Usermin

Webmin before 1.296 and Usermin before 1.226 do not properly handle a URL with a null ("%00") character, which allows remote attackers to conduct cross-site scripting (XSS), read CGI program source code, list directories, and possibly execute programs.

Published: 2006-09-05T23:00:00.000Z
Updated: 2024-08-07T19:14:47.503Z

Usermin before 1.220 (20060629) allows remote attackers to read arbitrary files, possibly related to chfn/save.cgi not properly handling an empty shell parameter, which results in changing root's shell instead of the shell of a specified user.

Published: 2006-09-19T18:00:00.000Z
Updated: 2024-08-07T19:06:07.026Z

Unknown vulnerability in (1) Webmin and (2) Usermin before 1.200 causes Webmin to change permissions and ownership of configuration files, with unknown impact.

Published: 2005-04-19T04:00:00.000Z
Updated: 2024-08-07T21:44:05.268Z

miniserv.pl in (1) Webmin before 1.070 and (2) Usermin before 1.000 does not properly handle metacharacters such as line feeds and carriage returns (CRLF) in Base-64 encoded strings during Basic authentication, which allows remote attackers to spoof a session ID and gain root privileges.

Published: 2003-02-26T05:00:00.000Z
Updated: 2024-08-08T01:43:35.586Z

(1) Webmin 0.96 and (2) Usermin 0.90 with password timeouts enabled allow local and possibly remote attackers to bypass authentication and gain privileges via certain control characters in the authentication information, which can force Webmin or Usermin to accept arbitrary username/session ID combinations.

Published: 2002-07-26T04:00:00.000Z
Updated: 2024-08-08T03:03:47.946Z