Webmin / Usermin PAM Authentication Bypass Vulnerability

Secunia Advisory: SA16858 Release Date: 2005-09-20 Critical: Moderately critical Impact: Security Bypass Where: From remote Solution Status: Vendor Patch Software: Usermin 1.x Webmin 1.x Select a product and view a complete list of all Patched/Unpatched Secunia advisories affecting it. Descriptio...

JVN#40940493 Webmin and Usermin authentication bypass vulnerability

Impact A remote attacker could bypass Webmin and Usermin's authentication, and execute an arbitrary command with root privileges. Solution Products Affected Webmin Version 1.200 - 1.220 Usermin Version 1.130 - 1.160...

CVE-2005-2731

Directory traversal vulnerability in Astaro Security Linux 6.0, when using Webmin, allows remote authenticated webmin users to read arbitrary files via a .. dot dot in the wfedownload parameter to index.fpl...

CVE-2005-2731

CVE-2005-2731: Directory traversal in Astaro Security Linux 6.0 when Webmin is used. Remote authenticated Webmin users could read arbitrary files via a .. sequence in the wfe_download parameter to index.fpl. NVD lists a LOW base score (2.1). No remediation details are provided in the supplied doc...

CVE-2005-2731

Directory traversal vulnerability in Astaro Security Linux 6.0, when using Webmin, allows remote authenticated webmin users to read arbitrary files via a .. dot dot in the wfedownload parameter to index.fpl...

CVE-2005-2731: Undefined Security Weakness

Directory traversal vulnerability in Astaro Security Linux 6.0, when using Webmin, allows remote authenticated webmin users to read arbitrary files via a .. dot dot in the wfedownload parameter to index.fpl...

Astaro security Linux default configuration multiple vulnerabilities

It's possible to access 127.0.0.1 with CONNECT proxy, Webmin directory traversal, crossite scripting...

Astaro Security Linux 6.0 - HTTP CONNECT Access Localhost Weakness

Astaro Security Linux 6.0 - HTTP CONNECT Access Localhost Weakness ================================================================== Product: ======== Astaro Security Linux 6.0 is a network security solution, including a combination of the following security applications: - Stateful inspection...

CVE-2001-1530

run.cgi in Webmin 0.80 and 0.88 creates temporary files with world-writable permissions, which allows local users to execute arbitrary commands...

CVE-2001-1530

CVE-2001-1530 affects Webmin 0.80 and 0.88. The vulnerability is in run.cgi, which creates temporary files with world-writable permissions. This allows local users to execute arbitrary commands. The connected Red Hat/Nessus entries corroborate the effect, describing the same root cause and impact...

CVE-2001-1530: Undefined Security Weakness

run.cgi in Webmin 0.80 and 0.88 creates temporary files with world-writable permissions, which allows local users to execute arbitrary commands...

FreeBSD : webmin (2132)

The following package needs to be updated: webmin %NASLMINLEVEL 70300 C Tenable Network Security, Inc. This script contains information extracted from VuXML : Copyright 2003-2006 Jacques Vidrine and contributors Redistribution and use in source VuXML and 'compiled' forms SGML, HTML, PDF,...

CVE-2002-1947

Webmin 0.21–1.0 uses the same built-in SSL key across installations, allowing remote attackers to eavesdrop on or hijack SSL sessions. The root cause is the shared SSL key across deployments. No remediation or patch details are provided in the connected documents.

CVE-2002-1947

Webmin 0.21 through 1.0 uses the same built-in SSL key for all installations, which allows remote attackers to eavesdrop or highjack the SSL session...

CVE-2002-1947: Undefined Security Weakness

Webmin 0.21 through 1.0 uses the same built-in SSL key for all installations, which allows remote attackers to eavesdrop or highjack the SSL session...

CVE-2002-1672

Webmin 0.92 (RPM install) creates /var/webmin with world-readable permissions, enabling local users to read the root cookie-based authentication credentials and potentially hijack the root session. The issue is documented in CVE-2002-1672 and corroborated by multiple sources (NVD/Nessus). Affecte...

CVE-2002-1673

The CVE-2002-1673 issue affects Webmin 0.92: the web interface fails to properly quote/filter script code in files shown to the interface, enabling local users to run scripts and potentially steal cookies by inserting script into files or fields such as a real user name entry in /etc/passwd. The ...

CVE-2002-1673

The web interface for Webmin 0.92 does not properly quote or filter script code in files that are displayed to the interface, which allows local users to execute script and possibly steal cookies by inserting the script into certain files or fields, such as a real user name entry in the passwd fi...

CVE-2002-1672

Webmin 0.92, when installed from an RPM, creates /var/webmin with insecure permissions world readable, which could allow local users to read the root user's cookie-based authentication credentials and possibly hijack the root user's session using the credentials...

CVE-2002-1672: Undefined Security Weakness

Webmin 0.92, when installed from an RPM, creates /var/webmin with insecure permissions world readable, which could allow local users to read the root user's cookie-based authentication credentials and possibly hijack the root user's session using the credentials...