1505 matches found
USN-78-1: Mailman vulnerability
An path traversal vulnerability has been discovered in the "private" module of Mailman. A flawed path sanitation algorithm allowed the construction of URLS to arbitrary files readable by Mailman. This allowed a remote attacker to retrieve configuration and password databases, private list archive...
Mailman mailing lists manager directory traversal
It's possible to bypass filtering with URL like .../..../// and retrieve any file from from the system...
Mailman private.py true_path Function Traversal Arbitrary File Access
According to its version number, the remote installation of Mailman reportedly is affected by a directory traversal vulnerability in 'Cgi/private.py'. The flaw comes into play only on web servers that don't strip extraneous slashes from URLs, such as Apache 1.3.x, and allows a list subscriber,...
GNU Mailman < 2.1.6 Directory Traversal Arbitrary File Access
Binary data 2607.prm...
[Full-Disclosure] Administrivia: List Compromised due to Mailman Vulnerability
Hi On 7th February 2005 I was notified of a number of potentially - compromised Full-Disclosure subscriber accounts. Following an investigation it appears that the Mailman configuration database was obtained from lists.netsys.com on 2nd January 2005 using a remote directory traversal exploit for ...
Mailman: Directory traversal vulnerability
Background Mailman is a Python-based mailing list server with an extensive web interface. Description Mailman contains an error in private.py which fails to properly sanitize input paths. Impact An attacker could exploit this flaw to obtain arbitrary files on the web server. Workaround There is n...
DSA-674-1 mailman - cross-site scripting, directory traversal
Bulletin has no description...
Mailman Detection
The remote host is running Mailman, an open source, Python-based mailing list management package. This script was written by George A. Theall, . GPLv2 include"compat.inc"; if description scriptid16338; scriptversion"1.17"; scriptsetattributeattribute:"pluginmodificationdate", value:"2022/06/01";...
Debian DSA-674-3 : mailman - XSS, directory traversal
Due to an incompatibility between Python 1.5 and 2.1 the last mailman update did not run with Python 1.5 anymore. This problem is corrected with this update. This advisory only updates the packages updated with DSA 674-2. The version in unstable is not affected since it is not supposed to work wi...
RHEL 2.1 / 3 : mailman (RHSA-2005:136)
Updated mailman packages that correct a mailman security issue are now available. The mailman package is software to help manage email discussion lists. A flaw in the truepath function of Mailman was discovered. A remote attacker who is a member of a private mailman list could use a carefully...
CVE-2005-0202
CVE-2005-0202 concerns a directory-traversal in Mailman 2.1.5 and earlier, arising from an insufficient cleanse of "../" and "../" sequences in the true_path function of private.py. The flaw allows remote attackers to read arbitrary files by crafting URLs like ".../....///". The issue is caused b...
CVE-2005-0202
Removed by vendor...
CVE-2005-0202
Directory traversal vulnerability in the truepath function in private.py for Mailman 2.1.5 and earlier allows remote attackers to read arbitrary files via ".../....///" sequences, which are not properly cleansed by regular expressions that are intended to remove "../" and "./" sequences...
Mandrake Linux Security Advisory : mailman (MDKSA-2005:015)
Florian Weimer discovered a vulnerability in Mailman, which can be exploited by malicious people to conduct cross-site scripting attacks. Input is not properly sanitised by 'scripts/driver' when returning error pages. This can be exploited to execute arbitrary HTML or script code in a user's...
Mailman: Cross-site scripting vulnerability
Background Mailman is a Python-based mailing list server with an extensive web interface. Description Florian Weimer has discovered a cross-site scripting vulnerability in the error messages that are produced by Mailman. Impact By enticing a user to visiting a specially-crafted URL, an attacker c...
CVE-2004-1143
The CVE-2004-1143 issue concerns Mailman prior to version 2.1.5, where auto-generated passwords are limited to about 5 million, enabling remote attackers to perform brute-force guessing of subscriber credentials. Remediation: upgrade to Mailman 2.1.5 or newer (as detailed in related advisories). ...
CVE-2004-1177
Cross-site scripting XSS vulnerability in the driver script in mailman before 2.1.5 allows remote attackers to inject arbitrary web script or HTML via a URL, which is not properly escaped in the resulting error page...
CVE-2005-0080
The 55optionstraceback.dpatch patch for mailman 2.1.5 in Ubuntu 4.10 displays a different error message depending on whether the e-mail address is subscribed to a private list, which allows remote attackers to determine the list membership for a given e-mail address...