vBulletin 3.7.3 - Visitor Message Cross-Site Request Forgery Worm

vBulletin 3.7.3 - Visitor Message Cross-Site Request Forgery Worm / ----------------------------- Author = Mx Title = vBulletin 3.7.3 Visitor Messages XSS/XSRF + worm Software = vBulletin Addon = Visitor Messages Version = 3.7.3 Attack = XSS/XSRF - Description = A critical vulnerability exists in...

vBulletin 3.7.3 - Visitor Message Cross-Site Request Forgery / Worm

/ ----------------------------- Author = Mx Title = vBulletin 3.7.3 Visitor Messages XSS/XSRF + worm Software = vBulletin Addon = Visitor Messages Version = 3.7.3 Attack = XSS/XSRF - Description = A critical vulnerability exists in the new vBulletin 3.7.3 software which comes included + with the...

vBulletin admincp/admincalendar.php模块SQL注入漏洞

BUGTRAQ ID: 32348 vBulletin是一款开放源代码的PHP论坛程序。 vBulletin论坛的admincp/admincalendar.php文件没有正确地验证用户提交参数： -------------------original source code------------------ if$POST'do' == 'saveholiday' $vbulletin-input-cleanarraygpc'p', array 'holidayid' = TYPEINT, 'holidayinfo' = TYPEARRAY, 'month1' = TYPEINT,...

[waraxe-2008-SA#069] - Multiple Sql Injection in vBulletin 3.7.4

waraxe-2008-SA069 - Multiple Sql Injection in vBulletin 3.7.4 =============================================================================== Author: Janek Vind "waraxe" Date: 17. November 2008 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-69.html Description of vulnerable software:...

[waraxe-2008-SA#069] - Multiple Sql Injection in vBulletin 3.7.4

waraxe-2008-SA069 - Multiple Sql Injection in vBulletin 3.7.4 =============================================================================== Author: Janek Vind "waraxe" Date: 17. November 2008 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-69.html Description of vulnerable software:...

[waraxe-2008-SA#068] - Sql Injection in vBulletin 3.7.3.pl1

waraxe-2008-SA068 - Sql Injection in vBulletin 3.7.3.pl1 =============================================================================== Author: Janek Vind "waraxe" Date: 17. November 2008 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-68.html Description of vulnerable software:...

waraxe-2008-SA069.txt

waraxe-2008-SA069 - Multiple Sql Injection in vBulletin 3.7.4 =============================================================================== Author: Janek Vind "waraxe" Date: 17. November 2008 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-69.html Description of vulnerable software:...

waraxe-2008-SA068.txt

waraxe-2008-SA068 - Sql Injection in vBulletin 3.7.3.pl1 =============================================================================== Author: Janek Vind "waraxe" Date: 17. November 2008 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-68.html Description of vulnerable software:...

Sql injection

SQL injection vulnerability in VBGooglemap Hotspot Edition 1.0.3, a vBulletin module, allows remote attackers to execute arbitrary SQL commands via the mapid parameter in a showdetails action to 1 vbgooglemaphse.php and 2 mapa.php...

CVE-2008-4706

CVE-2008-4706 affects VBGooglemap Hotspot Edition 1.0.3 (a vBulletin module). The vulnerability is a SQL injection in the mapid parameter of the showdetails action, exploitable via (1) vbgooglemaphse.php and (2) mapa.php. Remote attackers could potentially execute arbitrary SQL commands. Exploita...

CVE-2008-4706

SQL injection vulnerability in VBGooglemap Hotspot Edition 1.0.3, a vBulletin module, allows remote attackers to execute arbitrary SQL commands via the mapid parameter in a showdetails action to 1 vbgooglemaphse.php and 2 mapa.php...

Cross site scripting

Cross-site scripting XSS vulnerability in vBulletin 3.7.2 PL1 and 3.6.10 PL3, when "Show New Private Message Notification Pop-Up" is enabled, allows remote authenticated users to inject arbitrary web script or HTML via a private message subject aka newpmtitle...

CVE-2008-3773

Cross-site scripting XSS vulnerability in vBulletin 3.7.2 PL1 and 3.6.10 PL3, when "Show New Private Message Notification Pop-Up" is enabled, allows remote authenticated users to inject arbitrary web script or HTML via a private message subject aka newpmtitle...

CVE-2008-3773

Cross-site scripting XSS vulnerability in vBulletin 3.7.2 PL1 and 3.6.10 PL3, when "Show New Private Message Notification Pop-Up" is enabled, allows remote authenticated users to inject arbitrary web script or HTML via a private message subject aka newpmtitle...

CVE-2008-3773

The CVE-2008-3773 entry concerns a cross-site scripting (XSS) vulnerability in vBulletin versions 3.7.2 PL1 and 3.6.10 PL3. When the option “Show New Private Message Notification Pop-Up” is enabled, remote authenticated users can inject arbitrary web script or HTML via a private message subject (...

vBulletin '$newpm[title]' 跨站漏洞

vBulletin is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the...

CORE-2008-0813 - vBulletin Cross Site Scripting Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory http://www.coresecurity.com/corelabs/ vBulletin Cross Site Scripting Vulnerability Advisory Information Title: vBulletin Cross Site Scripting Vulnerability Advisory ID: CORE-2008-0813 Advisory URL:...

vBulletin Cross Site Scripting Vulnerability

1. Advisory Information Title: vBulletin Cross Site Scripting Vulnerability Advisory ID: CORE-2008-0813 Advisory URL:https://www.coresecurity.com/core-labs/advisories/vbulletin-cross-site-scripting-vulnerability Date published: 2008-08-20 Date of last update: 2008-08-20 Vendors contacted:...

vBulletin 3.6.10/3.7.2 - '$newpm[title]' Cross-Site Scripting

source: https://www.securityfocus.com/bid/30777/info vBulletin is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in th...

vBulletin 3.6.103.7.2 - $newpm[title] Cross-Site Scripting

vBulletin 3.6.103.7.2 - $newpmtitle Cross-Site Scripting source: https://www.securityfocus.com/bid/30777/info vBulletin is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary...