Filtered by vendor Gnu Subscriptions
Filtered by product Mailman Subscriptions
Total 47 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2004-1177 2 Gnu, Redhat 2 Mailman, Enterprise Linux 2025-04-03 N/A
Cross-site scripting (XSS) vulnerability in the driver script in mailman before 2.1.5 allows remote attackers to inject arbitrary web script or HTML via a URL, which is not properly escaped in the resulting error page.
CVE-2005-4153 2 Gnu, Redhat 2 Mailman, Enterprise Linux 2025-04-03 N/A
Mailman 2.1.4 through 2.1.6 allows remote attackers to cause a denial of service via a message that causes the server to "fail with an Overflow on bad date data in a processed message," a different vulnerability than CVE-2005-3573.
CVE-2000-0701 3 Conectiva, Gnu, Redhat 3 Linux, Mailman, Linux 2025-04-03 N/A
The wrapper program in mailman 2.0beta3 and 2.0beta4 does not properly cleanse untrusted format strings, which allows local users to gain privileges.
CVE-2003-0038 1 Gnu 1 Mailman 2025-04-03 N/A
Cross-site scripting (XSS) vulnerability in options.py for Mailman 2.1 allows remote attackers to inject script or HTML into web pages via the (1) email or (2) language parameters.
CVE-2001-1132 1 Gnu 1 Mailman 2025-04-03 N/A
Mailman 2.0.x before 2.0.6 allows remote attackers to gain access to list administrative pages when there is an empty site or list password, which is not properly handled during the call to the crypt function during authentication.
CVE-2006-1712 1 Gnu 1 Mailman 2025-04-03 N/A
Cross-site scripting (XSS) vulnerability in the private archive script (private.py) in GNU Mailman 2.1.7 allows remote attackers to inject arbitrary web script or HTML via the action argument.
CVE-2005-0080 2 Gnu, Ubuntu 2 Mailman, Ubuntu Linux 2025-04-03 N/A
The 55_options_traceback.dpatch patch for mailman 2.1.5 in Ubuntu 4.10 displays a different error message depending on whether the e-mail address is subscribed to a private list, which allows remote attackers to determine the list membership for a given e-mail address.
CVE-2001-0884 2 Gnu, Redhat 4 Mailman, Linux, Powertools and 1 more 2025-04-03 N/A
Cross-site scripting vulnerability in Mailman email archiver before 2.08 allows attackers to obtain sensitive information or authentication credentials via a malicious link that is accessed by other web users.
CVE-2001-0290 1 Gnu 1 Mailman 2025-04-03 N/A
Vulnerability in Mailman 2.0.1 and earlier allows list administrators to obtain user passwords.
CVE-2000-0861 1 Gnu 1 Mailman 2025-04-03 N/A
Mailman 1.1 allows list administrators to execute arbitrary commands via shell metacharacters in the %(listname) macro expansion.
CVE-2006-4624 2 Gnu, Redhat 2 Mailman, Enterprise Linux 2025-04-03 N/A
CRLF injection vulnerability in Utils.py in Mailman before 2.1.9rc1 allows remote attackers to spoof messages in the error log and possibly trick the administrator into visiting malicious URLs via CRLF sequences in the URI.
CVE-2006-2191 1 Gnu 1 Mailman 2025-04-03 N/A
Format string vulnerability in Mailman before 2.1.9 allows attackers to execute arbitrary code via unspecified vectors. NOTE: the vendor has disputed this vulnerability, stating that it is "unexploitable.
CVE-2002-0389 2 Gnu, Redhat 2 Mailman, Enterprise Linux 2025-04-03 N/A
Pipermail in Mailman stores private mail messages with predictable filenames in a world-executable directory, which allows local users to read private mailing list archives.
CVE-2004-1143 1 Gnu 1 Mailman 2025-04-03 N/A
The password generation in mailman before 2.1.5 generates only 5 million unique passwords, which makes it easier for remote attackers to guess passwords via a brute force attack.
CVE-2006-0052 2 Gnu, Redhat 2 Mailman, Enterprise Linux 2025-04-03 N/A
The attachment scrubber (Scrubber.py) in Mailman 2.1.5 and earlier, when using Python's library email module 2.5, allows remote attackers to cause a denial of service (mailing list delivery failure) via a multipart MIME message with a single part that has two blank lines between the first boundary and the end boundary.
CVE-2021-34337 1 Gnu 1 Mailman 2025-02-06 6.3 Medium
An issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the value of the configured REST API password and then make arbitrary REST API calls. The REST API is bound to localhost by default, limiting the ability for attackers to exploit this, but can optionally be made to listen on other interfaces.
CVE-2021-44227 3 Debian, Gnu, Redhat 5 Debian Linux, Mailman, Enterprise Linux and 2 more 2024-11-21 8.8 High
In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes.
CVE-2021-43332 2 Debian, Gnu 2 Debian Linux, Mailman 2024-11-21 6.5 Medium
In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potentially be cracked by a moderator via an offline brute-force attack.
CVE-2021-43331 2 Debian, Gnu 2 Debian Linux, Mailman 2024-11-21 6.1 Medium
In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS.
CVE-2021-42097 3 Debian, Gnu, Redhat 4 Debian Linux, Mailman, Enterprise Linux and 1 more 2024-11-21 8.0 High
GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not specific to a single user account. An attacker can obtain a value within the context of an unprivileged user account, and then use that value in a CSRF attack against an admin (e.g., for account takeover).