| Max CVSS | 10.0 | Min CVSS | 2.1 | Total Count | 2 |
| ID | CVSS | Summary | Last (major) update | Published | |
| CVE-2006-3392 | 5.0 |
Webmin before 1.290 and Usermin before 1.220 calls the simplify_path function before decoding HTML, which allows remote attackers to read arbitrary files, as demonstrated using "..%01" sequences, which bypass the removal of "../" sequences before byt
|
18-10-2018 - 16:47 | 06-07-2006 - 20:05 | |
| CVE-2006-3274 | 5.0 |
Directory traversal vulnerability in Webmin before 1.280, when run on Windows, allows remote attackers to read arbitrary files via \ (backslash) characters in the URL to certain directories under the web root, such as the image directory. Update to v
|
18-10-2018 - 16:46 | 28-06-2006 - 22:05 | |
| CVE-2005-1177 | 10.0 |
Unknown vulnerability in (1) Webmin and (2) Usermin before 1.200 causes Webmin to change permissions and ownership of configuration files, with unknown impact.
|
11-07-2017 - 01:32 | 02-05-2005 - 04:00 | |
| CVE-2002-1672 | 2.1 |
Webmin 0.92, when installed from an RPM, creates /var/webmin with insecure permissions (world readable), which could allow local users to read the root user's cookie-based authentication credentials and possibly hijack the root user's session using t
|
11-07-2017 - 01:29 | 31-12-2002 - 05:00 | |
| CVE-2014-0339 | 4.3 |
Cross-site scripting (XSS) vulnerability in view.cgi in Webmin before 1.680 allows remote attackers to inject arbitrary web script or HTML via the search parameter.
|
24-07-2015 - 18:35 | 16-03-2014 - 14:06 | |
| CVE-2015-1377 | 4.9 |
The Read Mail module in Webmin 1.720 allows local users to read arbitrary files via a symlink attack on an unspecified file.
|
11-02-2015 - 19:45 | 10-02-2015 - 20:59 | |
| CVE-2014-3924 | 4.3 |
Multiple cross-site scripting (XSS) vulnerabilities in Webmin before 1.690 and Usermin before 1.600 allow remote attackers to inject arbitrary web script or HTML via vectors related to popup windows.
|
17-07-2014 - 05:07 | 30-05-2014 - 14:55 | |
| CVE-2002-1947 | 6.4 |
Webmin 0.21 through 1.0 uses the same built-in SSL key for all installations, which allows remote attackers to eavesdrop or highjack the SSL session.
|
05-09-2008 - 20:31 | 31-12-2002 - 05:00 |