1377 matches found
GLSA-200409-15 : Webmin, Usermin: Multiple vulnerabilities in Usermin
The remote host is affected by the vulnerability described in GLSA-200409-15 Webmin, Usermin: Multiple vulnerabilities in Usermin There is an input validation bug in the webmail feature of Usermin. Additionally, the Webmin and Usermin installation scripts write to /tmp/.webmin without properly...
Webmin, Usermin: Multiple vulnerabilities in Usermin
Background Webmin and Usermin are web-based system administration consoles. Webmin allows an administrator to easily configure servers and other features. Usermin allows users to configure their own accounts, execute commands, and read e-mail. The Usermin functionality, including webmail, is also...
Webmin 1.x - HTML Email Command Execution
source: https://www.securityfocus.com/bid/11122/info Webmin / Usermin are reportedly affected by a command execution vulnerability when rendering HTML email messages. This issue is due to a failure to sanitize HTML email messages and may allow an attacker to execute arbitrary commands on a...
Webmin 1.x - HTML Email Command Execution
Webmin 1.x - HTML Email Command Execution source: https://www.securityfocus.com/bid/11122/info Webmin / Usermin are reportedly affected by a command execution vulnerability when rendering HTML email messages. This issue is due to a failure to sanitize HTML email messages and may allow an attacker...
webmin -- insecure temporary file creation at installation time
The Webmin developers documented a security issue in the release notes for version 1.160: Fixed a security hole in the maketemp.pl script, used to create the /tmp/.webmin directory at install time. If an un-trusted user creates this directory before Webmin is installed, he could create in it a...
GLSA-200406-12 : Webmin: Multiple vulnerabilities
The remote host is affected by the vulnerability described in GLSA-200406-12 Webmin: Multiple vulnerabilities Webmin contains two security vulnerabilities. One allows any user to view the configuration of any module and the other could allow an attacker to lock out a valid user by sending an...
Webmin Server Detection (deprecated)
Binary data 1452.prm...
CVE-2004-0583
The account lockout functionality in 1 Webmin 1.140 and 2 Usermin 1.070 does not parse certain character strings, which allows remote attackers to conduct a brute force attack to guess user IDs and passwords...
CVE-2004-0583
The account lockout functionality in 1 Webmin 1.140 and 2 Usermin 1.070 does not parse certain character strings, which allows remote attackers to conduct a brute force attack to guess user IDs and passwords...
CVE-2004-0582
Unknown vulnerability in Webmin 1.140 allows remote attackers to bypass access control rules and gain read access to configuration information for a module...
Mandrake Linux Security Advisory : webmin (MDKSA-2004:074)
Unknown vulnerability in Webmin 1.140 allows remote attackers to bypass access control rules and gain read access to configuration information for a module. CVE-2004-0582 The account lockout functionality in Webmin 1.140 does not parse certain character strings, which allows remote attackers to...
Mandrake Linux Security Advisory : webmin (MDKSA-2002:033)
A vulnerability exists in all versions of Webmin prior to 0.970 that allows a remote attacker to login to Webmin as any user. All users of Webmin are encouraged to upgrade immediately. Users of Mandrake Linux 8.0 and earlier will need to install some additional perl modules for this new version o...
Mandrake Linux Security Advisory : webmin (MDKSA-2003:025)
A vulnerability was discovered in webmin by Cintia M. Imanishi, in the miniserv.pl program, which is the core server of webmin. This vulnerability allows an attacker to spoof a session ID by including special metacharacters in the BASE64 encoding string used during the authentication process. Thi...
Mandrake Linux Security Advisory : webmin (MDKSA-2001:059)
Recently, Caldera found that when webmin starts a system daemon from the web frontend it does not clear its environment variables. Since these variables contain the authorization of the administrator, any daemon would also get these variables. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...
[SECURITY] [DSA 526-1] New webmin packages fix multiple vulnerabilities
-------------------------------------------------------------------------- Debian Security Advisory DSA 526-1 [email protected] http://www.debian.org/security/ Matt Zimmerman July 3rd, 2004 http://www.debian.org/security/faq -...
DSA-526 webmin - several vulnerabilities
Bulletin has no description...
CVE-2004-0582
CVE-2004-0582 refers to an unknown vulnerability in Webmin 1.140 that allows remote attackers to bypass access control and gain read access to configuration information for a module. The vulnerability is mapped to a CVSS v2 base score of 5.0 (AV:N/AC:L/Au:N/C:P/I:N/A:N), indicating network-based ...
CVE-2004-0583
The account lockout functionality in 1 Webmin 1.140 and 2 Usermin 1.070 does not parse certain character strings, which allows remote attackers to conduct a brute force attack to guess user IDs and passwords...
CVE-2004-0582
Unknown vulnerability in Webmin 1.140 allows remote attackers to bypass access control rules and gain read access to configuration information for a module...
CVE-2004-0583
The CVE-2004-0583 entry concerns Webmin 1.140 and Usermin 1.070 where the account lockout function fails to parse certain character strings, enabling remote brute-force attempts to guess user IDs and passwords. Root cause: input parsing flaw in the account lockout logic. Impact is limited to unau...