Adem El Adeb

**Name of the Vulnerable Software and Affected Versions** Webmin versions prior to 2.641 **Description** The Webmin HTTP server (miniserv.pl) improperly trusts a client-supplied HTTP header for SSL client certificate identity. This allows unauthenticated remote attackers to spoof certificate distinguished names (DNs)—the unique identifiers used in digital certificates—by sending a forged HTTP header. Consequently, an attacker can impersonate any user with a configured SSL client certificate without presenting a valid certificate, leading to a remote authentication bypass and potential full takeover of administrative accounts and managed systems. **Recommendations** Upgrade to version 2.641.

**Name of the Vulnerable Software and Affected Versions** Webmin (affected versions not specified) **Description** Unauthenticated attackers can read the contents of any file ending in .conf within module directories. This is caused by a bypassable regex pattern, which is a sequence of characters used to find or match specific patterns in text. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Webmin versions prior to 2.641 **Description** Webmin accepts basic authentication without session cookies when an attacker provides the 'User-Agent: webmin' header. This behavior allows the bypass of additional multi-factor authentication (MFA) requirements. There have been reports of increased actor activities targeting this issue. **Recommendations** Update to version 2.641.

**Name of the Vulnerable Software and Affected Versions** InSAT MasterSCADA BUK-TS (affected versions not specified) **Description** InSAT MasterSCADA BUK-TS is susceptible to SQL Injection through its main web interface. Successful exploitation allows malicious users to potentially cause remote code execution. The issue does not require any privileges or user interaction and has a high impact on confidentiality, integrity, and availability. The vulnerable endpoint allows for this exploitation. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** InSAT MasterSCADA BUK-TS (affected versions not specified) **Description** All versions of InSAT MasterSCADA BUK-TS are susceptible to OS command injection through a field in its `MMadmServ` web interface. This flaw enables an attacker to execute arbitrary system commands remotely, potentially leading to full system compromise. The vulnerable component is the `MMadmServ` web interface. The vulnerability allows attackers to inject commands through a specific field. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.