Gnu Mailman
47 CVEs affecting Gnu Mailman. Latest disclosed: 2025-04-20. Critical: 0, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-44227 | High | 8.8 | 2021-12-02 | In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make… |
CVE-2016-7123 | High | 8.8 | 2016-09-02 | Cross-site request forgery (CSRF) vulnerability in the admin web interface in GNU Mailman before 2.1.15 allows remote attackers to hijack the authentication of… |
CVE-2016-6893 | High | 8.8 | 2016-09-02 | Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authenticatio… |
CVE-2021-42097 | High | 8.0 | 2021-10-21 | GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not specific to a single user account. An attacker can obtain a value wi… |
CVE-2021-43332 | Medium | 6.5 | 2021-11-12 | In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potential… |
CVE-2020-12108 | Medium | 6.5 | 2020-05-06 | /options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection. |
CVE-2018-13796 | Medium | 6.5 | 2018-07-12 | An issue was discovered in GNU Mailman before 2.1.28. A crafted URL can cause arbitrary text to be displayed on a web page from a trusted site. |
CVE-2021-34337 | Medium | 6.3 | 2023-04-15 | An issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the value of the configured… |
CVE-2021-43331 | Medium | 6.1 | 2021-11-12 | In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS. |
CVE-2020-12137 | Medium | 6.1 | 2020-04-24 | GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against lis… |
CVE-2018-5950 | Medium | 6.1 | 2018-01-23 | Cross-site scripting (XSS) vulnerability in the web UI in Mailman before 2.1.26 allows remote attackers to inject arbitrary web script or HTML via a user-optio… |
CVE-2025-43919 | Medium | 5.8 | 2025-04-20 | GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to read arbitrary files via ../ directory traversal at /mailman/private/ma… |
CVE-2025-43920 | Medium | 5.4 | 2025-04-20 | GNU Mailman 2.1.39, as bundled in cPanel (and WHM), in certain external archiver configurations, allows unauthenticated attackers to execute arbitrary OS comma… |
CVE-2018-0618 | Medium | 5.4 | 2018-07-26 | Cross-site scripting vulnerability in Mailman 2.1.26 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified v… |
CVE-2025-43921 | Medium | 5.3 | 2025-04-20 | GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to create lists via the /mailman/create endpoint. NOTE: multiple third par… |
CVE-2021-42096 | Medium | 4.3 | 2021-10-21 | GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A certain csrf_token value is derived from the admin password, and may be useful in conducting… |
CVE-2020-15011 | Medium | 4.3 | 2020-06-24 | GNU Mailman before 2.1.33 allows arbitrary content injection via the Cgi/private.py private archive login page. |
CVE-2015-2775 | | 2015-04-13 | Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot… | |
CVE-2011-5024 | | 2011-12-29 | Cross-site scripting (XSS) vulnerability in mmsearch/design in the Mailman/htdig integration patch for Mailman allows remote attackers to inject arbitrary web… | |
CVE-2011-0707 | | 2011-02-22 | Multiple cross-site scripting (XSS) vulnerabilities in Cgi/confirm.py in GNU Mailman 2.1.14 and earlier allow remote attackers to inject arbitrary web script o… |