[SECURITY] [DLA 3049-1] mailman security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3049-1 [email protected] https://www.debian.org/lts/security/ Sylvain Beucler June 09, 2022 https://wiki.debian.org/LTS -...

Debian DLA-3049-1 : mailman - LTS security update

The remote Debian 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3049 advisory. - In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS. CVE-2021-43331 - In GNU Mailman...

DLA-3049-1 mailman - security update

Bulletin has no description...

SUSE SLES12 Security Update : mailman (SUSE-SU-2022:1886-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:1886-1 advisory. - GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A certain csrftoken value is derived from the admin password, an...

SUSE: Security Advisory (SUSE-SU-2022:1886-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2022:1886-1 Security update for mailman

This update for mailman fixes the following issues: - CVE-2021-44227: Preventing list moderator or list member accessing the admin UI bsc1193316. - CVE-2021-43332: Preventing list moderator from cracking the list admin password encrypted in a CSRF token bsc1192741. - CVE-2021-43331: Fixed XSS in...

EulerOS 2.0 SP3 : mailman (EulerOS-SA-2022-1745)

According to the versions of the mailman package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS. CVE-2021-43331 - I...

Huawei EulerOS: Security Advisory for mailman (EulerOS-SA-2022-1745)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GHSA-V83X-78Q3-GR2J GNU Mailman Postorius Access Control Issues

An issue was discovered in views/list.py in GNU Mailman Postorius before 1.3.5. An attacker logged into any account can send a crafted POST request to unsubscribe any user from a mailing list, also revealing whether that address was subscribed in the first place...

GNU Mailman Postorius Access Control Issues

An issue was discovered in views/list.py in GNU Mailman Postorius before 1.3.5. An attacker logged into any account can send a crafted POST request to unsubscribe any user from a mailing list, also revealing whether that address was subscribed in the first place...

GHSA-RH6C-JH4C-9FG3 mailman Cross-site scripting (XSS) vulnerability

Cross-site scripting XSS vulnerability in the driver script in mailman before 2.1.5 allows remote attackers to inject arbitrary web script or HTML via a URL, which is not properly escaped in the resulting error page...

mailman Cross-site scripting (XSS) vulnerability

Cross-site scripting XSS vulnerability in the driver script in mailman before 2.1.5 allows remote attackers to inject arbitrary web script or HTML via a URL, which is not properly escaped in the resulting error page...

GHSA-HJ4H-VQPQ-95WG Mailman Sensitive Information Disclosure

Mailman before 2.1.5 allows remote attackers to obtain user passwords via a crafted email request to the Mailman server...

Mailman Sensitive Information Disclosure

Mailman before 2.1.5 allows remote attackers to obtain user passwords via a crafted email request to the Mailman server...

GHSA-82RM-28Q9-435P Mailman Cross-site scripting (XSS) vulnerability

Cross-site scripting XSS vulnerability in options.py for Mailman 2.1 allows remote attackers to inject script or HTML into web pages via the 1 email or 2 language parameters...

Mailman Cross-site scripting (XSS) vulnerability

Cross-site scripting XSS vulnerability in options.py for Mailman 2.1 allows remote attackers to inject script or HTML into web pages via the 1 email or 2 language parameters...

Huawei EulerOS: Security Advisory for mailman (EulerOS-SA-2022-1277)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP5 : mailman (EulerOS-SA-2022-1277)

According to the versions of the mailman package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Cross-site request forgery CSRF vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the...

EulerOS 2.0 SP3 : mailman (EulerOS-SA-2022-1177)

According to the versions of the mailman package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Cross-site request forgery CSRF vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the...

AlmaLinux 8 : mailman:2.1 (ALSA-2021:4826)

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2021:4826 advisory. mailman: CSRF token bypass allows to perform CSRF attacks and account takeover CVE-2021-42097 mailman: CSRF token derived from admin password allows offli...