Description
GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors, because an HTTP reply from an archive web server may lack a MIME type, and a web browser may perform MIME sniffing, conclude that the MIME type should have been text/html, and execute JavaScript code.
Remediation
References
Related Vulnerabilities
Craft CMS Weak Password Recovery Mechanism for Forgotten Password Vulnerability (CVE-2017-8385)
Ruby Resource Management Errors Vulnerability (CVE-2008-2664)
WordPress Plugin Flexible Captcha Multiple Vulnerabilities (3.3)
WordPress Plugin AP Companion includes Backdoor [Only if downloaded via the vendor website] (1.0.6)
WordPress Plugin Contact Form 7 Multi-Step Addon Malicious Code (1.0.5)