PT-2012-4413

Name of the Vulnerable Software and Affected Versions Webmin versions 1.590 and earlier Description The issue allows remote attackers to read arbitrary files without proper authorization. This is due to a lack of authorization check in the file/edit html.cgi component, which permits access to a...

CVE-2012-4893: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in file/show.cgi in Webmin 1.590 and earlier allow remote attackers to hijack the authentication of privileged users for requests that 1 read files or execute 2 tar, 3 zip, or 4 gzip commands, a different issue than CVE-2012-2982...

PT-2012-4411

Name of the Vulnerable Software and Affected Versions Webmin versions 1.590 and earlier Description The issue allows remote authenticated users to execute arbitrary Perl code via a crafted file associated with the type parameter, also referred to as the monitor type name. Recommendations For Webm...

PT-2012-4412

Name of the Vulnerable Software and Affected Versions Webmin versions 1.590 and earlier Description The issue allows remote authenticated users to execute arbitrary commands via an invalid character in a pathname. This can be achieved by using a | pipe character in the file/show.cgi endpoint...

CVE-2012-2982: Undefined Security Weakness

file/show.cgi in Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary commands via an invalid character in a pathname, as demonstrated by a | pipe character...

PT-2012-5642

Name of the Vulnerable Software and Affected Versions Webmin versions 1.590 and earlier Description The issue allows remote attackers to hijack the authentication of privileged users for requests, enabling them to read files or execute tar, zip, or gzip commands. Recommendations For Webmin versio...

Mandrake Linux Security Advisory : webmin (MDKSA-2001:016)

Previous versions of webmin would create temporary files insecurely on several occasions. This could be exploited by a local attacker to overwrite or create arbitrary files and possibly gain root privileges. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package...

Webmin contains input validation vulnerabilities

Overview Webmin 1.580, and possibly earlier versions, has been reported to contain input validation vulnerabilities. Description The advisories from American Information Security Group report the following vulnerabilities.CWE-20: Improper Input Validation - CVE-2012-2981 "An input validation flaw...

Webmin edit_html.cgi file Parameter Traversal Arbitrary File Access

This module exploits a directory traversal in Webmin 1.580. The vulnerability exists in the edithtml.cgi component and allows an authenticated user with access to the File Manager Module to access arbitrary files with root privileges. The module has been tested successfully with Webmin 1.580 over...

Webmin /file/show.cgi Remote Command Execution

This module exploits an arbitrary command execution vulnerability in Webmin 1.580. The vulnerability exists in the /file/show.cgi component and allows an authenticated user, with access to the File Manager Module, to execute arbitrary commands with root privileges. The module has been tested...

Webmin < 0.970 / Usermin < 0.910 Login XSS Vulnerability

Webmin and Usermin are prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mandriva Update for webmin MDVSA-2011:109 (webmin)

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

Mandriva Linux Security Advisory : webmin (MDVSA-2011:109)

A vulnerability was discovered and corrected in webmin : Cross-site scripting XSS vulnerability in Webmin 1.540 and earlier allows local users to inject arbitrary web script or HTML via a chfn command that changes the real aka Full Name field, related to useradmin/index.cgi and...

CVE-2011-1937

Cross-site scripting XSS vulnerability in Webmin 1.540 and earlier allows local users to inject arbitrary web script or HTML via a chfn command that changes the real aka Full Name field, related to useradmin/index.cgi and useradmin/user-lib.pl...

Cross site scripting

Cross-site scripting XSS vulnerability in Webmin 1.540 and earlier allows local users to inject arbitrary web script or HTML via a chfn command that changes the real aka Full Name field, related to useradmin/index.cgi and useradmin/user-lib.pl...

CVE-2011-1937

CVE-2011-1937 affects Webmin versions up to 1.540. The vulnerability is a cross-site scripting (XSS) flaw that lets local users inject arbitrary script/HTML via the chfn command changing the real name field, related to the code paths useradmin/index.cgi and useradmin/user-lib.pl. Documented impac...

CVE-2011-1937

Cross-site scripting XSS vulnerability in Webmin 1.540 and earlier allows local users to inject arbitrary web script or HTML via a chfn command that changes the real aka Full Name field, related to useradmin/index.cgi and useradmin/user-lib.pl...

PT-2011-3486

Name of the Vulnerable Software and Affected Versions Webmin versions 1.540 and earlier Description A cross-site scripting XSS issue allows local users to inject arbitrary web script or HTML via a chfn command that changes the real field, related to useradmin/index.cgi and useradmin/user-lib.pl...

CVE-2011-1937: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Webmin 1.540 and earlier allows local users to inject arbitrary web script or HTML via a chfn command that changes the real aka Full Name field, related to useradmin/index.cgi and useradmin/user-lib.pl...

XSS in Webmin 1.540 + exploit for privilege escalation

Information -------------------- Name : XSS vulnerability in Webmin Software : All versions prior to and including 1.540 are affected. Vendor Hompeage : http://www.webmin.com Vulnerability Type : Cross-Site Scripting Severity : Medium Researcher : Javier Bassi javierbassi at gmail dot com...