93 matches found
CVE-2018-18207
Virtualmin 6.03 allows Frame Injection via the settings-editorread.cgi file parameter...
CVE-2018-18208
Virtualmin 6.03 allows XSS via the query string, as demonstrated by the webminsearch.cgi URI...
Design/Logic Flaw
Virtualmin 6.03 allows XSS via the query string, as demonstrated by the webminsearch.cgi URI...
CVE-2018-18207
Virtualmin 6.03 allows Frame Injection via the settings-editorread.cgi file parameter...
CVE-2018-18208
Virtualmin 6.03 allows XSS via the query string, as demonstrated by the webminsearch.cgi URI...
Design/Logic Flaw
Virtualmin 6.03 allows Frame Injection via the settings-editorread.cgi file parameter...
CVE-2018-18208
CVE-2018-18208 affects Virtualmin 6.03 and enables reflected XSS via the query string, demonstrated through the webmin_search.cgi URI. The connected sources confirm the vulnerable component (Webmin/Virtualmin search endpoint) and the input vector (query string) but do not provide explicit exploit...
CVE-2018-18207
Virtualmin 6.03 allows Frame Injection via the settings-editorread.cgi file parameter...
CVE-2018-18207
CVE-2018-18207 affects Virtualmin 6.03. The vulnerability arises from a flaw in the settings-editor_read.cgi file parameter, enabling Frame Injection . Exploitation details or successful exploit status are not provided in the connected documents. No remediation details are specified here.
CVE-2018-18208
Virtualmin 6.03 allows XSS via the query string, as demonstrated by the webminsearch.cgi URI...
Virtualmin 6.03 Multiple Vulnerabilities
Exploit for cgi platform in category web applications Exploit Title: Virtualmin 6.03 Multiple Vulnerabilities Exploit Author: Seccops - Siber Güvenlik Hizmetleri https://seccops.com Vendor Homepage: https://www.virtualmin.com/ Software Link: https://www.virtualmin.com/download.html Version: 6.03...
Fedora 26 : roundcubemail (2017-7263e7d321)
Roundcube Webmail 1.2.5 This is a security update to the stable version 1.2. It primarily fixes a recently discovered vulnerability in the virtualmin and sasl drivers of the password plugin plus adds a few cherry-picked bug fixes from upstream versions. A detailed list of changes is shown below...
Updated roundcubemail packages fix security vulnerability
It was discovered that roundcubemail prior to 1.0.11 contained a vulnerability in the virtualmin and sasl drivers of the password plugin CVE-2017-8114...
Internet Bug Bounty: Roundcube virtualmin privilege escalation (CVE-2017-8114)
Description Password plugin in its virtualmin driver allows to an attacker, that has a valid username/password to login in his web panel, to execute malicious inputs. This could allow to an attacker to reset victim's password and in some scenarios getting a system shell. CVE CVE-2017-8114 Details...
Fedora 25 : roundcubemail (2017-ede53aa845)
Roundcube Webmail 1.2.5 This is a security update to the stable version 1.2. It primarily fixes a recently discovered vulnerability in the virtualmin and sasl drivers of the password plugin plus adds a few cherry-picked bug fixes from upstream versions. A detailed list of changes is shown below...
Fedora 24 : roundcubemail (2017-c8448d0cad)
Roundcube Webmail 1.2.5 This is a security update to the stable version 1.2. It primarily fixes a recently discovered vulnerability in the virtualmin and sasl drivers of the password plugin plus adds a few cherry-picked bug fixes from upstream versions. A detailed list of changes is shown below...
Debian DLA-933-1 : roundcube security update
Roundcube Webmail allows arbitrary password resets by authenticated users. The issue is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin. For Debian 7 'Wheezy', these problems have been fixed in version 0.7.2-9+deb7u7. We recommend that you...
ALPINE-CVE-2017-8114
Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin...
CVE-2017-8114
Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin...
Default credentials
Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin...