barry warsaw

Top products

The 9 most recently published vulnerabilities affecting barry warsaw.

• CVE-2025-43919GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to read arbitrary files via ../ directory traversal at /mailman/private/mailman (aka the private archive authent...5.8Apr 20, 2025
• CVE-2025-43921GNU Mailman 2.1.39, as bundled in cPanel (and WHM), allows unauthenticated attackers to create lists via the /mailman/create endpoint. NOTE: multiple third parties report that they are unable to re...5.3Apr 20, 2025
• CVE-2021-44227In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes.8.8Dec 2, 2021
• CVE-2021-43332In GNU Mailman before 2.1.36, the CSRF token for the Cgi/admindb.py admindb page contains an encrypted version of the list admin password. This could potentially be cracked by a moderator via an of...6.5Nov 12, 2021
• CVE-2021-43331In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS.6.1Nov 12, 2021
• CVE-2020-15011GNU Mailman before 2.1.33 allows arbitrary content injection via the Cgi/private.py private archive login page.4.3Jun 24, 2020
• CVE-2020-12137GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP re...6.1Apr 24, 2020
• CVE-2016-6893Cross-site request forgery (CSRF) vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the authentication of arbitrary users for requests that...8.8Sep 2, 2016
• CVE-2016-7123Cross-site request forgery (CSRF) vulnerability in the admin web interface in GNU Mailman before 2.1.15 allows remote attackers to hijack the authentication of administrators.8.8Sep 2, 2016