305 matches found
Unrestricted file upload
Unrestricted file upload vulnerability in the avatar upload functionality in Simple Machines Forum before 2.0.6 and 2.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecifie...
CVE-2013-4465
Unrestricted file upload vulnerability in the avatar upload functionality in Simple Machines Forum before 2.0.6 and 2.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecifie...
Simple Machines Forum 2.0.3 File Disclosure
Summary: -------------- A security flaw allows an attacker to know the full source file of the web system. Details: ----------- Sources/ManageErrors.php Line 340: // Make sure the file we are looking for is one they are allowed to look at if !isreadable$file || strpos$file, '../' !== false &&...
Simple Machines Forum 2.0.3 Path Disclosure
Summary: -------------- A security flaw allows an attacker to know the full path of the web system. Details: ----------- SSI.php Line 294: // Fetch a post with a particular ID. By default will only show if you have permission to the see the board in question - this can be overriden. function...
CVE-2012-5903
Cross-site scripting XSS vulnerability in Simple Machines Forum SMF 2.0.2 allows remote attackers to inject arbitrary web script or HTML via the scheduled parameter to index.php...
CVE-2012-5903
Cross-site scripting XSS vulnerability in Simple Machines Forum SMF 2.0.2 allows remote attackers to inject arbitrary web script or HTML via the scheduled parameter to index.php...
Smf 2.0.2 Cross-Site Scripting Vulnerability
a bug in Smf 2.0.2 that allows to us to occur a Cross-Site Scripting on a Remote machin. Exploit Title : Smf 2.0.2 Cross-Site Scripting Vulnerability Author : IrIsT.Ir Discovered By : Am!r Home : http://IrIsT.Ir/forum/ Software Link : http://www.simplemachines.org Security Risk : High Version : A...
Simple Machines Forum (SMF) 1.1.15 - fckeditor Arbitrary File Upload
Simple Machines Forum SMF 1.1.15 - fckeditor Arbitrary File Upload source: https://www.securityfocus.com/bid/50925/info Simple Machines Forum is prone to an arbitrary-file-upload vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to upload...
Simple Machines Forum (SMF) 1.1.15 - 'fckeditor' Arbitrary File Upload
source: https://www.securityfocus.com/bid/50925/info Simple Machines Forum is prone to an arbitrary-file-upload vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in...
CVE-2011-4173
Cross-site request forgery CSRF vulnerability in Simple Machines Forum SMF 2.x before 2.0.1 allows remote attackers to hijack the authentication of administrators or moderators via vectors involving image files, a different vulnerability than CVE-2011-3615. NOTE: some of these details are obtaine...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in Simple Machines Forum SMF 2.x before 2.0.1 allows remote attackers to hijack the authentication of administrators or moderators via vectors involving image files, a different vulnerability than CVE-2011-3615. NOTE: some of these details are obtaine...
CVE-2011-4173
The data confirms CVE-2011-4173 is a CSRF vulnerability in Simple Machines Forum (SMF) 2.x prior to 2.0.1, enabling remote attackers to hijack administrator/moderator sessions via image-file related vectors. Affected product/component: SMF 2.x (before 2.0.1); root cause is a cross-site request fo...
CVE-2011-3615
Multiple SQL injection vulnerabilities in Simple Machines Forum SMF before 1.1.15 and 2.x before 2.0.1 allow remote attackers to execute arbitrary SQL commands via vectors involving a 1 HTML entity or 2 display name. NOTE: some of these details are obtained from third party information...
Sql injection
Multiple SQL injection vulnerabilities in Simple Machines Forum SMF before 1.1.15 and 2.x before 2.0.1 allow remote attackers to execute arbitrary SQL commands via vectors involving a 1 HTML entity or 2 display name. NOTE: some of these details are obtained from third party information...
CVE-2011-3615
Multiple SQL injection vulnerabilities in Simple Machines Forum SMF before 1.1.15 and 2.x before 2.0.1 allow remote attackers to execute arbitrary SQL commands via vectors involving a 1 HTML entity or 2 display name. NOTE: some of these details are obtained from third party information...
CVE-2011-3615
CVE-2011-3615 affects Simple Machines Forum (SMF). Remote attackers can exploit multiple SQL injection vulnerabilities via two vectors: (1) HTML entity handling and (2) display name processing. Affected software includes SMF versions before 1.1.15 and 2.x before 2.0.1. The underlying issue allows...
Simple Machines Forum (SMF) 2.0 Session Hijacking Vulnerability
Simple Machines Forum SMF is prone to session hijacking vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Simple Machines Forum (SMF) 1.1.14/2.0 - '[img]' BBCode Tag Cross-Site Request Forgery
source: https://www.securityfocus.com/bid/49311/info Simple Machines Forum is prone to a cross-site request-forgery vulnerability. Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application. Other attacks ar...
Simple Machine Forum v1.1.10 - Multiple Web Vulnerabilities
Document Title: =============== Simple Machine Forum v1.1.10 - Multiple Web Vulnerabilities References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=118 Release Date: ============= 2011-07-20 Vulnerability Laboratory ID VL-ID: ====================================...
