CVE-2020-15011

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

GNU Mailman before 2.1.33 allows arbitrary content injection via the Cgi/private.py private archive login page.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-74

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00047.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00063.htmlMailing List, Third Party Advisory
https://bugs.launchpad.net/mailman/+bug/1877379Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/06/msg00036.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/07/msg00007.htmlMailing List, Third Party Advisory
https://usn.ubuntu.com/4406-1/Third Party Advisory
https://www.debian.org/security/2021/dsa-4991Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00047.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00063.htmlMailing List, Third Party Advisory
https://bugs.launchpad.net/mailman/+bug/1877379Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/06/msg00036.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/07/msg00007.htmlMailing List, Third Party Advisory
https://usn.ubuntu.com/4406-1/Third Party Advisory
https://www.debian.org/security/2021/dsa-4991Third Party Advisory

Timeline

Published: Jun 24, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-150128.6A Directory Traversal issue was discovered in Sonatype Nexus Repository Manager 2.x before 2.14.19. A user that requests a crafted path can CVE-2020-150148.8pramodmahato BlogCMS through 2019-12-31 has admin/changepass.php CSRF.CVE-2020-150156.1The FileExplorer component in GleamTech FileUltimate 6.1.5.0 allows XSS via an SVG document.CVE-2020-150166.1NeDi 1.9C is vulnerable to reflected cross-site scripting. The Other-Converter.php file improperly validates user input. An attacker can exp CVE-2020-150176.1NeDi 1.9C is vulnerable to reflected cross-site scripting. The Devices-Config.php file improperly validates user input. An attacker can expl CVE-2020-150186.5playSMS through 1.4.3 is vulnerable to session fixation.CVE-2020-15025.5An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory. An attacker who exploite CVE-2020-150205.4An issue was discovered in the Elementor plugin through 2.9.13 for WordPress. An authenticated attacker can achieve stored XSS via the Name CVE-2020-150235.9Askey AP5100W devices through AP5100W_Dual_SIG_1.01.097 are affected by WPS PIN offline brute-force cracking. This arises because of issues CVE-2020-150245.5An issue was discovered in the Login Password feature of the Password Manager component in Avast Antivirus 20.1.5069.562. An entered passwor CVE-2020-150254.9ntpd in ntp 4.2.8 before 4.2.8p15 and 4.3.x before 4.3.101 allows remote attackers to cause a denial of service (memory consumption) by send CVE-2020-150264.9Bludit 3.12.0 allows admins to use a /plugin-backup-download?file=../ directory traversal approach for arbitrary file download via backup/pl