Description

Multiple cross-site scripting (XSS) vulnerabilities in Cgi/confirm.py in GNU Mailman 2.1.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) full name or (2) username field in a confirmation message.

Remediation

References

CVE-2011-0707

Related Vulnerabilities

SugarCRM Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2008-2045)

WordPress Plugin WP Font Awesome Cross-Site Scripting (1.7.8)

Atlassian Confluence Server-Side Request Forgery (SSRF) Vulnerability (CVE-2020-29445)

MySQL CVE-2013-2389 Vulnerability (CVE-2013-2389)

WordPress Plugin Event Espresso 4 Decaf-Event Registration Event Ticketing Cross-Site Request Forgery (4.9.82)

Severity

Medium

Classification

CVE-2011-0707 CWE-707

Tags

Missing Update Known Vulnerabilities