1379 matches found
CVE-2021-31761
Webmin 1.973 is affected by reflected Cross Site Scripting XSS to achieve Remote Command Execution through Webmin's running process feature...
CVE-2021-32158
A Cross-Site Scripting XSS vulnerability exists in Webmin 1.973 via the Upload and Download feature...
CVE-2021-32159
A Cross-site request forgery CSRF vulnerability exists in Webmin 1.973 via the Upload and Download feature...
CVE-2021-32156
A cross-site request forgery CSRF vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature...
CVE-2021-32157
A Cross-Site Scripting XSS vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature...
CVE-2021-31762
Webmin 1.973 is affected by Cross Site Request Forgery CSRF to create a privileged user through Webmin's add users feature, and then get a reverse shell through Webmin's running process feature...
CVE-2021-3149
On Netshield NANO 25 10.2.18 devices, /usr/local/webmin/System/manualping.cgi allows OS command injection after authentication by the attacker because the system C library function is used unsafely...
CVE-2021-32161
A Cross-Site Scripting XSS vulnerability exists in Webmin 1.973 through the File Manager feature...
CVE-2021-32160
A Cross-Site Scripting XSS vulnerability exists in Webmin 1.973 through the Add Users feature...
CVE-2021-32162
A Cross-site request forgery CSRF vulnerability exists in Webmin 1.973 through the File Manager feature...
CVE-2020-35769
miniserv.pl in Webmin 1.962 on Windows mishandles special characters in query arguments to the CGI program...
CVE-2020-35606
Arbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can execute arbitrary commands with root privileges via vectors involving %0A and %0C. NOTE: this issue exists because of an incomplete fix for CVE-2019-12840...
CVE-2017-15646
Webmin before 1.860 has XSS with resultant remote code execution. Under the 'Others/File Manager' menu, there is a 'Download from remote URL' option to download a file from a remote server. After setting up a malicious server, one can wait for a file download request and then send an XSS payload...
CVE-2018-8712
An issue was discovered in Webmin 1.840 and 1.880 when the default Yes setting of "Can view any file as a log file" is enabled. As a result of weak default configuration settings, limited users have full access rights to the underlying Unix system files, allowing the user to read sensitive data...
CVE-2019-15641
xmlrpc.cgi in Webmin through 1.930 allows authenticated XXE attacks. By default, only root, admin, and sysadm can access xmlrpc.cgi...
CVE-2019-15107
An issue was discovered in Webmin =1.920. The parameter old in passwordchange.cgi contains a command injection vulnerability...
CVE-2017-15644
SSRF exists in Webmin 1.850 via the PATHINFO to tunnel/link.cgi, as demonstrated by a GET request for tunnel/link.cgi/http://INTRANET-IP:8000...
CVE-2019-15642
rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialisevariable makes an eval call. NOTE: the WebminServersIndex documentation states "RPC can be used to run any command or modify any file on a server, which is why access to it must...
CVE-2012-4893
Multiple cross-site request forgery CSRF vulnerabilities in file/show.cgi in Webmin 1.590 and earlier allow remote attackers to hijack the authentication of privileged users for requests that 1 read files or execute 2 tar, 3 zip, or 4 gzip commands, a different issue than CVE-2012-2982...