Debian: Security Advisory (DSA-1177-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 1177-1 (usermin)

The remote host is missing an update to usermin announced via advisory DSA 1177-1. Hendrik Weimer discovered that it is possible for a normal user to disable the login shell of the root account via usermin, a web-based administration tool. OpenVAS Vulnerability Test $Id: deb11771.nasl 6616...

GLSA-200707-05 : Webmin, Usermin: XSS vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200707-05 Webmin, Usermin: XSS vulnerabilities The pamlogin.cgi file does not properly sanitize user input before sending it back as output to the user. Impact : An unauthenticated attacker could entice a user to browse a speciall...

Webmin pam_login.cgis远程跨站脚本执行漏洞

BUGTRAQ ID: 24381 CVECAN ID: CVE-2007-3156 Webmin是一款基于WEB的Unix和Linux操作系统管理界面。 Webmin的pamlogin.cgi文件中存在多个跨站脚本漏洞，如果用户受骗访问了恶意网页的话，远程攻击者就可以通过cid、message或question参数向用户浏览器会话注入并执行任意脚本。 Webmin Webmin 1.340 Webmin Usermin 1.270 Webmin ------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

Webmin, Usermin: Cross-site scripting vulnerabilities

Background Webmin is a web-based administrative interface for Unix-like systems. Usermin is a simplified version of Webmin designed for use by normal users rather than system administrators. Description The pamlogin.cgi file does not properly sanitize user input before sending it back as output t...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in pamlogin.cgi in Webmin before 1.350 and Usermin before 1.280 allow remote attackers to inject arbitrary web script or HTML via the 1 cid, 2 message, or 3 question parameter. NOTE: some of these details are obtained from third party information...

CVE-2007-3156

Multiple cross-site scripting XSS vulnerabilities in pamlogin.cgi in Webmin before 1.350 and Usermin before 1.280 allow remote attackers to inject arbitrary web script or HTML via the 1 cid, 2 message, or 3 question parameter. NOTE: some of these details are obtained from third party information...

CVE-2007-3156

Multiple cross-site scripting XSS vulnerabilities in pamlogin.cgi in Webmin before 1.350 and Usermin before 1.280 allow remote attackers to inject arbitrary web script or HTML via the 1 cid, 2 message, or 3 question parameter. NOTE: some of these details are obtained from third party information...

CVE-2007-3156

Webmin pam_login.cgi contains multiple XSS vulnerabilities (CVE-2007-3156) that allow remote attackers to inject arbitrary scripts if a user visits a crafted page. Affected are Webmin prior to 1.350 and Usermin prior to 1.280, where inputs in cid, message, or question are not properly sanitized. ...

CVE-2007-3156: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in pamlogin.cgi in Webmin before 1.350 and Usermin before 1.280 allow remote attackers to inject arbitrary web script or HTML via the 1 cid, 2 message, or 3 question parameter. NOTE: some of these details are obtained from third party information...

CVE-2007-1276

Multiple cross-site scripting XSS vulnerabilities in chooser.cgi in Webmin before 1.330 and Usermin before 1.260 allow remote attackers to inject arbitrary web script or HTML via a crafted filename...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in chooser.cgi in Webmin before 1.330 and Usermin before 1.260 allow remote attackers to inject arbitrary web script or HTML via a crafted filename...

CVE-2007-1276

Multiple cross-site scripting XSS vulnerabilities in chooser.cgi in Webmin before 1.330 and Usermin before 1.260 allow remote attackers to inject arbitrary web script or HTML via a crafted filename...

CVE-2007-1276

The CVE-2007-1276 entry describes multiple cross-site scripting (XSS) vulnerabilities in Webmin’s chooser.cgi, affecting Webmin versions before 1.330 and Usermin versions before 1.260. The root cause is improper handling of crafted filename input in chooser.cgi, enabling remote attackers to injec...

CVE-2007-1276: Cross-Site Request Forgery (CSRF)

Multiple cross-site scripting XSS vulnerabilities in chooser.cgi in Webmin before 1.330 and Usermin before 1.260 allow remote attackers to inject arbitrary web script or HTML via a crafted filename...

Mandrake Linux Security Advisory : webmin (MDKSA-2006:170-1)

Webmin before 1.296 and Usermin before 1.226 does not properly handle a URL with a null '%00' character, which allows remote attackers to conduct cross-site scripting XSS, read CGI program source code, list directories, and possibly execute programs. Updated packages have been patched to correct...

Mandrake Linux Security Advisory : webmin (MDKSA-2006:125)

Webmin before 1.290 and Usermin before 1.220 calls the simplifypath function before decoding HTML, which allows remote attackers to read arbitrary files. NOTE: This is a different issue than CVE-2006-3274. Updated packages have been patched to correct this issue. %NASLMINLEVEL 70300 C Tenable...

Debian DSA-1177-1 : usermin - programming error

Hendrik Weimer discovered that it is possible for a normal user to disable the login shell of the root account via usermin, a web-based administration tool. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Debian...

CVE-2006-4246

Usermin before 1.220 20060629 allows remote attackers to read arbitrary files, possibly related to chfn/save.cgi not properly handling an empty shell parameter, which results in changing root's shell instead of the shell of a specified user...

CVE-2006-4246

Usermin before 1.220 20060629 allows remote attackers to read arbitrary files, possibly related to chfn/save.cgi not properly handling an empty shell parameter, which results in changing root's shell instead of the shell of a specified user...