CVSS: 5.0EPSS: 0%CPEs: 14EXPL: 0CVE-2004-0583
https://notcve.org/view.php?id=CVE-2004-0583
The account lockout functionality in (1) Webmin 1.140 and (2) Usermin 1.070 does not parse certain character strings, which allows remote attackers to conduct a brute force attack to guess user IDs and passwords. La funcionalidad lockout en (1)Webmin 1.140 y (2) Usermin 1.070 no process ciertas cadenas de caractéreis, lo que permite a atacanetes remotos conducir un ataque de fuerza bruta para averiguar IDs de usuario y contraseñas. • http://marc.info/?l=bugtraq&m=108737059313829&w=2 http://www.debian.org/security/2004/dsa-526 http://www.gentoo.org/security/en/glsa/glsa-200406-12.xml http://www.gentoo.org/security/en/glsa/glsa-200406-15.xml http://www.lac.co.jp/security/csl/intelligence/SNSadvisory_e/75_e.html http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:074 http://www.securityfocus.com/bid/10474 http://www.securityfocus.com/bid/10523 http://www.webmin.com/cha •
CVSS: 10.0EPSS: 6%CPEs: 18EXPL: 1CVE-2003-0101 – Webmin 0.9x / Usermin 0.9x/1.0 - Access Session ID Spoofing
https://notcve.org/view.php?id=CVE-2003-0101
miniserv.pl in (1) Webmin before 1.070 and (2) Usermin before 1.000 does not properly handle metacharacters such as line feeds and carriage returns (CRLF) in Base-64 encoded strings during Basic authentication, which allows remote attackers to spoof a session ID and gain root privileges. miniserv.pl en Webmin anterior a 1.070 y Usermin antes de 1.000 no maneja adecuadamente metacaractéres como avance de línea y retorno de carro (CRLF) en cadenas codificadas en Base-64 durante la autenticación básica, lo que permite a atacantes remotos suplantar un ID de sesión y ganar privilegios de root. • https://www.exploit-db.com/exploits/22275 ftp://patches.sgi.com/support/free/security/advisories/20030602-01-I http://archives.neohapsis.com/archives/hp/2003-q1/0063.html http://archives.neohapsis.com/archives/linux/engarde/2003-q1/0008.html http://marc.info/?l=bugtraq&m=104610245624895&w=2 http://marc.info/?l=bugtraq&m=104610300325629&w=2 http://marc.info/?l=bugtraq&m=104610336226274&w=2 http://marc.info/?l=webmin-announce&m=104587858408101&w=2 http://secunia&# •
CVSS: 3.6EPSS: 0%CPEs: 25EXPL: 2CVE-2002-1673 – Webmin 0.x - Code Input Validation
https://notcve.org/view.php?id=CVE-2002-1673
The web interface for Webmin 0.92 does not properly quote or filter script code in files that are displayed to the interface, which allows local users to execute script and possibly steal cookies by inserting the script into certain files or fields, such as a real user name entry in the passwd file. • https://www.exploit-db.com/exploits/21348 http://online.securityfocus.com/archive/1/263181 http://www.securityfocus.com/bid/4329 https://exchange.xforce.ibmcloud.com/vulnerabilities/8596 •
CVSS: 6.4EPSS: 0%CPEs: 23EXPL: 0CVE-2002-1947
https://notcve.org/view.php?id=CVE-2002-1947
Webmin 0.21 through 1.0 uses the same built-in SSL key for all installations, which allows remote attackers to eavesdrop or highjack the SSL session. • ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SN-02%3A06.asc http://www.iss.net/security_center/static/10381.php http://www.securityfocus.com/bid/5936 http://www.webmin.com/changes.html •
CVSS: 2.1EPSS: 0%CPEs: 2EXPL: 0CVE-2002-1672
https://notcve.org/view.php?id=CVE-2002-1672
Webmin 0.92, when installed from an RPM, creates /var/webmin with insecure permissions (world readable), which could allow local users to read the root user's cookie-based authentication credentials and possibly hijack the root user's session using the credentials. • http://online.securityfocus.com/archive/1/263181 http://www.securityfocus.com/bid/4328 http://www.webmin.com/changes.html https://exchange.xforce.ibmcloud.com/vulnerabilities/8595 •