424 matches found
Webmin < 1.290 / Usermin < 1.220 Arbitrary File Disclosure Exploit
No description provided by source. ?php / Name : Webmin / Usermin Arbitrary File Disclosure Vulnerability Date : 2006-06-30 Patch : update to version 1.290 Advisory : http://securitydot.net/vuln/exploits/vulnerabilities/articles/17885/vuln.html Coded by joffer , http://securitydot.net / $host =...
Webmin 1.290 Usermin 1.220 - Arbitrary File Disclosure (PHP)
Webmin 1.290 Usermin 1.220 - Arbitrary File Disclosure PHP milw0rm.com 2006-07-09...
Webmin < 1.290 / Usermin < 1.220 - Arbitrary File Disclosure
milw0rm.com 2006-07-09...
Webmin and Usermin fail to sanitize user input
Overview Webmin and Usermin do not properly sanitize user input. This vulnerability may allow a remote, unauthenticated user to view any file on the system running Webmin or Usermin. Description Webmin Webmin is popular web-based administration tool for Unix and Linux servers that allows system...
CVE-2006-3392
Webmin before 1.290 and Usermin before 1.220 calls the simplifypath function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using "..%01" sequences, which bypass the removal of "../" sequences before bytes such as "%01" are removed from the filename...
CVE-2006-3392
Webmin before 1.290 and Usermin before 1.220 calls the simplifypath function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using "..%01" sequences, which bypass the removal of "../" sequences before bytes such as "%01" are removed from the filename...
CVE-2006-3392
CVE-2006-3392 affects Webmin (pre-1.290) and Usermin (pre-1.220). The issue arises when the server’s miniserv.pl sanitization path uses the simplify_path function before HTML decoding, allowing a remote attacker to read arbitrary files via specially crafted URLs (eg, using ..%01 sequences that b...
CVE-2006-3392
Webmin before 1.290 and Usermin before 1.220 calls the simplifypath function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using "..%01" sequences, which bypass the removal of "../" sequences before bytes such as "%01" are removed from the filename...
CVE-2006-3392: Undefined Security Weakness
Webmin before 1.290 and Usermin before 1.220 calls the simplifypath function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using "..%01" sequences, which bypass the removal of "../" sequences before bytes such as "%01" are removed from the filename...
FreeBSD : webmin, usermin -- arbitrary file disclosure vulnerability (227475c2-09cb-11db-9156-000e0c2e438a)
The webmin development team reports : An attacker without a login to Webmin can read the contents of any file on the server using a specially crafted URL. All users should upgrade to version 1.290 as soon as possible, or setup IP access control in Webmin. %NASLMINLEVEL 70300 C Tenable Network...
Webmin File Disclosure
A vulnerability has been reported in Webmin and Usermin, which can be exploited by malicious people to disclose potentially sensitive information. The vulnerability is caused due to an unspecified error within the handling of an URL. This can be exploited to read the contents of any files on the...
webmin, usermin -- arbitrary file disclosure vulnerability
The webmin development team reports: An attacker without a login to Webmin can read the contents of any file on the server using a specially crafted URL. All users should upgrade to version 1.290 as soon as possible, or setup IP access control in Webmin...
FreeBSD : perl, webmin, usermin -- perl format string integer wrap vulnerability (bb33981a-7ac6-11da-bf72-00123f589060)
The Perl Development page reports : Dyad Security recently released a security advisory explaining how in certain cases, a carefully crafted format string passed to sprintf can cause a buffer overflow. This buffer overflow can then be used by an attacker to execute code on the machine. This was...
GLSA-200512-02 : Webmin, Usermin: Format string vulnerability
The remote host is affected by the vulnerability described in GLSA-200512-02 Webmin, Usermin: Format string vulnerability Jack Louis discovered that the Webmin and Usermin 'miniserv.pl' web server component is vulnerable to a Perl format string vulnerability. Login with the supplied username is...
Webmin, Usermin: Format string vulnerability
Background Webmin is a web-based interface for Unix-like systems. Usermin is a simplified version of Webmin designed for use by normal users rather than system administrators. Description Jack Louis discovered that the Webmin and Usermin "miniserv.pl" web server component is vulnerable to a Perl...
CVE-2005-3912
Format string vulnerability in miniserv.pl Perl web server in Webmin before 1.250 and Usermin before 1.180, with syslog logging enabled, allows remote attackers to cause a denial of service crash or memory consumption and possibly execute arbitrary code via format string specifiers in the usernam...
CVE-2005-3912
CVE-2005-3912: Webmin/miniserv.pl format-string vulnerability (username in login form) can crash or exhaust resources and potentially allow remote code execution when syslog logging is enabled. Affected: Webmin < 1.250 and Usermin
CVE-2005-3912: Undefined Security Weakness
Format string vulnerability in miniserv.pl Perl web server in Webmin before 1.250 and Usermin before 1.180, with syslog logging enabled, allows remote attackers to cause a denial of service crash or memory consumption and possibly execute arbitrary code via format string specifiers in the usernam...
Webmin / Usermin Detection (HTTP)
HTTP based detection of Webmin / Usermin. SPDX-FileCopyrightText: 2005 Alert4Web.com Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.10757"...
GLSA-200509-17 : Webmin, Usermin: Remote code execution through PAM authentication
The remote host is affected by the vulnerability described in GLSA-200509-17 Webmin, Usermin: Remote code execution through PAM authentication Keigo Yamazaki discovered that the miniserv.pl webserver, used in both Webmin and Usermin, does not properly validate authentication credentials before...