Multiple cross-site scripting (XSS) vulnerabilities in Cgi/confirm.py in GNU Mailman 2.1.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) full name or (2) username field in a confirmation message.
CVSS Details
- CVSS 3.1 Base Score: 6.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Apache | — | Upgrade macOS to the latest versionApply OS X security update 2011-006 | Aug 28, 2015 | Feb 22, 2011 |
| Apple Osx Mailman | — | Apply OS X security update 2011-006 | Dec 16, 2011 | Feb 22, 2011 |
| Centos_linux | — | Upgrade mailman | Dec 1, 2016 | Feb 22, 2011 |
| Freebsd | — | Upgrade mailman | Dec 10, 2025 | Mar 10, 2011 |
| Oracle_linux | — | Upgrade mailman | Oct 16, 2024 | Feb 22, 2011 |
| Suse | — | Upgrade mailman | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade mailman | Nov 8, 2024 | Feb 22, 2011 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub