Debian DSA-4970-1 : postorius - security update

The remote Debian 10 / 11 host has a package installed that is affected by a vulnerability as referenced in the dsa-4970 advisory. Kevin Israel discovered that Postorius, the administrative web frontend for Mailman 3, didn't validate whether a logged-in user owns the email address when...

CVE-2021-40347: Undefined Security Weakness

An issue was discovered in views/list.py in GNU Mailman Postorius before 1.3.5. An attacker logged into any account can send a crafted POST request to unsubscribe any user from a mailing list, also revealing whether that address was subscribed in the first place...

PT-2021-22074

Name of the Vulnerable Software and Affected Versions GNU-Mailman Integration WordPress plugin versions up to and including 1.0.6 Description The GNU-Mailman Integration WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the gm error parameter found in the...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress Plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists i...

PT-2021-22867 · Gnu +2 · Gnu Mailman Postorius +2

Name of the Vulnerable Software and Affected Versions: GNU Mailman Postorius versions prior to 1.3.5 Description: An issue was discovered in views/list.py in GNU Mailman Postorius. An attacker, logged into any account, can send a crafted POST request to unsubscribe any user from a mailing list,...

WordPress GNU-Mailman Integration plugin <= 1.0.6 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by p7e4 in WordPress GNU-Mailman Integration plugin versions = 1.0.6. Solution This plugin has been closed as of September 7, 2021 and is not available for download. This closure is temporary, pending a full review...

GNU-Mailman Integration <= 1.0.6 - Reflected Cross-Site Scripting

The plugin is vulnerable to Reflected Cross-Site Scripting via the gmerror parameter found in the /includes/admin/mailing-lists-page.php file which allows attackers to inject arbitrary web scripts...

GNU Mailman 访问控制错误漏洞

GNU Mailman is a free suite of software from the GNU community for managing e-mail discussions and e-mail lists. The software integrates with web projects to make it easy for users to manage email subscription accounts and provides built-in archiving, automatic forwarding processing, content...

Advisory ROSA-SA-2021-1913

Software: mailman 2.1.15 OS: Cobalt 7.9 CVE-ID: CVE-2016-6893 CVE-Crit: HIGH CVE-DESC: A cross-site request forgery CSRF vulnerability in the user parameter page in GNU Mailman 2.1.x through 2.1.23 allows remote attackers to intercept arbitrary user authentication for requests that modify a...

SUSE SLES11 Security Update : mailman (SUSE-SU-2020:14423-1)

The remote SUSE Linux SLES11 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2020:14423-1 advisory. - GNU Mailman before 2.1.33 allows arbitrary content injection via the Cgi/private.py private archive login page. CVE-2020-15011 Note that Nessus has...

Oracle Linux 8 : mailman:2.1 (ELSA-2021-1751)

The remote Oracle Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2021-1751 advisory. 3:2.1.29-11 - Fixes for CVE-2020-12108 and CVE-2020-15011 Tenable has extracted the preceding description block directly from the Oracle Linux security...

Gnu Mailman Command Injection (CVE-2020-12108)

A command injection vulnerability exists in Gnu Mailman. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

NewStart CGSL CORE 5.04 / MAIN 5.04 : mailman Multiple Vulnerabilities (NS-SA-2020-0061)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has mailman packages installed that are affected by multiple vulnerabilities: - An issue was discovered in GNU Mailman before 2.1.28. A crafted URL can cause arbitrary text to be displayed on a web page from a trusted site...

Content Injection

mailman is vulnerable to content injection. An attacker is able to inject arbitrary content in GNU Mailman...

Content Injection

GNU Mailman is vulnerable to content injection. An attacker is able to inject arbitrary content into the application via the Cgi/private.py private archive login page...

Oracle Linux 8 : mailman:2.1 (ELSA-2020-4667)

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2020-4667 advisory. - Fix for CVE-2020-12137 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not tested...

Huawei EulerOS: Security Advisory for mailman (EulerOS-SA-2020-2291)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for mailman (EulerOS-SA-2020-2256)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP5 : mailman (EulerOS-SA-2020-2291)

According to the version of the mailman package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - An issue was discovered in GNU Mailman before 2.1.28. A crafted URL can cause arbitrary text to be displayed on a web page from a trusted...

Amazon Linux 2 : mailman (ALAS-2020-1536)

The version of mailman installed on the remote host is prior to 2.1.15-30. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1536 advisory. A cross-site scripting vulnerability XSS has been discovered in mailman due to the hostname field not being properly...