CVSS: 7.5EPSS: 1%CPEs: 22EXPL: 1CVE-2004-1468
https://notcve.org/view.php?id=CVE-2004-1468
The web mail functionality in Usermin 1.x and Webmin 1.x allows remote attackers to execute arbitrary commands via shell metacharacters in an e-mail message. • http://secunia.com/advisories/12488 http://www.gentoo.org/security/en/glsa/glsa-200409-15.xml http://www.lac.co.jp/security/csl/intelligence/SNSadvisory_e/77_e.html http://www.securityfocus.com/bid/11122 https://exchange.xforce.ibmcloud.com/vulnerabilities/17293 •
CVSS: 2.1EPSS: 0%CPEs: 28EXPL: 0CVE-2004-0559
https://notcve.org/view.php?id=CVE-2004-0559
The maketemp.pl script in Usermin 1.070 and 1.080 allows local users to overwrite arbitrary files at install time via a symlink attack on the /tmp/.usermin directory. El script maketemp.pl en Usermin 1.070 y 1.080 permite a usuarios locales sobreescribir ficheros de su elección durante la instalación mediante un ataque de enlaces simbólicos en el directorio /tmp/.usermin • http://secunia.com/advisories/12488 http://www.gentoo.org/security/en/glsa/glsa-200409-15.xml http://www.securityfocus.com/bid/11153 http://www.webmin.com/uchanges-1.089.html https://exchange.xforce.ibmcloud.com/vulnerabilities/17299 •
CVSS: 5.0EPSS: 0%CPEs: 14EXPL: 0CVE-2004-0583
https://notcve.org/view.php?id=CVE-2004-0583
The account lockout functionality in (1) Webmin 1.140 and (2) Usermin 1.070 does not parse certain character strings, which allows remote attackers to conduct a brute force attack to guess user IDs and passwords. La funcionalidad lockout en (1)Webmin 1.140 y (2) Usermin 1.070 no process ciertas cadenas de caractéreis, lo que permite a atacanetes remotos conducir un ataque de fuerza bruta para averiguar IDs de usuario y contraseñas. • http://marc.info/?l=bugtraq&m=108737059313829&w=2 http://www.debian.org/security/2004/dsa-526 http://www.gentoo.org/security/en/glsa/glsa-200406-12.xml http://www.gentoo.org/security/en/glsa/glsa-200406-15.xml http://www.lac.co.jp/security/csl/intelligence/SNSadvisory_e/75_e.html http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2004:074 http://www.securityfocus.com/bid/10474 http://www.securityfocus.com/bid/10523 http://www.webmin.com/cha •
CVSS: 10.0EPSS: 6%CPEs: 18EXPL: 1CVE-2003-0101 – Webmin 0.9x / Usermin 0.9x/1.0 - Access Session ID Spoofing
https://notcve.org/view.php?id=CVE-2003-0101
miniserv.pl in (1) Webmin before 1.070 and (2) Usermin before 1.000 does not properly handle metacharacters such as line feeds and carriage returns (CRLF) in Base-64 encoded strings during Basic authentication, which allows remote attackers to spoof a session ID and gain root privileges. miniserv.pl en Webmin anterior a 1.070 y Usermin antes de 1.000 no maneja adecuadamente metacaractéres como avance de línea y retorno de carro (CRLF) en cadenas codificadas en Base-64 durante la autenticación básica, lo que permite a atacantes remotos suplantar un ID de sesión y ganar privilegios de root. • https://www.exploit-db.com/exploits/22275 ftp://patches.sgi.com/support/free/security/advisories/20030602-01-I http://archives.neohapsis.com/archives/hp/2003-q1/0063.html http://archives.neohapsis.com/archives/linux/engarde/2003-q1/0008.html http://marc.info/?l=bugtraq&m=104610245624895&w=2 http://marc.info/?l=bugtraq&m=104610300325629&w=2 http://marc.info/?l=bugtraq&m=104610336226274&w=2 http://marc.info/?l=webmin-announce&m=104587858408101&w=2 http://secunia&# •
CVSS: 7.5EPSS: 0%CPEs: 10EXPL: 0CVE-2002-0756
https://notcve.org/view.php?id=CVE-2002-0756
Cross-site scripting vulnerability in the authentication page for (1) Webmin 0.96 and (2) Usermin 0.90 allows remote attackers to insert script into an error page and possibly steal cookies. Vulnerabilidad de secuencias de comandos en sitios cruzados en la página de autenticación de: Webmin 0.96 Usermin 0.90 que permite a atacantes remotos la inserción de código en una página de error y posiblemente el robo de cookies. • http://archives.neohapsis.com/archives/bugtraq/2002-05/0040.html http://www.iss.net/security_center/static/9036.php http://www.securityfocus.com/bid/4694 •