CVE-2000-0758

The CVE-2000-0758 entry affects Lyris List Manager 3 and 4; the web interface allows subscribers to obtain administrative access by modifying the hidden form field list_admin. Root cause is insufficient server-side validation of this hidden field, enabling privilege escalation from a subscriber. ...

CVE-2007-6319

CVE-2007-6319 affects Lyris ListManager 8.x (before 8.95d), 9.2 (before 9.2c), and 9.3 (before 9.3b). Multiple issues allow remote attackers to (1) gain list administrator privileges or (2) access arbitrary mailing lists by modifying client-side information, and (3) remote authenticated administr...

CVE-2014-5188

The CVE-2014-5188 issue affects Lyris ListManager (LM) 8.95a, in the doemailpassword.tml page, where the EmailAddr parameter is unsafely processed, enabling cross-site scripting (XSS). Exploitation is via crafted input submitted to the EmailAddr field (e.g., POST to doemailpassword.tml) which can...

CVE-2006-4546

CVE-2006-4546 affects Lyris ListManager 8.95. The vulnerability allows remote authenticated users who have administrative privileges for at least one list to add new administrators to any list by modifying the MEMBERS_.List_ parameter. The underlying cause is parameter manipulation that bypasses ...

CVE-2005-4143

CVE-2005-4143 affects Lyris ListManager versions 5.0 through 8.9a. The vulnerability is a SQL injection that allows a remote attacker to execute arbitrary SQL commands via SQL code appended after a numeric argument in a “/read/attachment” URL. Documented impact indicators in the sources show part...

CVE-2005-4144

CVE-2005-4144 affects Lyris ListManager 5.0–8.9a. The vulnerability arises from improper handling of whitespace in the orderby parameter, allowing remote attackers to modify SQL queries by injecting ORDER BY clauses (e.g., via newlines or 0xFF characters). Documents consistently identify this as ...

CVE-2008-2923

The CVE-2008-2923 entry documents a Cross-site scripting (XSS) vulnerability in Lyris ListManager (read/search/results) affecting versions 8.8, 8.95, and 9.3d. The underlying issue is failure to sanitize the user-provided words parameter, allowing remote attackers to inject arbitrary HTML/JavaScr...

CVE-2006-4547

CVE-2006-4547 affects Lyris ListManager 8.95. The vulnerability arises when an authenticated remote user adds a new user with a name containing a single quote, which can cause the underlying SQL query to be exposed or manipulated, indicating an SQL injection or error-driven information disclosure...