312 matches found
CVE-2025-43921
CVE-2025-43921: GNU Mailman 2.1.39 cPanel/WHM バンドル版 における認証なしメーリングリスト作成 発見者: Firudin Davudzada & Musazada Aydan 開示日: 2025年4月 CVE ID: CVE-2025-43921 深刻度: 5.3 Medium CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N 攻撃タイプ: リモート 影響を受けるソフトウェア: GNU Mailman 2.1.39 cPanel/WHM にバンドル 概要 GNU Mailman 2.1.39（cPane...
CVE-2025-43919-POC
🚨 CVE-2025-43919: GNU Mailman 2.1.39 cPanel/WHM におけるディレクトリトラバーサル cPanel/WHM にバンドルされている GNU Mailman 2.1.39 で新たな脆弱性が発見されました。ディレクトリトラバーサルの欠陥により、認証されていないリモート攻撃者がサーバー上の任意のファイルを読み取ることが可能です。 📌 脆弱性概要: 種類 : ディレクトリトラバーサル 認証不要 コンポーネント : private.py CGI スクリプト 影響を受けるエンドポイント : /mailman/private/mailman 影響 :...
CVE-2025-43920
CVE-2025-43920: GNU Mailman 2.1.39（cPanel/WHMバンドル）におけるメール件名を介したコマンドインジェクション 発見者: Firudin Davudzada & Musazada Aydan 開示日: 2025年4月 CVE ID: CVE-2025-43920 深刻度: 5.4 中程度 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N 攻撃タイプ: リモート 影響を受けるソフトウェア: GNU Mailman 2.1.39（cPanel/WHMにバンドル） 概要 GNU Mailman...
CVE-2025-43919
CVE-2025-43919: GNU Mailman 2.1.39（cPanel/WHMバンドル）におけるディレクトリトラバーサル 発見者: Firudin Davudzada & Musazada Aydan 開示日: 2025年4月 CVE ID: CVE-2025-43919 深刻度: 5.8 Medium CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N 攻撃タイプ: リモート 影響を受けるソフトウェア: GNU Mailman 2.1.39（cPanel/WHMとバンドル） 概要 GNU Mailman...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093164)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093164 advisory. /options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection. Tenable has extracted the preceding description block directly from the Unity Linux...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093203)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093203 advisory. In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request using that token to set a new admin password or make other...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093171)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093171 advisory. GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093193)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093193 advisory. In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS. Tenable has extracted the preceding...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093157)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093157 advisory. GNU Mailman before 2.1.33 allows arbitrary content injection via the Cgi/private.py private archive login page. Tenable has extracted the preceding description block...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093198)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093198 advisory. In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potentially be...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093169)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093169 advisory. GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A certain csrftoken value is derived from the admin password, and may be useful in conducting a...
Moderate severity vulnerability that affects mailman
An issue was discovered in GNU Mailman before 2.1.28. A crafted URL can cause arbitrary text to be displayed on a web page from a trusted site...
PYSEC-2026-661 Moderate severity vulnerability that affects mailman
An issue was discovered in GNU Mailman before 2.1.28. A crafted URL can cause arbitrary text to be displayed on a web page from a trusted site...
[SECURITY] Fedora 44 Update: python-postorius-1.3.13-1.fc44
The Postorius Django app provides a web user interface to access GNU Mailman...
[SECURITY] Fedora 43 Update: python-postorius-1.3.13-1.fc43
The Postorius Django app provides a web user interface to access GNU Mailman...
Postorius 跨站脚本漏洞
Postorius is an open-source web application developed by GNU Mailman for managing email lists. Versions of Postorius 1.3.13 and earlier contained a cross-site scripting vulnerability. This vulnerability stemmed from the lack of escaping of HTML in the message titles when these titles were rendere...
The vulnerability of the GNU Mailman email distribution management package, related to authentication mechanism flaws, allows attackers to create arbitrary files.
The vulnerability of the GNU Mailman email distribution management package is related to deficiencies in the authentication mechanism. Exploiting this vulnerability allows a malicious actor to create arbitrary files remotely...
EUVD-2010-3090
Malware in sbrugna...