Cross-site Scripting (XSS)

mailman is vulnerable to cross-site scripting XSS. The vulnerability exists as a cross-site scripting XSS flaw in the driver script of mailman prior to version 2.1.5 could allow remote attackers to execute scripts as other web users...

CentOS 7 : mailman (RHSA-2020:1054)

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1054 advisory. - Cross-site scripting vulnerability in Mailman 2.1.26 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via...

mailman security update

CentOS Errata and Security Advisory CESA-2020:1054 An update for mailman is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

mailman security and bug fix update

3:2.1.15-30 - Resolves: 1599692 - Sanitize input on listinfo page CVE-2018-0618 3:2.1.15-29 - Resolves: 1611689 - Trim long text in 'no such list' messages 3:2.1.15-28 - Resolves: 1718180 - Try to decode member name first 3:2.1.15-27 - Related : 1545973 - Bump release to override rhel-7.4.z versi...

Cross-Site Scripting (XSS)

mailman is vulnerable to cross-site scripting XSS. A listowner is able to inject and execute arbitrary Javascripts in a user's browser via the listinfo pages...

URL Mishandling

Mailman is vulnerable to URL mishandling. The Utils.py:GetPathPieces allows attackers to display arbitrary text on trusted sites since it does not correctly handle the URL...

RHEL 7 : mailman (RHSA-2020:1054)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1054 advisory. Mailman is a program used to help manage e-mail discussion lists. Security Fixes: mailman: Cross-site scripting vulnerability allows malicio...

Moderate: Red Hat Security Advisory: mailman security and bug fix update

An update for mailman is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

mailman: Mishandled URLs in Utils.py:GetPathPieces() allows attackers to display arbitrary text on trusted sites

An issue was discovered in GNU Mailman before 2.1.28. A crafted URL can cause arbitrary text to be displayed on a web page from a trusted site...

mailman: Cross-site scripting vulnerability allows malicious listowners to inject scripts into listinfo pages

A cross-site scripting vulnerability XSS has been discovered in mailman due to the hostname field not being properly validated. A malicious list owner could use this flaw to create a specially crafted list and inject client-side scripts...

Security update for mailman (moderate)

openSUSE Security Update: Security update for mailman Announcement ID: openSUSE-SU-2020:0156-1 Rating: moderate References: 1154328 Cross-References: CVE-2019-3693 Affected Products: openSUSE Backports SLE-15-SP1 An update that fixes one vulnerability is now available. Description: This update fo...

OPENSUSE-SU-2020:0156-1 Security update for mailman

This update for mailman fixes the following issues: - CVE-2019-3693: Fixed a privilege escalation during package install. Could be exploited by a local users who is members of the the mailman group. boo1154328 This update was imported from the openSUSE:Leap:15.1:Update update project...

openSUSE Security Update : mailman (openSUSE-2020-148)

This update for mailman fixes the following issues : - CVE-2019-3693: Fixed a privilege escalation during package install. Could be exploited by a local users who is members of the the mailman group. boo1154328 C Tenable Network Security, Inc. The descriptive text and package checks in this plugi...

openSUSE: Security Advisory for mailman (openSUSE-SU-2020:0148_1)

The remote host is missing an update for the Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OPENSUSE-SU-2020:0148-1 Security update for mailman

This update for mailman fixes the following issues: - CVE-2019-3693: Fixed a privilege escalation during package install. Could be exploited by a local users who is members of the the mailman group. boo1154328...

Security update for mailman (moderate)

openSUSE Security Update: Security update for mailman Announcement ID: openSUSE-SU-2020:0148-1 Rating: moderate References: 1154328 Cross-References: CVE-2019-3693 Affected Products: openSUSE Leap 15.1 An update that fixes one vulnerability is now available. Description: This update for mailman...

CVE-2019-3693

A symlink following vulnerability in the packaging of mailman in SUSE Linux Enterprise Server 11, SUSE Linux Enterprise Server 12; openSUSE Leap 15.1 allowed local attackers to escalate their privileges from user wwwrun to root. Additionally arbitrary files could be changed to group mailman. This...

CVE-2019-3693

A symlink following vulnerability in the packaging of mailman in SUSE Linux Enterprise Server 11, SUSE Linux Enterprise Server 12; openSUSE Leap 15.1 allowed local attackers to escalate their privileges from user wwwrun to root. Additionally arbitrary files could be changed to group mailman. This...

Spoofing

A symlink following vulnerability in the packaging of mailman in SUSE Linux Enterprise Server 11, SUSE Linux Enterprise Server 12; openSUSE Leap 15.1 allowed local attackers to escalate their privileges from user wwwrun to root. Additionally arbitrary files could be changed to group mailman. This...

CVE-2019-3693

CVE-2019-3693 is a local privilege-escalation flaw in the mailman packaging for SUSE SLES 11/12 and openSUSE Leap 15.1. A symlink-following vulnerability during package installation could allow a local attacker (wwwrun group) to escalate to root and potentially alter files to the mailman group. A...