PT-2016-2676

Name of the Vulnerable Software and Affected Versions GNU Mailman versions 2.1.x through 2.1.22 Description A cross-site request forgery CSRF issue in the user options page allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, potentially...

CVE-2016-7123

Cross-site request forgery CSRF vulnerability in the admin web interface in GNU Mailman before 2.1.15 allows remote attackers to hijack the authentication of administrators...

CVE-2016-6893

Cross-site request forgery CSRF vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that modify an option, as demonstrated by gaining access to the credentials of a victim's account...

PT-2016-2674

Name of the Vulnerable Software and Affected Versions GNU Mailman versions prior to 2.1.15 Description The issue is related to a cross-site request forgery CSRF vulnerability in the admin web interface. This vulnerability allows remote attackers to hijack the authentication of administrators...

CVE-2015-2775

CVE-2015-2775 is a directory traversal vulnerability in GNU Mailman up to version 2.1.19, exploitable via a leading .. in a list name when not using a static alias. The underlying issue is improper validation of list-name input, enabling remote attackers to execute arbitrary files. Impact is remo...

CVE-2015-2775

Removed by vendor...

CVE-2015-2775: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. dot dot in a list name...

PT-2015-5888

Name of the Vulnerable Software and Affected Versions GNU Mailman versions prior to 2.1.20 Description The issue allows remote attackers to execute arbitrary files via a .. dot dot in a list name, when not using a static alias. Recommendations For GNU Mailman versions prior to 2.1.20, update to...

UBUNTU-CVE-2015-2775

Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. dot dot in a list name...

GNU Mailman 2.0.x Subscribe Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5298/info GNU Mailman is prone to a cross-site scripting vulnerability. Arbitrary HTML and script code are not sanitized from the URI parameters of mailing list subscribe scripts. An attacker may exploit this issue by...

GNU Mailman 2.1 'email' Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/6677/info A vulnerability has been discovered in GNU Mailman. It has been reported that Mailman is prone to cross site scripting attacks. This is due to insufficient santization of URI parameters. As a result, attackers m...

GNU Mailman 2.0.x Admin Login Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/4825/info GNU Mailman is prone to a cross-site scripting vulnerability. An attacker may construct a malicious link to the administrative login page, which contains arbitrary HTML and script code. A user visiting the link...

GNU Mailman 2.0.x Admin Login Variant Cross-Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5299/info GNU Mailman is prone to a cross-site scripting vulnerability. An attacker may construct a malicious link to the administrative login page, which contains arbitrary HTML and script code. A user visiting the link...

GNU Mailman 2.1 Error Page Cross Site Scripting Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/6678/info A vulnerability has been discovered in GNU Mailman. The issue occurs to insufficient sanitization of user-supplied data which is output when generating error pages. As a result, attackers may embed malicious...

FreeBSD : mailman -- XSS vulnerability (64691c49-4b22-11e0-a226-00e0815b8da8)

CVE reports : Multiple cross-site scripting XSS vulnerabilities in Cgi/confirm.py in GNU Mailman 2.1.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 full name or 2 username field in a confirmation message. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Mailman: Three XSS flaws due improper escaping of the full name of the member

Multiple cross-site scripting XSS vulnerabilities in Cgi/confirm.py in GNU Mailman 2.1.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 full name or 2 username field in a confirmation message...

Mandriva Update for mailman MDVSA-2011:036 (mailman)

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Mandriva Linux Security Advisory : mailman (MDVSA-2011:036)

A vulnerability has been found and corrected in mailman : Multiple cross-site scripting XSS vulnerabilities in Cgi/confirm.py in GNU Mailman 2.1.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 full name or 2 username field in a confirmation message...

CVE-2011-0707

Multiple cross-site scripting XSS vulnerabilities in Cgi/confirm.py in GNU Mailman 2.1.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 full name or 2 username field in a confirmation message...

CVE-2011-0707

CVE-2011-0707 is a cross-site scripting (XSS) vulnerability in GNU Mailman 2.1.14 and earlier, specifically in Cgi/confirm.py, where remote attackers can inject arbitrary script or HTML via the full name or username in a confirmation message. Multiple Nessus/MiracleLinux open-source advisories re...