CVE-2007-1276

The CVE-2007-1276 entry describes multiple cross-site scripting (XSS) vulnerabilities in Webmin’s chooser.cgi, affecting Webmin versions before 1.330 and Usermin versions before 1.260. The root cause is improper handling of crafted filename input in chooser.cgi, enabling remote attackers to injec...

CVE-2007-1276: Cross-Site Request Forgery (CSRF)

Multiple cross-site scripting XSS vulnerabilities in chooser.cgi in Webmin before 1.330 and Usermin before 1.260 allow remote attackers to inject arbitrary web script or HTML via a crafted filename...

Mandrake Linux Security Advisory : webmin (MDKSA-2006:170-1)

Webmin before 1.296 and Usermin before 1.226 does not properly handle a URL with a null '%00' character, which allows remote attackers to conduct cross-site scripting XSS, read CGI program source code, list directories, and possibly execute programs. Updated packages have been patched to correct...

Mandrake Linux Security Advisory : webmin (MDKSA-2006:125)

Webmin before 1.290 and Usermin before 1.220 calls the simplifypath function before decoding HTML, which allows remote attackers to read arbitrary files. NOTE: This is a different issue than CVE-2006-3274. Updated packages have been patched to correct this issue. %NASLMINLEVEL 70300 C Tenable...

Debian DSA-1177-1 : usermin - programming error

Hendrik Weimer discovered that it is possible for a normal user to disable the login shell of the root account via usermin, a web-based administration tool. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...

CVE-2006-4246

Usermin before 1.220 20060629 allows remote attackers to read arbitrary files, possibly related to chfn/save.cgi not properly handling an empty shell parameter, which results in changing root's shell instead of the shell of a specified user...

CVE-2006-4246

Usermin before 1.220 20060629 allows remote attackers to read arbitrary files, possibly related to chfn/save.cgi not properly handling an empty shell parameter, which results in changing root's shell instead of the shell of a specified user...

CVE-2006-4246

Usermin before 1.220 20060629 allows remote attackers to read arbitrary files, possibly related to chfn/save.cgi not properly handling an empty shell parameter, which results in changing root's shell instead of the shell of a specified user...

CVE-2006-4246

CVE-2006-4246 affects Usermin prior to 1.220 (20060629). The vulnerability arises from how chfn/save.cgi handles an empty shell parameter, which can let remote attackers read arbitrary files and can change the root shell instead of the target user’s shell. Public sources confirm upstream fixes in...

CVE-2006-4246: Undefined Security Weakness

Usermin before 1.220 20060629 allows remote attackers to read arbitrary files, possibly related to chfn/save.cgi not properly handling an empty shell parameter, which results in changing root's shell instead of the shell of a specified user...

[SECURITY] [DSA 1177-1] New usermin packages fix denial of service

-------------------------------------------------------------------------- Debian Security Advisory DSA 1177-1 [email protected] http://www.debian.org/security/ Martin Schulze September 15th, 2006 http://www.debian.org/security/faq -...

DSA-1177-1 usermin

Bulletin has no description...

CVE-2006-4542

Webmin before 1.296 and Usermin before 1.226 do not properly handle a URL with a null "%00" character, which allows remote attackers to conduct cross-site scripting XSS, read CGI program source code, list directories, and possibly execute programs...

CVE-2006-4542

Webmin before 1.296 and Usermin before 1.226 do not properly handle a URL with a null "%00" character, which allows remote attackers to conduct cross-site scripting XSS, read CGI program source code, list directories, and possibly execute programs...

CVE-2006-4542

Webmin before 1.296 and Usermin before 1.226 do not properly handle a URL with a null "%00" character, which allows remote attackers to conduct cross-site scripting XSS, read CGI program source code, list directories, and possibly execute programs...

CVE-2006-4542

Vulnerability CVE-2006-4542 affects Webmin prior to 1.296 and Usermin prior to 1.226, where miniserv.pl fails to filter null (%00) characters in URLs. This can enable cross-site scripting, CGI source disclosure, directory listing, and potentially arbitrary code execution. The public advisories in...

CVE-2006-4542: Improper Neutralization of Input During Web Page Generation

Webmin before 1.296 and Usermin before 1.226 do not properly handle a URL with a null "%00" character, which allows remote attackers to conduct cross-site scripting XSS, read CGI program source code, list directories, and possibly execute programs...

[SA21690] Webmin / Usermin Cross-Site Scripting and Source Code Disclosure

TITLE: Webmin / Usermin Cross-Site Scripting and Source Code Disclosure SECUNIA ADVISORY ID: SA21690 VERIFY ADVISORY: http://secunia.com/advisories/21690/ CRITICAL: Moderately critical IMPACT: Cross Site Scripting, Exposure of sensitive information WHERE: From remote SOFTWARE: Webmin 1.x...

JVN#99776858 Multiple vulnerabilities in Webmin and Usermin

Impact A remote attacker could conduct the followings: Steal Webmin and Usermin's configuration information Execute an arbitrary script on the user's web browser Possibly conduct a session hijack attack if session information from a cookie is leaked Solution Products Affected Webmin 1.290 and...

GLSA-200608-11 : Webmin, Usermin: File Disclosure

The remote host is affected by the vulnerability described in GLSA-200608-11 Webmin, Usermin: File Disclosure A vulnerability in both Webmin and Usermin has been discovered by Kenny Chen, wherein simplifypath is called before the HTML is decoded. Impact : A non-authenticated user can read any fil...