CVE-2021-46900

< 6.2.62

Sympa before 6.2.62 relies on a cookie parameter for certain security objectives, but does not ensure that this parameter exists a

7.5HIGH

CVE-2020-29668

<= 6.2.58

Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an

3.7LOW

CVE-2020-26932

< 6.2.40

debian/sympa.postinst for the Debian Sympa package before 6.2.40~dfsg-7 uses mode 4755 for sympa_newaliases-wrapper, whereas the i

4.3MEDIUM

CVE-2020-26880

<= 6.2.56

Sympa through 6.2.57b.2 allows a local privilege escalation from the sympa user account to full root access by modifying the sympa

7.8HIGH

CVE-2020-10936

< 6.2.56

Sympa before 6.2.56 allows privilege escalation.

7.8HIGH

CVE-2020-9369

>= 6.2.38 and <= 6.2.52

Sympa 6.2.38 through 6.2.52 allows remote attackers to cause a denial of service (disk consumption from temporary files, and a flo

7.5HIGH

CVE-2018-1000671

>= 6.2.16

sympa version 6.2.16 and later contains a CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in The "refer

6.1MEDIUM

CVE-2018-1000550

< 6.2.32

The Sympa Community Sympa version prior to version 6.2.32 contains a Directory Traversal vulnerability in wwsympa.fcgi template ed

9.8CRITICAL

CVE-2015-1306

all versions

The newsletter posting area in the web interface in Sympa 6.0.x before 6.0.10 and 6.1.x before 6.1.24 allows remote attackers to r

CVE-2012-2352

<= 6.1.10

The archive management (arc_manage) page in wwsympa/wwsympa.fcgi.in in Sympa before 6.1.11 does not check permissions, which allow

CVE-2008-4476

all versions

sympa.pl in sympa 5.3.4 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/sympa_aliases.$$ temporar

CVE-2008-1648

all versions

Sympa before 5.4 allows remote attackers to cause a denial of service (daemon crash) via an e-mail message with a malformed value

CVE-2005-0073

all versions

Buffer overflow in queue.c in a support script for sympa 3.3.3, when running setuid, allows local users to execute arbitrary code.

CVE-2004-1735

all versions

Cross-site scripting (XSS) vulnerability in the create list option in Sympa 4.1.x and earlier allows remote authenticated users to