CVE-2018-0618

The provided documents confirm CVE-2018-0618 is a cross-site scripting vulnerability in Mailman prior to or including 2.1.26, caused by unvalidated input in the host_name field, enabling a malicious listowner to inject scripts on the listinfo page. Affected product: Mailman (versions up to 2.1.26...

CVE-2025-43921

GNU Mailman 2.1.39 (bundled with cPanel/WHM) is vulnerable to unauthenticated creation of mailing lists via the /mailman/create endpoint. The root cause is missing access controls in the create CGI script, enabling arbitrary list creation by anyone. Impact described across sources includes potent...

CVE-2005-0202

CVE-2005-0202 concerns a directory-traversal in Mailman 2.1.5 and earlier, arising from an insufficient cleanse of "../" and "../" sequences in the true_path function of private.py. The flaw allows remote attackers to read arbitrary files by crafting URLs like ".../....///". The issue is caused b...

CVE-2005-3573

CVE-2005-3573 affects Mailman 2.1.4–2.1.6 with two DoS vectors: (1) UTF-8 handling in attachment filenames can crash the server, and (2) malformed date handling can crash the Mailman service. Connected advisories (RHSA-2006:0204, Debian DSA-955-1, CentOS/CESA-2006:0204) document these issues and ...

CVE-2006-2941

Mailman vulnerability CVE-2006-2941 affects Mailman prior to 2.1.9rc1, involving how RFC 2231 formatted headers are processed. Exploitation can lead to a denial of service on mailing lists. Connected advisories (Red Hat RHSA-2006:0600, Ubuntu USN-345-1, SuSE/SLES9 updates, Gentoo GLSA 200609-12, ...

CVE-2004-0412

Mailman prior to version 2.1.5 is affected by CVE-2004-0412. A crafted email request to the Mailman server can allow a remote attacker to obtain user passwords, per the description in multiple sources (Mailman password disclosure). The vulnerability stems from how password data could be disclosed...

CVE-2006-0052

CVE-2006-0052 affects Mailman 2.1.5 and earlier when used with Python’s email library 2.5. A malformed MIME multipart message (a single part with two blank lines between the first and end boundaries) can cause a denial of service by blocking mailing-list delivery. Root cause involves how Mailman ...

CVE-2003-0991

CVE-2003-0991 concerns the Mailman mail command handler. Multiple connected sources confirm this is a vulnerability in Mailman prior to 2.0.14 where certain malformed email commands could crash the mailman process, producing a denial-of-service condition. Debian advisories (DSA-436-1/DSA-436-2) a...

CVE-2005-0080

CVE-2005-0080 affects Mailman 2.1.5 via the 55_options_traceback.dpatch patch used in Ubuntu 4.10. The patch causes the error message to differ based on whether an email address is subscribed to a private list, enabling remote attackers to determine list membership for a given address. The availa...

CVE-2004-0182

CVE-2004-0182 affects Mailman before 2.0.13. A flaw allows remote attackers to trigger a denial of service (crash) by sending an email message with an empty subject field. Multiple connected sources corroborate this issue and tie it to a DoS in Mailman. Remediation in the public advisories is to ...

CVE-2001-0884

CVE-2001-0884 is a cross-site scripting vulnerability in the Mailman email archiver prior to version 2.08. The issue allows attackers to obtain sensitive information or authentication credentials via a malicious link that is accessed by other web users. The provided documents do not include remed...