Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
131 results · page 2 of 3
Apr 11, 2022A Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 through the File Manager feature.CVE-2021-32162 · Other software · Webmin · reported by MITREHigh 8.8
A Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 through the File Manager feature.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2022A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the File Manager feature.CVE-2021-32161 · Other software · Webmin · reported by MITREMedium 6.1
A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the File Manager feature.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2022A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the Add Users feature.CVE-2021-32160 · Other software · Webmin · reported by MITREMedium 6.1
A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the Add Users feature.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2022A Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Upload and Download feature.CVE-2021-32159 · Other software · Webmin · reported by MITREHigh 8.8
A Cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Upload and Download feature.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2022A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Upload and Download feature.CVE-2021-32158 · Other software · Webmin · reported by MITREMedium 6.1
A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Upload and Download feature.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2022A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature.CVE-2021-32157 · Other software · Webmin · reported by MITRECritical 9.6
A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 11, 2022A cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature.CVE-2021-32156 · Other software · Webmin · reported by MITREHigh 8.8
A cross-site request forgery (CSRF) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2022Improper Authorization in GitHub repository webmin/webmin prior to 1.990.CVE-2022-0829 · Other software · webmin · reported by security@huntr.devHigh 8.1
Improper Authorization in GitHub repository webmin/webmin prior to 1.990.
- Product
- webmin/webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2022Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990.CVE-2022-0824 · Other software · webmin · reported by security@huntr.devHigh 8.8
Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990.
- Product
- webmin/webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.compacketstormsecurity.com
Apr 25, 2021Webmin 1.973 is affected by Cross Site Request Forgery (CSRF) to create a privileged user through Webmin's add users feature, and then get a reverse shell throuCVE-2021-31762 · Other software · Webmin · reported by MITREHigh 8.8
Webmin 1.973 is affected by Cross Site Request Forgery (CSRF) to create a privileged user through Webmin's add users feature, and then get a reverse shell through Webmin's running process feature.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Apr 25, 2021Webmin 1.973 is affected by reflected Cross Site Scripting (XSS) to achieve Remote Command Execution through Webmin's running process feature.CVE-2021-31761 · Other software · Webmin · reported by MITRECritical 9.6
Webmin 1.973 is affected by reflected Cross Site Scripting (XSS) to achieve Remote Command Execution through Webmin's running process feature.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Apr 25, 2021Webmin 1.973 is affected by Cross Site Request Forgery (CSRF) to achieve Remote Command Execution (RCE) through Webmin's running process feature.CVE-2021-31760 · Other software · Webmin · reported by MITREHigh 8.8
Webmin 1.973 is affected by Cross Site Request Forgery (CSRF) to achieve Remote Command Execution (RCE) through Webmin's running process feature.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 21, 2021On Netshield NANO 25 10.2.18 devices, /usr/local/webmin/System/manual_ping.cgi allows OS command injection (after authentication by the attacker) because the syCVE-2021-3149 · Other software · Netshieldcorp · reported by MITREHigh 7.2
On Netshield NANO 25 10.2.18 devices, /usr/local/webmin/System/manual_ping.cgi allows OS command injection (after authentication by the attacker) because the system C library function is used unsafely.
- Product
- Nano 25 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkc.mcafee.comdigitaldefense.com
Dec 29, 2020miniserv.pl in Webmin 1.962 on Windows mishandles special characters in query arguments to the CGI program.CVE-2020-35769 · Other software · Webmin · reported by MITRECritical 9.8
miniserv.pl in Webmin 1.962 on Windows mishandles special characters in query arguments to the CGI program.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvigilance.fr
Dec 21, 2020Arbitrary command execution can occur in Webmin through 1.962.CVE-2020-35606 · Other software · Webmin · reported by MITREHigh 8.8
Arbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can execute arbitrary commands with root privileges via vectors involving %0A and %0C. NOTE: this issue exists because of an incomplete fix for CVE-2019-12840.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Oct 12, 2020An Improper Data Validation Vulnerability exists in Webmin 1.941 and earlier affecting the Command Shell Endpoint.CVE-2020-8821 · Other software · Webmin · reported by MITREMedium 5.4
An Improper Data Validation Vulnerability exists in Webmin 1.941 and earlier affecting the Command Shell Endpoint. A user may enter HTML code into the Command field and submit it. Then, after visiting the Action Logs Menu and displaying logs, the HTML code will be rendered (however, JavaScript is not executed). Changes are kept across users.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2020An XSS Vulnerability exists in Webmin 1.941 and earlier affecting the Cluster Shell Commands Endpoint.CVE-2020-8820 · Other software · Webmin · reported by MITREMedium 5.4
An XSS Vulnerability exists in Webmin 1.941 and earlier affecting the Cluster Shell Commands Endpoint. A user may enter any XSS Payload into the Command field and execute it. Then, after revisiting the Cluster Shell Commands Menu, the XSS Payload will be rendered and executed.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2020XSS exists in Webmin 1.941 and earlier affecting the Save function of the Read User Email Module / mailboxes Endpoint when attempting to save HTML emails.CVE-2020-12670 · Other software · Webmin · reported by MITREMedium 6.1
XSS exists in Webmin 1.941 and earlier affecting the Save function of the Read User Email Module / mailboxes Endpoint when attempting to save HTML emails. This module parses any output without sanitizing SCRIPT elements, as opposed to the View function, which sanitizes the input correctly. A malicious user can send any JavaScript payload into the message body and execute it if the user decides to save that email.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 26, 2019rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialise_variable makes an eval call.CVE-2019-15642 · Other software · Webmin · reported by MITREHigh 8.8
rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialise_variable makes an eval call. NOTE: the Webmin_Servers_Index documentation states "RPC can be used to run any command or modify any file on a server, which is why access to it must not be granted to un-trusted Webmin users."
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddoxfer.webmin.comgithub.com
Aug 26, 2019xmlrpc.cgi in Webmin through 1.930 allows authenticated XXE attacks.CVE-2019-15641 · Other software · Webmin · reported by MITREMedium 6.5
xmlrpc.cgi in Webmin through 1.930 allows authenticated XXE attacks. By default, only root, admin, and sysadm can access xmlrpc.cgi.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2019Webmin Command Injection VulnerabilityCVE-2019-15107 · Other software · Webmin · reported by MITREExploitedRansomwareCritical 9.8
An issue was discovered in Webmin. The parameter old in password_change.cgi contains a command injection vulnerability.
- Product
- Webmin
- On CISA’s list since
- Mar 25, 2022 (federal fix deadline Apr 15, 2022)
- What to do
- Attackers are using this now. Install Webmin’s update today (ransomware groups use this one). If there is no update for your version, take the product off the internet or stop using it until there is.
Full record and what to do →NVD recordCISA catalogpacketstormsecurity.compacketstormsecurity.com
Jun 15, 2019In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root privileges via the data parameter to updatCVE-2019-12840 · Other software · Webmin · reported by MITREHigh 8.8
In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root privileges via the data parameter to update.cgi.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comsecurityfocus.com
Mar 21, 2019Webmin 1.890 has XSS via /config.cgi?webmin, the /shell/index.cgi history parameter, /shell/index.cgi?stripped=1, or the /webminlog/search.cgi uall or mall paraCVE-2018-19191 · Other software · Webmin · reported by MITREMedium 5.4
Webmin 1.890 has XSS via /config.cgi?webmin, the /shell/index.cgi history parameter, /shell/index.cgi?stripped=1, or the /webminlog/search.cgi uall or mall parameter.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comwebmin.com
Mar 7, 2019Webmin 1.900 allows remote attackers to execute arbitrary code by leveraging the "Java file manager" and "Upload and Download" privileges to upload a crafted .cCVE-2019-9624 · Other software · Webmin · reported by MITREHigh 7.8
Webmin 1.900 allows remote attackers to execute arbitrary code by leveraging the "Java file manager" and "Upload and Download" privileges to upload a crafted .cgi file via the /updown/upload.cgi URI.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrapid7.compentest.com.tr
Oct 10, 2018Virtualmin 6.03 allows XSS via the query string, as demonstrated by the webmin_search.cgi URI.CVE-2018-18208 · Other software · Virtualmin · reported by MITREMedium 6.1
Virtualmin 6.03 allows XSS via the query string, as demonstrated by the webmin_search.cgi URI.
- Product
- Virtualmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2018An issue was discovered in Webmin 1.840 and 1.880 when the default Yes setting of "Can view any file as a log file" is enabled.CVE-2018-8712 · Other software · Webmin · reported by MITRECritical 9.8
An issue was discovered in Webmin 1.840 and 1.880 when the default Yes setting of "Can view any file as a log file" is enabled. As a result of weak default configuration settings, limited users have full access rights to the underlying Unix system files, allowing the user to read sensitive data from the local system (using Local File Include) such as the '/etc/shadow' file via a "GET /syslog/save_log.cgi?view=1&file=/etc/shadow" request.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record7elements.co.uk7elements.co.uk
Feb 22, 2018Backup Download exists in the Proclaim 9.1.1 component for Joomla! via a direct request for a .sql file under backup/.CVE-2018-7317 · Other software · Christianwebministries · reported by MITREHigh 7.5
Backup Download exists in the Proclaim 9.1.1 component for Joomla! via a direct request for a .sql file under backup/.
- Product
- Proclaim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Feb 22, 2018Arbitrary File Upload exists in the Proclaim 9.1.1 component for Joomla! via a mediafileform action.CVE-2018-7316 · Other software · Christianwebministries · reported by MITRECritical 9.8
Arbitrary File Upload exists in the Proclaim 9.1.1 component for Joomla! via a mediafileform action.
- Product
- Proclaim
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comexploit-db.com
Dec 30, 2017custom/run.cgi in Webmin before 1.870 allows remote authenticated administrators to conduct XSS attacks via the description field in the custom command functionCVE-2017-17089 · Other software · Webmin · reported by MITREMedium 4.8
custom/run.cgi in Webmin before 1.870 allows remote authenticated administrators to conduct XSS attacks via the description field in the custom command functionality.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comgithub.com
Oct 19, 2017Webmin before 1.860 has XSS with resultant remote code execution.CVE-2017-15646 · Other software · Webmin · reported by MITREMedium 6.1
Webmin before 1.860 has XSS with resultant remote code execution. Under the 'Others/File Manager' menu, there is a 'Download from remote URL' option to download a file from a remote server. After setting up a malicious server, one can wait for a file download request and then send an XSS payload that will lead to Remote Code Execution, as demonstrated by an OS command in the value attribute of a name='cmd' input element.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2017CSRF exists in Webmin 1.850.CVE-2017-15645 · Other software · Webmin · reported by MITREHigh 8.8
CSRF exists in Webmin 1.850. By sending a GET request to at/create_job.cgi containing dir=/&cmd= in the URI, an attacker to execute arbitrary commands.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2017SSRF exists in Webmin 1.850 via the PATH_INFO to tunnel/link.cgi, as demonstrated by a GET request for tunnel/link.cgi/http://INTRANET-IP:8000.CVE-2017-15644 · Other software · Webmin · reported by MITREHigh 8.6
SSRF exists in Webmin 1.850 via the PATH_INFO to tunnel/link.cgi, as demonstrated by a GET request for tunnel/link.cgi/http://INTRANET-IP:8000.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 3, 2017Multiple Cross-site scripting (XSS) vulnerabilities in Webmin before 1.850 allow remote attackers to inject arbitrary web script or HTML via the sec parameter tCVE-2017-9313 · Other software · Webmin · reported by MITREMedium 6.1
Multiple Cross-site scripting (XSS) vulnerabilities in Webmin before 1.850 allow remote attackers to inject arbitrary web script or HTML via the sec parameter to view_man.cgi, the referers parameter to change_referers.cgi, or the name parameter to save_user.cgi. NOTE: these issues were not fixed in 1.840.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgsecurityfocus.com
Apr 28, 2017Multiple cross-site scripting vulnerabilities in Webmin versions prior to 1.830 allows remote attackers to inject arbitrary web script or HTML via unspecified vCVE-2017-2106 · Other software · Webmin · reported by vultures@jpcert.or.jpMedium 6.1
Multiple cross-site scripting vulnerabilities in Webmin versions prior to 1.830 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsecurityfocus.com
Apr 12, 2017Multiple cross-site scripting (XSS) vulnerabilities in (1) filter/save_forward.cgi, (2) filter/save.cgi, (3) /man/search.cgi in Usermin before 1.690.CVE-2016-4897 · Other software · Webmin · reported by vultures@jpcert.or.jpMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in (1) filter/save_forward.cgi, (2) filter/save.cgi, (3) /man/search.cgi in Usermin before 1.690.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2015The xmlrpc.cgi Webmin script in IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitraCVE-2015-2011 · Other software · IBM · reported by psirt@us.ibm.comHigh 9
The xmlrpc.cgi Webmin script in IBM QRadar SIEM 7.1 MR2 before Patch 11 IF02 and 7.2.x before 7.2.5 Patch 4 allows remote authenticated users to execute arbitrary commands with root privileges via unspecified vectors.
- Product
- Qradar Security Information And Event Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwww-01.ibm.comwww-01.ibm.com
Feb 10, 2015The Read Mail module in Webmin 1.720 allows local users to read arbitrary files via a symlink attack on an unspecified file.CVE-2015-1377 · Other software · Webmin · reported by MITREMedium 4.9
The Read Mail module in Webmin 1.720 allows local users to read arbitrary files via a symlink attack on an unspecified file.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2014Cross-site scripting (XSS) vulnerability in Webmin before 1.690, when referrer checking is disabled, allows remote attackers to inject arbitrary web script or HCVE-2014-3886 · Other software · Webmin · reported by vultures@jpcert.or.jpLow 2.6
Cross-site scripting (XSS) vulnerability in Webmin before 1.690, when referrer checking is disabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: this might overlap CVE-2014-3924.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2014Cross-site scripting (XSS) vulnerability in Webmin before 1.690 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectorsCVE-2014-3885 · Other software · Webmin · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site scripting (XSS) vulnerability in Webmin before 1.690 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. NOTE: this might overlap CVE-2014-3924.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 20, 2014Cross-site scripting (XSS) vulnerability in Usermin before 1.600 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.CVE-2014-3884 · Other software · Webmin · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site scripting (XSS) vulnerability in Usermin before 1.600 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: this might overlap CVE-2014-3924.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 21, 2014Usermin before 1.600 allows remote attackers to execute arbitrary operating-system commands via unspecified vectors related to a user action.CVE-2014-3883 · Other software · Webmin · reported by vultures@jpcert.or.jpMedium 6.8
Usermin before 1.600 allows remote attackers to execute arbitrary operating-system commands via unspecified vectors related to a user action.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 30, 2014Multiple cross-site scripting (XSS) vulnerabilities in Webmin before 1.690 and Usermin before 1.600 allow remote attackers to inject arbitrary web script or HTMCVE-2014-3924 · Other software · Webmin · reported by MITREMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in Webmin before 1.690 and Usermin before 1.600 allow remote attackers to inject arbitrary web script or HTML via vectors related to popup windows.
- Product
- Userwin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecunia.com
Mar 16, 2014Cross-site scripting (XSS) vulnerability in view.cgi in Webmin before 1.680 allows remote attackers to inject arbitrary web script or HTML via the search parameCVE-2014-0339 · Other software · Webmin · reported by cret@cert.orgMedium 4.3
Cross-site scripting (XSS) vulnerability in view.cgi in Webmin before 1.680 allows remote attackers to inject arbitrary web script or HTML via the search parameter.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgwww-01.ibm.com
Sep 11, 2012Multiple cross-site request forgery (CSRF) vulnerabilities in file/show.cgi in Webmin 1.590 and earlier allow remote attackers to hijack the authentication of pCVE-2012-4893 · Other software · Gentoo · reported by MITREMedium 6.8
Multiple cross-site request forgery (CSRF) vulnerabilities in file/show.cgi in Webmin 1.590 and earlier allow remote attackers to hijack the authentication of privileged users for requests that (1) read files or execute (2) tar, (3) zip, or (4) gzip commands, a different issue than CVE-2012-2982.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordamericaninfosec.comamericaninfosec.com
Sep 11, 2012file/edit_html.cgi in Webmin 1.590 and earlier does not perform an authorization check before showing a file's unedited contents, which allows remote attackers CVE-2012-2983 · Other software · Gentoo · reported by cret@cert.orgMedium 5
file/edit_html.cgi in Webmin 1.590 and earlier does not perform an authorization check before showing a file's unedited contents, which allows remote attackers to read arbitrary files via the file field.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordamericaninfosec.comamericaninfosec.com
Sep 11, 2012file/show.cgi in Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary commands via an invalid character in a pathname, as demonstrateCVE-2012-2982 · Other software · Gentoo · reported by cret@cert.orgMedium 6.5
file/show.cgi in Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary commands via an invalid character in a pathname, as demonstrated by a | (pipe) character.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordamericaninfosec.comamericaninfosec.com
Sep 11, 2012Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary Perl code via a crafted file associated with the type (aka monitor type name) paCVE-2012-2981 · Other software · Gentoo · reported by cret@cert.orgMedium 6
Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary Perl code via a crafted file associated with the type (aka monitor type name) parameter.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordamericaninfosec.comamericaninfosec.com
May 31, 2011Cross-site scripting (XSS) vulnerability in Webmin 1.540 and earlier allows local users to inject arbitrary web script or HTML via a chfn command that changes tCVE-2011-1937 · Other software · Webmin · reported by Red HatMedium 4.3
Cross-site scripting (XSS) vulnerability in Webmin 1.540 and earlier allows local users to inject arbitrary web script or HTML via a chfn command that changes the real (aka Full Name) field, related to useradmin/index.cgi and useradmin/user-lib.pl.
- Product
- Webmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjavierb.com.aropenwall.com
Jan 5, 2010Cross-site scripting (XSS) vulnerability in Webmin before 1.500 and Usermin before 1.430 allows remote attackers to inject arbitrary web script or HTML via unspCVE-2009-4568 · Other software · Webmin · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Webmin before 1.500 and Usermin before 1.430 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Usermin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.commandriva.com
Dec 29, 2009Multiple unspecified vulnerabilities in the Vsftpd Webmin module before 1.3b for the Vsftpd server have unknown impact and attack vectors related to "Some securCVE-2009-4457 · Other software · Provider4u · reported by MITREHigh 7.5
Multiple unspecified vulnerabilities in the Vsftpd Webmin module before 1.3b for the Vsftpd server have unknown impact and attack vectors related to "Some security issues."
- Product
- Vsftpd Webmin Module
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfreshmeat.netosvdb.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.