My Little Forum 2.3.3 Cross Site Scripting / SQL Injection

Advisory ID: HTB23248 Product: my little forum Vendor: http://mylittleforum.net/ Vulnerable Versions: 2.3.3 and probably prior Tested Version: 2.3.3 Advisory Publication: January 14, 2015 without technical details Vendor Notification: January 14, 2015 Vendor Patch: February 8, 2015 Public...

My Little Forum 2.3.3 Cross Site Scripting / SQL Injection Vulnerabilities

My Little Forum version 2.3.3 suffers from cross site scripting and remote SQL injection vulnerabilities. Product: my little forum Vendor: http://mylittleforum.net/ Vulnerable Versions: 2.3.3 and probably prior Tested Version: 2.3.3 Advisory Publication: January 14, 2015 without technical details...

Multiple Cross-Site Scripting Vulnerabilities in My Little Forum

My Little Forum is a simple WEB forum program. My Little Forum suffers from multiple cross-site scripting vulnerabilities that allow remote attackers to inject arbitrary web script or HTML via various parameters...

CVE-2015-1475

Multiple cross-site scripting XSS vulnerabilities in my little forum 2.3.3, 2.2, and 1.7 allow remote attackers to inject arbitrary web script or HTML via the 1 page or 2 category parameter to forum.php or the 3 page or 4 order parameter to a boardentry.php or b forumentry.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in my little forum 2.3.3, 2.2, and 1.7 allow remote attackers to inject arbitrary web script or HTML via the 1 page or 2 category parameter to forum.php or the 3 page or 4 order parameter to a boardentry.php or b forumentry.php...

CVE-2015-1475

My Little Forum (versions 2.3.3, 2.2, and 1.7) contains multiple cross-site scripting (XSS) vulnerabilities. An attacker can inject arbitrary script/HTML via (1) page or (2) category parameters to forum.php, or (3) page or (4) order parameters to board_entry.php or forum_entry.php. Public details...

CVE-2015-1475

Multiple cross-site scripting XSS vulnerabilities in my little forum 2.3.3, 2.2, and 1.7 allow remote attackers to inject arbitrary web script or HTML via the 1 page or 2 category parameter to forum.php or the 3 page or 4 order parameter to a boardentry.php or b forumentry.php...

phpBB CSS Injection Vulnerability

phpBB is phpBB group developed a set of open-source use of PHP language development of Web forum software . The software has support for multiple languages , support for multiple databases and customized layout and so on. A CSS injection vulnerability exists in phpBB, which arises from the...

My Little Forum 2.3.3 / 2.2 / 1.7 Cross Site Scripting

My Little Forum Multiple XSS Security Vulnerabilities Exploit Title: My Little Forum Multiple XSS Security Vulnerabilities Vendor: My Little Forum Product: My Little Forum Vulnerable Versions: 2.3.3 2.2 1.7 Tested Version: 2.3.3 2.2 1.7 Advisory Publication: Feb 2, 2015 Latest Update: Feb 2, 2015...

phpBB Cross-Site Request Forgery Vulnerability

phpBB is phpBB group developed a set of open-source use of PHP language development of Web forum software . The software has support for multiple languages , support for multiple databases and customized layout and so on. phpBB cross-site request forgery vulnerability allows attackers to exploit...

20 Million Credentials Stolen From Russian Dating Site 'Topface'

A database containing details of more than 20 Million users of a Russian-based online dating website has been allegedly stolen by a hacker and made publicly available for sale through an online forum. A hacker using the online alias "Mastermind" on an online forum used by cybercriminals claims th...

vBulletin vBSSO Single Sign-On 1.4.14 - SQL Injection

vBulletin vBSSO Single Sign-On 1.4.14 - SQL Injection Exploit Title: vBulletin vBSSO Single Sign-On – = 1.4.15 This plugin is vulnerable to SQL injection at the /vbsso/avatar.php file in the fetchUserinfo function. It requires a big UNION ALL SELECT query and commenting out the LIMIT function of...

CVE-2015-1058

Multiple cross-site scripting XSS vulnerabilities in AdaptCMS 3.0.3 allow remote attackers to inject arbitrary web script or HTML via the 1 dataCategorytitle parameter to admin/categories/add, 2 dataFieldtitle parameter to admin/fields/ajaxfields/, 3 name property in a basicInfo JSON object to...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in AdaptCMS 3.0.3 allow remote attackers to inject arbitrary web script or HTML via the 1 dataCategorytitle parameter to admin/categories/add, 2 dataFieldtitle parameter to admin/fields/ajaxfields/, 3 name property in a basicInfo JSON object to...

CVE-2015-1058

Multiple cross-site scripting XSS vulnerabilities in AdaptCMS 3.0.3 allow remote attackers to inject arbitrary web script or HTML via the 1 dataCategorytitle parameter to admin/categories/add, 2 dataFieldtitle parameter to admin/fields/ajaxfields/, 3 name property in a basicInfo JSON object to...

TR-0 6 9 auto configuration servers multiple vulnerabilities-vulnerability warning-the black bar safety net

Affected system: Broadband Forum TR-0 6 9 Description: -------------------------------------------------------------------------------- CVECAN ID: CVE-2 0 1 4-2 8 4 0,CVE-2 0 1 4-4 9 5 6,THE CVE-2 0 1 4-4 9 1 6,THE CVE-2 0 1 4-4 9 1 7,CVE-2 0 1 4-4 9 1 8,THE CVE-2 0 1 4-4 9 5 7 TR-0 6 9 is a DSL...

PHPOK过滤不当存在储存型xss漏洞

简要描述： 论坛bbs发帖那里。 版本：phpok4.2.100 详细说明： init.php function safehtml$info if!$info return false; $tmp = "//isU"; $info = pregreplace$tmp,"",$info; //$info = pregreplace"//isU","",$info; $tmp = array"//isU","//isU","//isU","//isU","//isU","//isU","//isU","//isU"; $info = pregreplace$tmp,'',$info;...

Google AdWords Campaigns Hijacked by Malvertisers

A malvertising scheme has hijacked at least two distinct Google AdWords advertising campaigns, redirecting users who had browsed to the sites hosting the poisoned ads without those visitors even clicking on them. Some of the sites in question service more than a million monthly users. Last week,...

CVE-2014-10030

CVE-2014-10030 : FluxBB contains an open redirect in forums/login.php. Versions prior to 1.4.13 and 1.5.x prior to 1.5.7 allow remote attackers to redirect users to arbitrary sites via the redirect_url parameter, enabling phishing-like redirections. No exploit details are provided in the document...

Vulnerability alert: well-known Forum system vBulletin commonly used SEO plugin VBSEO there is a serious security vulnerability-vulnerability warning-the black bar safety net

vBulletin team recently to all their customers warning of its plug-in VBSEO there was a serious security vulnerability. VBSEO for vBulletin and very popular third party seo modules, worst of VBSEO official already in the last year to stop updating this plug-in, that no one can exploit to provide...