Vendor
Webmin
24 known vulnerabilities.
Products
7 results · Clear filters · Feed
-
High 7.2
Webmin through 2.670 OS Command Injection via Samba User Account Options
Webmin through 2.670 contains an OS command injection vulnerability in samba/save_euser.cgi that allows authenticated Samba user maintainers to inject commands via unvalidated opts parameter. Attackers can embed shell metacharacters in account option flags pa…
-
High 8.8
Usermin through 2.570 Path Traversal File Write via detachall.cgi
Usermin through 2.570 contains a path traversal vulnerability in mailbox/detachall.cgi that allows remote unauthenticated attackers to write files outside the temporary directory via unsanitized attachment filenames. Attackers can email attachments with ../ s…
-
High 7.5
Usermin through 2.570 OS Command Injection via Read Mail IMAP Folder Deletion
Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated users to execute commands through unsanitized IMAP folder names. Attackers can create a folder containing shell metacharacters via an extern…
-
High 8.1
Webmin HTTP header authentication bypass
The Webmin HTTP server (miniserv.pl) allows unauthenticated attackers to impersonate any user with a configured SSL client certificate by sending a forged HTTP header. A remote attacker can spoof certificate DNs and authenticate as any user. Fixed in 2.202.
-
High 8.5
squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module …
-
High 8.8
Improper handling of insufficient permissions or privileges vulnerability exists in ajaxterm module of Webmin prior to …
-
High 8.3
Improper Access Control to Remote Code Execution in webmin/webmin
Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990.