https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 20:28:19 +0000 https://cve.radiocsirt.org/vuln/alsa-2021:4826 <p><strong>Affected:</strong> AlmaLinux:8: mailman</p> <p>Mailman is a program used to help manage e-mail discussion lists.</p> <p>Security Fix(es):</p> <p>* mailman: CSRF token bypass allows to perform CSRF attacks and account takeover (CVE-2021-42097)</p> <p>* mailman: CSRF token derived from admin password allows offline brute-force attack (CVE-2021-42096)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:8: mailman</p> <p>Mailman is a program used to help manage e-mail discussion lists.</p> <p>Security Fix(es):</p> <p>* mailman: CSRF token bypass allows to perform CSRF attacks and account takeover (CVE-2021-42097)</p> <p>* mailman: CSRF token derived from admin password allows offline brute-force attack (CVE-2021-42096)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2021:4826 https://cve.radiocsirt.org/vuln/euvd-2026-31993 EUVD-2026-31993 https://cve.radiocsirt.org/vuln/euvd-2026-31993 https://cve.radiocsirt.org/vuln/fkie_cve-2021-42097 <p>GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not specific to a single user account. An attacker can obtain a value within the context of an unprivileged user account, and then use that value in a CSRF attack against an admin (e.g., for account takeover).</p> <p>GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not specific to a single user account. An attacker can obtain a value within the context of an unprivileged user account, and then use that value in a CSRF attack against an admin (e.g., for account takeover).</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-42097 https://cve.radiocsirt.org/vuln/ghsa-vj65-f4hc-r425 <p>GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not specific to a single user account. An attacker can obtain a value within the context of an unprivileged user account, and then use that value in a CSRF attack against an admin (e.g., for account takeover).</p> <p>GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not specific to a single user account. An attacker can obtain a value within the context of an unprivileged user account, and then use that value in a CSRF attack against an admin (e.g., for account takeover).</p> https://cve.radiocsirt.org/vuln/ghsa-vj65-f4hc-r425 https://cve.radiocsirt.org/vuln/gsd-2021-42097 gsd-2021-42097 https://cve.radiocsirt.org/vuln/gsd-2021-42097 https://cve.radiocsirt.org/vuln/oesa-2021-1405 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: mailman, openEuler:20.03-LTS-SP2: mailman</p> <p>Mailman is free software for managing electronic mail discussion and e-newsletter lists. Mailman is integrated with the web, making it easy for users to manage their accounts and for list owners to administer their lists. Mailman supports built-in archiving, automatic bounce processing, content filtering, digest delivery, spam filters, and more. Security Fix(es): /options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection.(CVE-2020-12108) GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform MIME sniffing, conclude that the MIME type should have been text/html, and execute JavaScript code.(CVE-2020-12137) GNU Mailman before 2.1.33 allows arbitrary content injection via the Cgi/private.py private archive login page.(CVE-2020-15011)</p> <p>GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A certain csrf_token value is derived from the admin password, and may be useful in conducting a brute-force attack against that password.(CVE-2021-42096)</p> <p>GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not specific to a single user account. An attacker can obtain a value within the context of an unprivileged user account, and then use that value in a CSRF attack against an admin (e.g., for…</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: mailman, openEuler:20.03-LTS-SP2: mailman</p> <p>Mailman is free software for managing electronic mail discussion and e-newsletter lists. Mailman is integrated with the web, making it easy for users to manage their accounts and for list owners to administer their lists. Mailman supports built-in archiving, automatic bounce processing, content filtering, digest delivery, spam filters, and more. Security Fix(es): /options/mailman in GNU Mailman before 2.1.31 allows Arbitrary Content Injection.(CVE-2020-12108) GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform MIME sniffing, conclude that the MIME type should have been text/html, and execute JavaScript code.(CVE-2020-12137) GNU Mailman before 2.1.33 allows arbitrary content injection via the Cgi/private.py private archive login page.(CVE-2020-15011)</p> <p>GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A certain csrf_token value is derived from the admin password, and may be useful in conducting a brute-force attack against that password.(CVE-2021-42096)</p> <p>GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not specific to a single user account. An attacker can obtain a value within the context of an unprivileged user account, and then use that value in a CSRF attack against an admin (e.g., for…</p> https://cve.radiocsirt.org/vuln/oesa-2021-1405 https://cve.radiocsirt.org/vuln/opensuse-su-2021:1436-1 <p>Security update for mailman</p> <p>Security update for mailman</p> https://cve.radiocsirt.org/vuln/opensuse-su-2021:1436-1 https://cve.radiocsirt.org/vuln/rhsa-2021:4837 <p>mailman: CSRF token derived from admin password allows offline brute-force attack mailman: CSRF token bypass allows to perform CSRF attacks and account takeover</p> <p>mailman: CSRF token derived from admin password allows offline brute-force attack mailman: CSRF token bypass allows to perform CSRF attacks and account takeover</p> https://cve.radiocsirt.org/vuln/rhsa-2021:4837 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-42097 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: mailman, Ubuntu:18.04:LTS: mailman, Ubuntu:20.04:LTS: mailman</p> <p>GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not specific to a single user account. An attacker can obtain a value within the context of an unprivileged user account, and then use that value in a CSRF attack against an admin (e.g., for account takeover).</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: mailman, Ubuntu:18.04:LTS: mailman, Ubuntu:20.04:LTS: mailman</p> <p>GNU Mailman before 2.1.35 may allow remote Privilege Escalation. A csrf_token value is not specific to a single user account. An attacker can obtain a value within the context of an unprivileged user account, and then use that value in a CSRF attack against an admin (e.g., for account takeover).</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-42097