Skip to content
Noroxi

sympa records

13 published records for vendor sympa.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
0
With a fix record
100%
Median publish → KEV
No record has entered KEV

Records by year

  1. 18
  2. 20
  3. 23

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

13 records
  • CVE-2018-1000550
    40Plan

    The Sympa Community Sympa version prior to version 6.2.32 contains a Directory Traversal vulnerability in wwsympa.fcgi template editing func

    CriticalCVSS 9.8No exploitEPSS 2%

    sympa · sympaJun 26, 2018

  • CVE-2012-2352
    31Monitor

    The archive management (arc_manage) page in wwsympa/wwsympa.fcgi.in in Sympa before 6.1.11 does not check permissions, which allows remote a

    HighCVSS 7.5No exploitEPSS 3%

    sympa · sympaMay 31, 2012

  • CVE-2020-9369
    31Monitor

    Sympa 6.2.38 through 6.2.52 allows remote attackers to cause a denial of service (disk consumption from temporary files, and a flood of noti

    HighCVSS 7.5No exploitEPSS 2%

    sympa · sympaFeb 24, 2020

  • CVE-2020-10936
    31Monitor

    Sympa before 6.2.56 allows privilege escalation.

    HighCVSS 7.8No exploitEPSS 0%

    sympa · sympaMay 27, 2020

  • CVE-2020-26880
    31Monitor

    Sympa through 6.2.57b.2 allows a local privilege escalation from the sympa user account to full root access by modifying the sympa.conf conf

    HighCVSS 7.8No exploitEPSS 0%

    sympa · sympaOct 7, 2020

  • CVE-2021-46900
    30Monitor

    Sympa before 6.2.62 relies on a cookie parameter for certain security objectives, but does not ensure that this parameter exists and has an

    HighCVSS 7.5No exploitEPSS 0%

    sympa · sympaDec 31, 2023

  • CVE-2008-4476
    27Monitor

    sympa.pl in sympa 5.3.4 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/sympa_aliases.$$ temporary file.

    MediumCVSS 6.9No exploitEPSS 0%

    sympa · sympaOct 7, 2008

  • CVE-2018-1000671
    25Monitor

    sympa version 6.2.16 and later contains a CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in The "referer" parame

    MediumCVSS 6.1Proof of conceptEPSS 3%

    sympa · sympaSep 6, 2018

  • CVE-2015-1306
    21Monitor

    The newsletter posting area in the web interface in Sympa 6.0.x before 6.0.10 and 6.1.x before 6.1.24 allows remote attackers to read arbitr

    MediumCVSS 5.0No exploitEPSS 2%

    sympa · sympaJan 22, 2015

  • CVE-2008-1648
    21Monitor

    Sympa before 5.4 allows remote attackers to cause a denial of service (daemon crash) via an e-mail message with a malformed value of the Con

    MediumCVSS 5.0No exploitEPSS 2%

    sympa · sympaApr 2, 2008

  • CVE-2004-1735
    18Monitor

    Cross-site scripting (XSS) vulnerability in the create list option in Sympa 4.1.x and earlier allows remote authenticated users to inject ar

    MediumCVSS 4.3Proof of conceptEPSS 2%

    sympa · sympaAug 21, 2004

  • CVE-2020-26932
    17Monitor

    debian/sympa.postinst for the Debian Sympa package before 6.2.40~dfsg-7 uses mode 4755 for sympa_newaliases-wrapper, whereas the intended pe

    MediumCVSS 4.3No exploitEPSS 0%

    sympa · sympaOct 10, 2020

  • CVE-2020-29668
    15Monitor

    Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired co

    LowCVSS 3.7No exploitEPSS 1%

    sympa · sympaDec 10, 2020