail discussion lists. Security Fixes: mailman: XSS via file attachments in list archives CVE-2020-12137 F...

Moderate: mailman:2.1 security and bug fix update

Mailman is a program used to help manage e-mail discussion lists. Security Fixes: mailman: XSS via file attachments in list archives CVE-2020-12137 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page...

EulerOS 2.0 SP5 : mailman (EulerOS-SA-2020-2256)

According to the versions of the mailman package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - /options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection.CVE-2020-12108 - GNU Mailman 2.x before 2.1.30 uses the .obj...

EulerOS 2.0 SP5 : mailman (EulerOS-SA-2020-2291)

According to the version of the mailman package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - An issue was discovered in GNU Mailman before 2.1.28. A crafted URL can cause arbitrary text to be displayed on a web page from a trusted...

Huawei EulerOS: Security Advisory for mailman (EulerOS-SA-2020-2291)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for mailman (EulerOS-SA-2020-2256)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mailman 2.1.23 Cross Site Scripting

Title: Mailman 1.x 2.1.23 - Cross Site Scripting XSS Type: Reflected XSS Software: Mailman Version: =1.x = 2.1.23 Vendor Homepage: https://www.list.org Original link: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5950 POC Author: Valerio Alessandroni Date: 28/10/2020 Description:...

Mailman 1.x > 2.1.23 - Cross Site Scripting (XSS)

Title: Mailman 1.x 2.1.23 - Cross Site Scripting XSS Type: Reflected XSS Software: Mailman Version: =1.x = 2.1.23 Vendor Homepage: https://www.list.org Original link: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5950 POC Author: Valerio Alessandroni Date: 28/10/2020 Description:...

OPENSUSE-SU-2020:1752-1 Recommended update for mailman

This update for mailman to version 2.1.34 fixes the following issues: - The fix for lp1859104 can result in ValueError being thrown on attempts to subscribe to a list. This is fixed and extended to apply REFUSESECONDPENDING to unsubscription as well. lp1878458 - DMARC mitigation no longer misses ...

Medium: mailman

Issue Overview: A cross-site scripting vulnerability XSS has been discovered in mailman due to the hostname field not being properly validated. A malicious list owner could use this flaw to create a specially crafted list and inject client-side scripts. CVE-2018-0618 An issue was discovered in GN...