MA
Product
Mailman
47
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 6Medium 11Low 0
Watch
Add Mailman to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-44227 | 8.8 | Dec 2 | In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes Affected: before 2.1.38 |
| CVE-2016-7123 | 8.8 | Sep 2 | Cross-site request forgery (CSRF) vulnerability in the admin web interface in GNU Mailman before 2.1.15 allows remote attackers to hijack the authentication of administrators Affected: through 2.1.14 |
| CVE-2016-6893 | 8.8 | Sep 2 | Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users… Affected: 2.1; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1.5; +34 more |
| CVE-2025-43920 | 8.1 | Apr 20 | GNU Mailman 2.1.39, as bundled in cPanel (and WHM), in certain external archiver configurations, allows unauthenticated attackers to execute arbitrary OS commands via shell… Affected: 2.1.1 through 2.1.39 |
| CVE-2021-42097 | 8.0 | Oct 21 | GNU Mailman before 2.1.35 may allow remote Privilege Escalation Affected: before 2.1.35 |
| CVE-2025-43919 | 7.5 | Apr 20 | GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to read arbitrary files via ../ directory traversal at /mailman/private/mailman (aka the… Affected: 2.1.1 through 2.1.39 |
| CVE-2021-43332 | 6.5 | Nov 12 | In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password Affected: before 2.1.36 |
| CVE-2020-12108 | 6.5 | May 6 | /options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection Affected: before 2.1.31 |
| CVE-2018-13796 | 6.5 | Jul 12 | An issue was discovered in GNU Mailman before 2.1.28 Affected: before 2.1.28 |
| CVE-2021-34337 | 6.3 | Apr 15 | An issue was discovered in Mailman Core before 3.3.5 Affected: before 3.3.5 |
| CVE-2021-43331 | 6.1 | Nov 12 | In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS Affected: before 2.1.36 |
| CVE-2020-12137 | 6.1 | Apr 24 | GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts Affected: 2.0 before 2.1.30 |
| CVE-2018-5950 | 6.1 | Jan 23 | Cross-site scripting (XSS) vulnerability in the web UI in Mailman before 2.1.26 allows remote attackers to inject arbitrary web script or HTML via a user-options URL Affected: before 2.1.26 |
| CVE-2018-0618 | 5.4 | Jul 26 | Cross-site scripting vulnerability in Mailman 2.1.26 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors Affected: through 2.1.26 |
| CVE-2025-43921 | 5.3 | Apr 20 | GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to create lists via the /mailman/create endpoint Affected: 2.1.1 through 2.1.39 |
| CVE-2021-42096 | 4.3 | Oct 21 | GNU Mailman before 2.1.35 may allow remote Privilege Escalation Affected: before 2.1.35 |
| CVE-2020-15011 | 4.3 | Jun 24 | GNU Mailman before 2.1.33 allows arbitrary content injection via the Cgi/private.py private archive login page Affected: before 2.1.33 |
| CVE-2015-2775 | – | Apr 13 | Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a Affected: through 2.1.19 |
| CVE-2011-5024 | – | Dec 29 | Cross-site scripting (XSS) vulnerability in mmsearch/design in the Mailman/htdig integration patch for Mailman allows remote attackers to inject arbitrary web script or HTML via… Affected: 2.0.13; 2.1; 2.1.1; 2.1.2; 2.1.3; 2.1.4; +7 more |
| CVE-2011-0707 | – | Feb 22 | Multiple cross-site scripting (XSS) vulnerabilities in Cgi/confirm.py in GNU Mailman 2.1.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1)… Affected: through 2.1.14; 1.0; 1.1; 2.0; 2.0; 2.0; +34 more |
| CVE-2010-3089 | – | Sep 15 | Multiple cross-site scripting (XSS) vulnerabilities in GNU Mailman before 2.1.14rc1 allow remote authenticated users to inject arbitrary web script or HTML via vectors involving… Affected: through 2.1.13; 2.1; 2.1; 2.1; 2.1; 2.1.1; +14 more |
| CVE-2006-2191 | – | Sep 19 | Format string vulnerability in Mailman before 2.1.9 allows attackers to execute arbitrary code via unspecified vectors Affected: through 2.1.8 |
| CVE-2006-4624 | – | Sep 7 | CRLF injection vulnerability in Utils.py in Mailman before 2.1.9rc1 allows remote attackers to spoof messages in the error log and possibly trick the administrator into visiting… Affected: through 2.1.8 |
| CVE-2006-2941 | – | Sep 6 | Mailman before 2.1.9rc1 allows remote attackers to cause a denial of service via unspecified vectors involving "standards-breaking RFC 2231 formatted headers" Affected: 2.1; 2.1.1; 2.1.1; 2.1.2; 2.1.3; 2.1.4; +6 more |
| CVE-2006-3636 | – | Sep 6 | Multiple cross-site scripting (XSS) vulnerabilities in Mailman before 2.1.9rc1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: 2.1; 2.1.1; 2.1.1; 2.1.2; 2.1.3; 2.1.4; +6 more |
| CVE-2006-1712 | – | Apr 11 | Cross-site scripting (XSS) vulnerability in the private archive script (private.py) in GNU Mailman 2.1.7 allows remote attackers to inject arbitrary web script or HTML via the… Affected: 2.1.7 |
| CVE-2006-0052 | – | Mar 31 | The attachment scrubber (Scrubber.py) in Mailman 2.1.5 and earlier, when using Python's library email module 2.5, allows remote attackers to cause a denial of service (mailing… Affected: 1.0; 1.1; 2.0; 2.0; 2.0; 2.0; +21 more |
| CVE-2005-4153 | – | Dec 11 | Mailman 2.1.4 through 2.1.6 allows remote attackers to cause a denial of service via a message that causes the server to "fail with an Overflow on bad date data in a processed… Affected: 2.1.4; 2.1.5; 2.1.6 |
| CVE-2005-3573 | – | Nov 16 | Scrubber.py in Mailman 2.1.5-8 does not properly handle UTF8 character encodings in filenames of e-mail attachments, which allows remote attackers to cause a denial of service… Affected: 2.0; 2.0; 2.0; 2.0.1; 2.0.2; 2.0.3; +18 more |
| CVE-2005-0080 | – | May 2 | The 55_options_traceback.dpatch patch for mailman 2.1.5 in Ubuntu 4.10 displays a different error message depending on whether the e-mail address is subscribed to a private list,… Affected: 2.1.5 |
| CVE-2005-0202 | – | May 2 | Directory traversal vulnerability in the true_path function in private.py for Mailman 2.1.5 and earlier allows remote attackers to read arbitrary files via ".../....///"… Affected: 2.1; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1.5; +1 more |
| CVE-2004-1177 | – | Jan 10 | Cross-site scripting (XSS) vulnerability in the driver script in mailman before 2.1.5 allows remote attackers to inject arbitrary web script or HTML via a URL, which is not… Affected: 1.0; 1.1; 2.0; 2.0; 2.0; 2.0; +19 more |
| CVE-2004-1143 | – | Dec 31 | The password generation in mailman before 2.1.5 generates only 5 million unique passwords, which makes it easier for remote attackers to guess passwords via a brute force attack Affected: 1.0; 1.1; 2.0; 2.0; 2.0; 2.0; +19 more |
| CVE-2004-0412 | – | Aug 18 | Mailman before 2.1.5 allows remote attackers to obtain user passwords via a crafted email request to the Mailman server Affected: 2.1; 2.1.1; 2.1.2; 2.1.3; 2.1.4; 2.1b1 |
| CVE-2004-0182 | – | Jun 1 | Mailman before 2.0.13 allows remote attackers to cause a denial of service (crash) via an email message with an empty subject field Affected: through 2.0.12 |
| CVE-2003-0991 | – | Mar 3 | Unknown vulnerability in the mail command handler in Mailman before 2.0.14 allows remote attackers to cause a denial of service (crash) via malformed e-mail commands Affected: 1.0; 1.1; 2.0; 2.0; 2.0; 2.0; +14 more |
| CVE-2003-0992 | – | Feb 17 | Cross-site scripting (XSS) vulnerability in the create CGI script for Mailman before 2.1.3 allows remote attackers to steal cookies of other users Affected: through 2.1.3 |
| CVE-2003-0965 | – | Feb 17 | Cross-site scripting (XSS) vulnerability in the admin CGI script for Mailman before 2.1.4 allows remote attackers to steal session cookies and conduct unauthorized activities Affected: through 2.1.4 |
| CVE-2003-0038 | – | Feb 7 | Cross-site scripting (XSS) vulnerability in options.py for Mailman 2.1 allows remote attackers to inject script or HTML into web pages via the (1) email or (2) language parameters Affected: 2.1 |
| CVE-2002-0855 | – | Sep 5 | Cross-site scripting vulnerability in Mailman before 2.0.12 allows remote attackers to execute script as other users via a subscriber's list subscription options in the (1)… Affected: 2.0.12 |
| CVE-2002-0389 | – | Jun 18 | Pipermail in Mailman stores private mail messages with predictable filenames in a world-executable directory, which allows local users to read private mailing list archives Affected: All versions, or not specified |
| CVE-2002-0388 | – | Jun 18 | Cross-site scripting vulnerabilities in Mailman before 2.0.11 allow remote attackers to execute script via (1) the admin login page, or (2) the Pipermail index summaries Affected: through 2.0.11 |
| CVE-2001-0884 | – | Dec 21 | Cross-site scripting vulnerability in Mailman email archiver before 2.08 allows attackers to obtain sensitive information or authentication credentials via a malicious link that… Affected: 5.0; 5.1; 6.0; 7.0 |
| CVE-2001-1132 | – | Sep 5 | Mailman 2.0.x before 2.0.6 allows remote attackers to gain access to list administrative pages when there is an empty site or list password, which is not properly handled during… Affected: through 2.0.5 |
| CVE-2001-0290 | – | May 3 | Vulnerability in Mailman 2.0.1 and earlier allows list administrators to obtain user passwords Affected: through 2.0.2 |
| CVE-2000-0861 | – | Nov 14 | Mailman 1.1 allows list administrators to execute arbitrary commands via shell metacharacters in the %(listname) macro expansion Affected: 1.1 |
| CVE-2000-0701 | – | Oct 20 | The wrapper program in mailman 2.0beta3 and 2.0beta4 does not properly cleanse untrusted format strings, which allows local users to gain privileges Affected: 2.0; 2.0 |
Showing 47