1691 matches found
CVE-2019-15642
rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialisevariable makes an eval call. NOTE: the WebminServersIndex documentation states "RPC can be used to run any command or modify any file on a server, which is why access to it must...
CVE-2019-15642
rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialisevariable makes an eval call. NOTE: the WebminServersIndex documentation states "RPC can be used to run any command or modify any file on a server, which is why access to it must...
Remote code execution
rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialisevariable makes an eval call. NOTE: the WebminServersIndex documentation states "RPC can be used to run any command or modify any file on a server, which is why access to it must...
CVE-2019-15642
rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialisevariable makes an eval call. NOTE: the WebminServersIndex documentation states "RPC can be used to run any command or modify any file on a server, which is why access to it must...
CVE-2019-15641
xmlrpc.cgi in Webmin through 1.930 allows authenticated XXE attacks. By default, only root, admin, and sysadm can access xmlrpc.cgi...
Default credentials
xmlrpc.cgi in Webmin through 1.930 allows authenticated XXE attacks. By default, only root, admin, and sysadm can access xmlrpc.cgi...
CVE-2019-15642
rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialisevariable makes an eval call. NOTE: the WebminServersIndex documentation states "RPC can be used to run any command or modify any file on a server, which is why access to it must...
CVE-2019-15642
rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialisevariable makes an eval call. NOTE: the WebminServersIndex documentation states "RPC can be used to run any command or modify any file on a server, which is why access to it must...
CVE-2019-15642
CVE-2019-15642 : Webmin
CVE-2019-15641
xmlrpc.cgi in Webmin through 1.930 allows authenticated XXE attacks. By default, only root, admin, and sysadm can access xmlrpc.cgi...
CVE-2019-15641
CVE-2019-15641 affects Webmin via xmlrpc.cgi, where an authenticated XXE exists in Webmin up to version 1.930 (patch included in later versions). Impact: potential disclosure of sensitive data due to XML external entity processing; access is restricted in affected setups to root/admin/sysadm by d...
CVE-2019-15641
xmlrpc.cgi in Webmin through 1.930 allows authenticated XXE attacks. By default, only root, admin, and sysadm can access xmlrpc.cgi...
Webmin password_change.cgi backdoor
Added: 08/26/2019 Background Webmin is a web-based interface for system administration of Unix systems. The Webmin web server listens by default on port 10000/tcp. Problem A backdoor in Webmin allows a remote attacker to execute arbitrary commands by sending a POST request for passwordchange.cgi...
CVE-2019-15642: Improper Control of Generation of Code
rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialisevariable makes an eval call. NOTE: the WebminServersIndex documentation states "RPC can be used to run any command or modify any file on a server, which is why access to it must...
Webmin 1.890 expired Remote Root Exploit
Webmin version 1.890 based on 1.920 research expired remote root exploit. !/usr/bin/perl -w Webmin 1.890 based on 1.920 research 'expired' Remote Root Exploit Copyright 2019 c Todor Donev Installation on CentOS: rpm -ivh...
Webmin 1.890 expired Remote Root
!/usr/bin/perl -w Webmin 1.890 based on 1.920 research 'expired' Remote Root Exploit Copyright 2019 c Todor Donev Installation on CentOS: rpm -ivh https://sourceforge.net/projects/webadmin/files/webmin/1.890/webmin-1.890-1.noarch.rpm/download Disclaimer: This or previous programs are for...
PT-2019-14314
Name of the Vulnerable Software and Affected Versions Webmin versions prior to 1.920 Description The issue allows authenticated remote code execution via a crafted object name. This is because the unserialise variable function makes an eval call. It's noted that RPC can be used to run any command...
Webmin password_change.cgi backdoor
Added: 08/26/2019 Background Webmin is a web-based interface for system administration of Unix systems. The Webmin web server listens by default on port 10000/tcp. Problem A backdoor in Webmin allows a remote attacker to execute arbitrary commands by sending a POST request for passwordchange.cgi...
CVE-2019-15641: Improper Restriction of XML External Entity Reference
xmlrpc.cgi in Webmin through 1.930 allows authenticated XXE attacks. By default, only root, admin, and sysadm can access xmlrpc.cgi...
PT-2019-14313
Name of the Vulnerable Software and Affected Versions Webmin versions prior to 1.931 Description The issue allows authenticated XXE attacks through the xmlrpc.cgi module. By default, access to xmlrpc.cgi is restricted to root, admin, and sysadm users. Recommendations For versions prior to 1.931,...