CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 5CVE-2021-31762 – Webmin 1.973 - 'save_user.cgi' Cross-Site Request Forgery (CSRF)
https://notcve.org/view.php?id=CVE-2021-31762
Webmin 1.973 is affected by Cross Site Request Forgery (CSRF) to create a privileged user through Webmin's add users feature, and then get a reverse shell through Webmin's running process feature. Webmin versión 1.973, esta afectado por una vulnerabilidad de tipo Cross Site Request Forgery (CSRF) para crear un usuario privilegiado mediante la funcionalidad Webmin's add users, y luego obtener un shell inverso mediante la funcionalidad Webmin's running process Webmin version 1.973 suffers from a cross site request forgery vulnerability. • https://www.exploit-db.com/exploits/50126 https://github.com/electronicbots/CVE-2021-31762 https://github.com/Mesh3l911/CVE-2021-31762 http://packetstormsecurity.com/files/163492/Webmin-1.973-Cross-Site-Request-Forgery.html https://github.com/webmin/webmin https://youtu.be/qCvEXwyaF5U • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.6EPSS: 95%CPEs: 1EXPL: 5CVE-2021-31761 – Webmin 1.973 - 'run.cgi' Cross-Site Request Forgery (CSRF)
https://notcve.org/view.php?id=CVE-2021-31761
Webmin 1.973 is affected by reflected Cross Site Scripting (XSS) to achieve Remote Command Execution through Webmin's running process feature. Webmin versión 1.973, esta afectado por una vulnerabilidad de tipo Cross Site Scripting (XSS) reflejado para lograr una ejecución de comandos remota por medio de la funcionalidad Webmin's running process • https://www.exploit-db.com/exploits/50144 https://github.com/electronicbots/CVE-2021-31761 https://github.com/Mesh3l911/CVE-2021-31761 http://packetstormsecurity.com/files/163559/Webmin-1.973-Cross-Site-Request-Forgery.html https://github.com/webmin/webmin https://youtu.be/23VvUMu-28c • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 2%CPEs: 1EXPL: 3CVE-2021-31760
https://notcve.org/view.php?id=CVE-2021-31760
Webmin 1.973 is affected by Cross Site Request Forgery (CSRF) to achieve Remote Command Execution (RCE) through Webmin's running process feature. Webmin versión 1.973, esta afectado por una vulnerabilidad de tipo Cross Site Request Forgery (CSRF) para lograr una Ejecución de Comandos Remota (RCE) por medio de la funcionalidad Webmin's running process • https://github.com/electronicbots/CVE-2021-31760 https://github.com/Mesh3l911/CVE-2021-31760 https://github.com/webmin/webmin https://youtu.be/D45FN8QrzDo • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-35769
https://notcve.org/view.php?id=CVE-2020-35769
miniserv.pl in Webmin 1.962 on Windows mishandles special characters in query arguments to the CGI program. El archivo miniserv.pl en Webmin versión 1.962 en Windows, maneja inapropiadamente unos caracteres especiales en los argumentos de consulta para el programa CGI • https://github.com/webmin/webmin/commit/1163f3a7f418f249af64890f4636575e687e9de7#diff-9b33fd8f5603d4f0d1428689bc36f24af4770608a22c0d92b7a8bcc522450dc6 https://vigilance.fr/vulnerability/Webmin-code-execution-via-miniserv-pl-handle-request-34220 •
CVSS: 9.0EPSS: 2%CPEs: 1EXPL: 3CVE-2020-35606 – Webmin 1.962 - 'Package Updates' Escape Bypass RCE
https://notcve.org/view.php?id=CVE-2020-35606
Arbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can execute arbitrary commands with root privileges via vectors involving %0A and %0C. NOTE: this issue exists because of an incomplete fix for CVE-2019-12840. Una ejecución de comandos arbitraria puede ocurrir en Webmin versiones hasta 1.962. Cualquier usuario autorizado para el módulo Package Updates puede ejecutar comandos arbitrarios con privilegios root por medio de vectores que involucran %0A y %0C. • https://www.exploit-db.com/exploits/49318 http://packetstormsecurity.com/files/160676/Webmin-1.962-Remote-Command-Execution.html https://www.pentest.com.tr/exploits/Webmin-1962-PU-Escape-Bypass-Remote-Command-Execution.html https://www.webmin.com/download.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •