CVSS: 5.0EPSS: 0%CPEs: 14EXPL: 0CVE-2004-0583
https://notcve.org/view.php?id=CVE-2004-0583
The account lockout functionality in (1) Webmin 1.140 and (2) Usermin 1.070 does not parse certain character strings, which allows remote attackers to conduct a brute force attack to guess user IDs and passwords. La funcionalidad lockout en (1)Webmin 1.140 y (2) Usermin 1.070 no process ciertas cadenas de caractéreis, lo que permite a atacanetes remotos conducir un ataque de fuerza bruta para averiguar IDs de usuario y contraseñas. • http://marc.info/?l=bugtraq&m=108737059313829&w=2 http://www.debian.org/security/2004/dsa-526 http://www.gentoo.org/security/en/glsa/glsa-200406-12.xml http://www.gentoo.org/security/en/glsa/glsa-200406-15.xml http://www.lac.co.jp/security/csl/intelligence/SNSadvisory_e/75_e.html http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:074 http://www.securityfocus.com/bid/10474 http://www.securityfocus.com/bid/10523 http://www.webmin.com/cha •
CVSS: 10.0EPSS: 6%CPEs: 18EXPL: 1CVE-2003-0101 – Webmin 0.9x / Usermin 0.9x/1.0 - Access Session ID Spoofing
https://notcve.org/view.php?id=CVE-2003-0101
miniserv.pl in (1) Webmin before 1.070 and (2) Usermin before 1.000 does not properly handle metacharacters such as line feeds and carriage returns (CRLF) in Base-64 encoded strings during Basic authentication, which allows remote attackers to spoof a session ID and gain root privileges. miniserv.pl en Webmin anterior a 1.070 y Usermin antes de 1.000 no maneja adecuadamente metacaractéres como avance de línea y retorno de carro (CRLF) en cadenas codificadas en Base-64 durante la autenticación básica, lo que permite a atacantes remotos suplantar un ID de sesión y ganar privilegios de root. • https://www.exploit-db.com/exploits/22275 ftp://patches.sgi.com/support/free/security/advisories/20030602-01-I http://archives.neohapsis.com/archives/hp/2003-q1/0063.html http://archives.neohapsis.com/archives/linux/engarde/2003-q1/0008.html http://marc.info/?l=bugtraq&m=104610245624895&w=2 http://marc.info/?l=bugtraq&m=104610300325629&w=2 http://marc.info/?l=bugtraq&m=104610336226274&w=2 http://marc.info/?l=webmin-announce&m=104587858408101&w=2 http://secunia&# •
CVSS: 3.6EPSS: 0%CPEs: 25EXPL: 2CVE-2002-1673 – Webmin 0.x - Code Input Validation
https://notcve.org/view.php?id=CVE-2002-1673
The web interface for Webmin 0.92 does not properly quote or filter script code in files that are displayed to the interface, which allows local users to execute script and possibly steal cookies by inserting the script into certain files or fields, such as a real user name entry in the passwd file. • https://www.exploit-db.com/exploits/21348 http://online.securityfocus.com/archive/1/263181 http://www.securityfocus.com/bid/4329 https://exchange.xforce.ibmcloud.com/vulnerabilities/8596 •
CVSS: 10.0EPSS: 7%CPEs: 1EXPL: 0CVE-2002-2201
https://notcve.org/view.php?id=CVE-2002-2201
The Printer Administration module for Webmin 0.990 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the printer name. • ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SN-02:05.asc http://www.iss.net/security_center/static/10052.php http://www.webmin.com/updates.html •
CVSS: 6.4EPSS: 0%CPEs: 23EXPL: 0CVE-2002-1947
https://notcve.org/view.php?id=CVE-2002-1947
Webmin 0.21 through 1.0 uses the same built-in SSL key for all installations, which allows remote attackers to eavesdrop or highjack the SSL session. • ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SN-02%3A06.asc http://www.iss.net/security_center/static/10381.php http://www.securityfocus.com/bid/5936 http://www.webmin.com/changes.html •