CVSS: 7.5EPSS: 71%CPEs: 2EXPL: 11CVE-2006-3392 – Webmin < 1.290 / Usermin < 1.220 - Arbitrary File Disclosure
https://notcve.org/view.php?id=CVE-2006-3392
06 Jul 2006 — Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using "..%01" sequences, which bypass the removal of "../" sequences before bytes such as "%01" are removed from the filename. NOTE: This is a different issue than CVE-2006-3274. Las aplicaciones Webmin antes de su versión 1.290 y Usermin antes de la 1.220 llaman a la función simplify_path antes de decodificar HTML, lo que permite a atacan... • https://packetstorm.news/files/id/180803 •
CVSS: 9.1EPSS: 2%CPEs: 2EXPL: 0CVE-2005-3042
https://notcve.org/view.php?id=CVE-2005-3042
22 Sep 2005 — miniserv.pl in Webmin before 1.230 and Usermin before 1.160, when "full PAM conversations" is enabled, allows remote attackers to bypass authentication by spoofing session IDs via certain metacharacters (line feed or carriage return). • http://archives.neohapsis.com/archives/bugtraq/2005-09/0257.html •