{"enchantments": {"score": {"value": 4.9, "vector": "NONE", "modified": "2017-04-28T13:20:11", "rev": 2}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2004-1862"]}, {"type": "osvdb", "idList": ["OSVDB:14983", "OSVDB:14988", "OSVDB:14987", "OSVDB:14985"]}], "modified": "2017-04-28T13:20:11", "rev": 2}, "vulnersScore": 4.9}, "bulletinFamily": "software", "affectedSoftware": [{"name": "XMB Forum", "operator": "eq", "version": "1.8-SP3 (Partaguim)"}, {"name": "XMB Forum", "operator": "eq", "version": "1.9-Beta (Nexus)"}], "references": [], "href": "https://vulners.com/osvdb/OSVDB:14986", "id": "OSVDB:14986", "title": "XMB Forum stats.php Multiple Variable XSS", "type": "osvdb", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}, "lastseen": "2017-04-28T13:20:11", "edition": 1, "reporter": "Janek Vind \"waraxe\"(come2waraxe@yahoo.com)", "description": "## Vulnerability Description\nXMB Forum contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate user supplied arguments upon submission to the stats.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.\n## Solution Description\nUpgrade to version 1.9.1 Final or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.\n## Short Description\nXMB Forum contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate user supplied arguments upon submission to the stats.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.\n## Manual Testing Notes\nhttp://[victim]/xmb19beta/stats.php?action=view&viewmost=\"></textarea><body%20onload=alert(document.cookie);>\nhttp://[victim]/xmb19beta/stats.php?action=view&replymost=\"></textarea><body%20onload=alert(document.cookie);>\nhttp://[victim]/xmb19beta/stats.php?action=view&latest=\"></textarea><body%20onload=alert(document.cookie);>\n## References:\nVendor URL: http://www.xmbforum.com/\n[Secunia Advisory ID:11230](https://secuniaresearch.flexerasoftware.com/advisories/11230/)\n[Related OSVDB ID: 14983](https://vulners.com/osvdb/OSVDB:14983)\n[Related OSVDB ID: 14984](https://vulners.com/osvdb/OSVDB:14984)\n[Related OSVDB ID: 14982](https://vulners.com/osvdb/OSVDB:14982)\n[Related OSVDB ID: 14985](https://vulners.com/osvdb/OSVDB:14985)\n[Related OSVDB ID: 14988](https://vulners.com/osvdb/OSVDB:14988)\n[Related OSVDB ID: 14991](https://vulners.com/osvdb/OSVDB:14991)\n[Related OSVDB ID: 4643](https://vulners.com/osvdb/OSVDB:4643)\n[Related OSVDB ID: 14987](https://vulners.com/osvdb/OSVDB:14987)\n[Related OSVDB ID: 14989](https://vulners.com/osvdb/OSVDB:14989)\n[Related OSVDB ID: 14990](https://vulners.com/osvdb/OSVDB:14990)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2004-03/0265.html\nKeyword: waraxe-2004-SA#012\n[CVE-2004-1862](https://vulners.com/cve/CVE-2004-1862)\n", "modified": "2004-03-26T09:21:15", "viewCount": 1, "published": "2004-03-26T09:21:15", "cvelist": ["CVE-2004-1862"]}

{"cve": [{"lastseen": "2021-02-02T05:23:00", "description": "Multiple cross-site scripting (XSS) vulnerabilities in Extreme Messageboard (XMB) 1.8 SP3 and 1.9 beta allow remote attackers to inject arbitrary web script or HTML via the (1) xmbuser parameter to xmb.php, (2) folder parameter to u2u.php, (3) viewmost, replymost, or latest parameter to stats.php, (4) message or icons parameter to post.php, (5) threadlist, pagelinks, forumlist, navigation, or (6) forumdisplay parameter to forumdisplay.php.", "edition": 4, "cvss3": {}, "published": "2004-03-26T05:00:00", "title": "CVE-2004-1862", "type": "cve", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2004-1862"], "modified": "2017-07-11T01:31:00", "cpe": ["cpe:/a:xmb_forum:xmb:1.9_beta", "cpe:/a:xmb_forum:xmb:1.8_sp3"], "id": "CVE-2004-1862", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2004-1862", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cpe23": ["cpe:2.3:a:xmb_forum:xmb:1.9_beta:*:*:*:*:*:*:*", "cpe:2.3:a:xmb_forum:xmb:1.8_sp3:*:*:*:*:*:*:*"]}], "osvdb": [{"lastseen": "2017-04-28T13:20:11", "bulletinFamily": "software", "cvelist": ["CVE-2004-1862"], "edition": 1, "description": "## Vulnerability Description\nXMB Forum contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'folder' variable upon submission to the u2u.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.\n## Solution Description\nUpgrade to version 1.9.1 Final or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.\n## Short Description\nXMB Forum contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'folder' variable upon submission to the u2u.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.\n## Manual Testing Notes\nhttp://[victim]/xmb19beta/u2u.php?folder=foobar\"><body%20onload=alert(document.cookie);>\n## References:\nVendor URL: http://www.xmbforum.com/\n[Secunia Advisory ID:11230](https://secuniaresearch.flexerasoftware.com/advisories/11230/)\n[Related OSVDB ID: 14983](https://vulners.com/osvdb/OSVDB:14983)\n[Related OSVDB ID: 14984](https://vulners.com/osvdb/OSVDB:14984)\n[Related OSVDB ID: 14982](https://vulners.com/osvdb/OSVDB:14982)\n[Related OSVDB ID: 14988](https://vulners.com/osvdb/OSVDB:14988)\n[Related OSVDB ID: 14991](https://vulners.com/osvdb/OSVDB:14991)\n[Related OSVDB ID: 4643](https://vulners.com/osvdb/OSVDB:4643)\n[Related OSVDB ID: 14986](https://vulners.com/osvdb/OSVDB:14986)\n[Related OSVDB ID: 14987](https://vulners.com/osvdb/OSVDB:14987)\n[Related OSVDB ID: 14989](https://vulners.com/osvdb/OSVDB:14989)\n[Related OSVDB ID: 14990](https://vulners.com/osvdb/OSVDB:14990)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2004-03/0265.html\nKeyword: waraxe-2004-SA#012\n[CVE-2004-1862](https://vulners.com/cve/CVE-2004-1862)\n", "modified": "2004-03-26T09:21:15", "published": "2004-03-26T09:21:15", "href": "https://vulners.com/osvdb/OSVDB:14985", "id": "OSVDB:14985", "title": "XMB Forum u2u.php folder Variable XSS", "type": "osvdb", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}, {"lastseen": "2017-04-28T13:20:11", "bulletinFamily": "software", "cvelist": ["CVE-2004-1862"], "edition": 1, "description": "## Vulnerability Description\nXMB Forum contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'message' or 'icons' variables upon submission to the post.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.\n## Solution Description\nUpgrade to version 1.9.1 Final or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.\n## Short Description\nXMB Forum contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'message' or 'icons' variables upon submission to the post.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.\n## Manual Testing Notes\nhttp://[victim]/xmb19beta/post.php?action=newthread&fid=1&message=\"></textarea><body%20onload=alert(document.cookie);>\nhttp://[victim]/xmb19beta/post.php?action=newthread&fid=1&icons=<body%20onload=alert(document.cookie);>\n## References:\nVendor URL: http://www.xmbforum.com/\n[Secunia Advisory ID:11230](https://secuniaresearch.flexerasoftware.com/advisories/11230/)\n[Related OSVDB ID: 14983](https://vulners.com/osvdb/OSVDB:14983)\n[Related OSVDB ID: 14984](https://vulners.com/osvdb/OSVDB:14984)\n[Related OSVDB ID: 14982](https://vulners.com/osvdb/OSVDB:14982)\n[Related OSVDB ID: 14985](https://vulners.com/osvdb/OSVDB:14985)\n[Related OSVDB ID: 14988](https://vulners.com/osvdb/OSVDB:14988)\n[Related OSVDB ID: 14991](https://vulners.com/osvdb/OSVDB:14991)\n[Related OSVDB ID: 4643](https://vulners.com/osvdb/OSVDB:4643)\n[Related OSVDB ID: 14986](https://vulners.com/osvdb/OSVDB:14986)\n[Related OSVDB ID: 14989](https://vulners.com/osvdb/OSVDB:14989)\n[Related OSVDB ID: 14990](https://vulners.com/osvdb/OSVDB:14990)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2004-03/0265.html\nKeyword: waraxe-2004-SA#012\n[CVE-2004-1862](https://vulners.com/cve/CVE-2004-1862)\n", "modified": "2004-03-26T09:21:15", "published": "2004-03-26T09:21:15", "href": "https://vulners.com/osvdb/OSVDB:14987", "id": "OSVDB:14987", "title": "XMB Forum post.php Multiple Variable XSS", "type": "osvdb", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}, {"lastseen": "2017-04-28T13:20:11", "bulletinFamily": "software", "cvelist": ["CVE-2004-1862"], "edition": 1, "description": "## Vulnerability Description\nXMB Forum contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate multiple user supplied arguments upon submission to the forumdisplay.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.\n## Solution Description\nUpgrade to version 1.9.1 Final or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.\n## Short Description\nXMB Forum contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate multiple user supplied arguments upon submission to the forumdisplay.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.\n## Manual Testing Notes\nhttp://[victim]/xmb19beta/forumdisplay.php?fid=1&threadlist=<body%20onload=alert(document.cookie);>\nhttp://[victim]/xmb19beta/forumdisplay.php?fid=1&pagelinks=<body%20onload=alert(document.cookie);>\nhttp://[victim]/xmb19beta/forumdisplay.php?fid=1&forumlist=<body%20onload=alert(document.cookie);>\nhttp://[victim]/xmb19beta/forumdisplay.php?fid=1&navigation=<body%20onload=alert(document.cookie);>\nhttp://[victim]/xmb19beta/forumdisplay.php?fid=1&forumdisplay=<body%20onload=alert(document.cookie);>\n## References:\nVendor URL: http://www.xmbforum.com/\n[Secunia Advisory ID:11230](https://secuniaresearch.flexerasoftware.com/advisories/11230/)\n[Related OSVDB ID: 14983](https://vulners.com/osvdb/OSVDB:14983)\n[Related OSVDB ID: 14984](https://vulners.com/osvdb/OSVDB:14984)\n[Related OSVDB ID: 14982](https://vulners.com/osvdb/OSVDB:14982)\n[Related OSVDB ID: 14985](https://vulners.com/osvdb/OSVDB:14985)\n[Related OSVDB ID: 14991](https://vulners.com/osvdb/OSVDB:14991)\n[Related OSVDB ID: 4643](https://vulners.com/osvdb/OSVDB:4643)\n[Related OSVDB ID: 14986](https://vulners.com/osvdb/OSVDB:14986)\n[Related OSVDB ID: 14987](https://vulners.com/osvdb/OSVDB:14987)\n[Related OSVDB ID: 14989](https://vulners.com/osvdb/OSVDB:14989)\n[Related OSVDB ID: 14990](https://vulners.com/osvdb/OSVDB:14990)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2004-03/0265.html\nKeyword: waraxe-2004-SA#012\n[CVE-2004-1862](https://vulners.com/cve/CVE-2004-1862)\n", "modified": "2004-03-26T09:21:15", "published": "2004-03-26T09:21:15", "href": "https://vulners.com/osvdb/OSVDB:14988", "id": "OSVDB:14988", "title": "XMB Forum forumdisplay.php Multiple Variable XSS", "type": "osvdb", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}, {"lastseen": "2017-04-28T13:20:11", "bulletinFamily": "software", "cvelist": ["CVE-2004-1862"], "edition": 1, "description": "## Vulnerability Description\nXMB Forum contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'xmbuser' variable upon submission to the xmb.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.\n## Solution Description\nUpgrade to version 1.9.1 Final or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.\n## Short Description\nXMB Forum contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'xmbuser' variable upon submission to the xmb.php script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.\n## Manual Testing Notes\nhttp://[victim]/xmb19beta/xmb.php?show=version&xmbuser=foobar><body onload=alert(document.cookie);>\n## References:\nVendor URL: http://www.xmbforum.com/\n[Secunia Advisory ID:11230](https://secuniaresearch.flexerasoftware.com/advisories/11230/)\n[Related OSVDB ID: 14984](https://vulners.com/osvdb/OSVDB:14984)\n[Related OSVDB ID: 14982](https://vulners.com/osvdb/OSVDB:14982)\n[Related OSVDB ID: 14985](https://vulners.com/osvdb/OSVDB:14985)\n[Related OSVDB ID: 14988](https://vulners.com/osvdb/OSVDB:14988)\n[Related OSVDB ID: 14991](https://vulners.com/osvdb/OSVDB:14991)\n[Related OSVDB ID: 4643](https://vulners.com/osvdb/OSVDB:4643)\n[Related OSVDB ID: 14986](https://vulners.com/osvdb/OSVDB:14986)\n[Related OSVDB ID: 14987](https://vulners.com/osvdb/OSVDB:14987)\n[Related OSVDB ID: 14989](https://vulners.com/osvdb/OSVDB:14989)\n[Related OSVDB ID: 14990](https://vulners.com/osvdb/OSVDB:14990)\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2004-03/0265.html\nKeyword: waraxe-2004-SA#012\n[CVE-2004-1862](https://vulners.com/cve/CVE-2004-1862)\n", "modified": "2004-03-26T09:21:15", "published": "2004-03-26T09:21:15", "href": "https://vulners.com/osvdb/OSVDB:14983", "id": "OSVDB:14983", "title": "XMB Forum xmb.php xmbuser Variable XSS", "type": "osvdb", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:PARTIAL/A:NONE/"}}]}