RHEL 8 : mailman:2.1 (RHSA-2021:4838)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:4838 advisory. Mailman is a program used to help manage e-mail discussion lists. Security Fixes: mailman: CSRF token bypass allows to perform CSRF attacks...

VulnCheck KEV: CVE-2021-39317

A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the pluginofflineinstaller AJAX action due to a missing capability check in the pluginofflineinstallercallback function found in the /demo-functions.php file or /welcome.ph...

Hackers Targeting Biomanufacturing Facilities With Tardigrade Malware

An advanced persistent threat APT has been linked to cyberattacks on two biomanufacturing companies that occurred this year with the help of a custom malware loader called "Tardigrade." That's according to an advisory published by Bioeconomy Information Sharing and Analysis Center BIO-ISAC this...

mailman: CSRF token derived from admin password allows offline brute-force attack

Sensitive information is exposed to unprivileged users in mailman. The hash of the list admin password is used to derive the CSRF Cross-site Request Forgery token, which is exposed to unprivileged members of a list. Malicious members may use the CSRF token to perform an offline brute-force attack...

mailman: CSRF token derived from admin password allows offline brute-force attack

Sensitive information is exposed to unprivileged users in mailman. The hash of the list admin password is used to derive the CSRF Cross-site Request Forgery token, which is exposed to unprivileged members of a list. Malicious members may use the CSRF token to perform an offline brute-force attack...

mailman: CSRF token derived from admin password allows offline brute-force attack

Sensitive information is exposed to unprivileged users in mailman. The hash of the list admin password is used to derive the CSRF Cross-site Request Forgery token, which is exposed to unprivileged members of a list. Malicious members may use the CSRF token to perform an offline brute-force attack...

Important: Red Hat Security Advisory: mailman:2.1 security update

An update for the mailman:2.1 module is now available for Red Hat Enterprise Linux 8.1 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, i...

Important: Red Hat Security Advisory: mailman:2.1 security update

An update for the mailman:2.1 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

PT-2021-30594

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.10 through v5.14.15 Description A memory leak issue was discovered, caused by missing cgroup bpf offline. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions...

PT-2021-30663

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.10 through v5.15 Description A memory leak issue was discovered, caused by missing cgroup bpf offline. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions v5.10...

PT-2021-26599

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.10 through v5.14.15 Description A memory leak issue was discovered, caused by missing cgroup bpf offline. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel versions...

PT-2021-26534

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.77 Description A memory leak issue was discovered, potentially affecting the security of the system. The issue is related to a missing cgroup bpf offline call. The actual impact and attack plausibility have...

PT-2021-30529

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.10.77 Description A memory leak issue was discovered, potentially affecting the security of the system. The issue is related to a missing cgroup bpf offline and was introduced in version v5.10. The actual impa...

Security fix for the ALT Linux 9 package mailman version 5:2.1.36-alt1

Nov. 13, 2021 Konstantin Lepikhov 5:2.1.36-alt1 - Updated to 2.1.36. - Security fixes: + CVE-2021-43331: A potential XSS attack via the user options. + CVE-2021-43332: A potential for for a list moderator to carry out an off-line brute force attack to obtain the list admin password...

CVE-2021-43332

In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potentially be cracked by a moderator via an offline brute-force attack...

CVE-2021-43332

In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potentially be cracked by a moderator via an offline brute-force attack...

CVE-2021-43332

In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potentially be cracked by a moderator via an offline brute-force attack...

CVE-2021-43332

In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potentially be cracked by a moderator via an offline brute-force attack...

UBUNTU-CVE-2021-43332

In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potentially be cracked by a moderator via an offline brute-force attack...

CVE-2021-43332

In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potentially be cracked by a moderator via an offline brute-force attack...