Page 11 of 63 results (0.009 seconds)

CVSS: 10.0EPSS: 6%CPEs: 18EXPL: 1

miniserv.pl in (1) Webmin before 1.070 and (2) Usermin before 1.000 does not properly handle metacharacters such as line feeds and carriage returns (CRLF) in Base-64 encoded strings during Basic authentication, which allows remote attackers to spoof a session ID and gain root privileges. miniserv.pl en Webmin anterior a 1.070 y Usermin antes de 1.000 no maneja adecuadamente metacaractéres como avance de línea y retorno de carro (CRLF) en cadenas codificadas en Base-64 durante la autenticación básica, lo que permite a atacantes remotos suplantar un ID de sesión y ganar privilegios de root. • https://www.exploit-db.com/exploits/22275 ftp://patches.sgi.com/support/free/security/advisories/20030602-01-I http://archives.neohapsis.com/archives/hp/2003-q1/0063.html http://archives.neohapsis.com/archives/linux/engarde/2003-q1/0008.html http://marc.info/?l=bugtraq&m=104610245624895&w=2 http://marc.info/?l=bugtraq&m=104610300325629&w=2 http://marc.info/?l=bugtraq&m=104610336226274&w=2 http://marc.info/?l=webmin-announce&m=104587858408101&w=2 http://secunia&# •

CVSS: 3.6EPSS: 0%CPEs: 25EXPL: 2

The web interface for Webmin 0.92 does not properly quote or filter script code in files that are displayed to the interface, which allows local users to execute script and possibly steal cookies by inserting the script into certain files or fields, such as a real user name entry in the passwd file. • https://www.exploit-db.com/exploits/21348 http://online.securityfocus.com/archive/1/263181 http://www.securityfocus.com/bid/4329 https://exchange.xforce.ibmcloud.com/vulnerabilities/8596 •

CVSS: 10.0EPSS: 7%CPEs: 1EXPL: 0

The Printer Administration module for Webmin 0.990 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the printer name. • ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SN-02:05.asc http://www.iss.net/security_center/static/10052.php http://www.webmin.com/updates.html •

CVSS: 6.4EPSS: 0%CPEs: 23EXPL: 0

Webmin 0.21 through 1.0 uses the same built-in SSL key for all installations, which allows remote attackers to eavesdrop or highjack the SSL session. • ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SN-02%3A06.asc http://www.iss.net/security_center/static/10381.php http://www.securityfocus.com/bid/5936 http://www.webmin.com/changes.html •

CVSS: 2.1EPSS: 0%CPEs: 2EXPL: 0

Webmin 0.92, when installed from an RPM, creates /var/webmin with insecure permissions (world readable), which could allow local users to read the root user's cookie-based authentication credentials and possibly hijack the root user's session using the credentials. • http://online.securityfocus.com/archive/1/263181 http://www.securityfocus.com/bid/4328 http://www.webmin.com/changes.html https://exchange.xforce.ibmcloud.com/vulnerabilities/8595 •