CVE-2006-0080

Cross-site scripting XSS vulnerability in vBulletin 3.5.2, and possibly earlier versions, allows remote attackers to inject arbitrary web script or HTML via the title of an event, which is not properly filtered by 1 calendar.php and 2 reminder.php...

[KAPDA::#19] - Html Injection in vBulletin 3.5.2

KAPDA New advisory Vendor: http://www.vbulletin.com Vulnerable Version: 3.5.2 prior versions also may be affected Bug: Html Injection Second order cross site scripting Exploitation: Remote with browser Description: -------------------- vBulletin is a powerful, scalable and fully customizable foru...

CVE-2005-4621

Cross-site scripting XSS vulnerability in the editavatar page in vBulletin 3.5.1 allows remote attackers to inject arbitrary web script or HTML via a URL in the remote avatar url field, in which the URL generates a parsing error, and possibly requiring a trailing extension such as .jpg...

[VulnWatch] XSS & Header Injection in Drupal and vBulletin

A fake image header with actual html body content was able to get past phpbb's input validation. An exploit was issued for phpbb a month ago and that sparked me to check some other webapps. vbulletin 3.5.0 forum file attachments did not sanitize against this, as a result Jelsoft quickly issued...

vbullXSS.txt

re, submissionsatpacketstormsecurity.org. http://nshell.h15.ru/advisory's/vBulletin%203.5.1xss.txt ========================================================= = N Shell : advizory = ========================================================= PRODUCT: vBulletin 3.5.1 DESCRIPTION: vBulletin is a...

VBulletin 3.5.1 XSS vuln.

VBulletin 3.5.1 XSS vuln. Vuln. dicovered by : r0t Date: 26 nov. 2005 Orginal advisory:http://pridels.blogspot.com/2005/11/vbulletin-351-xss-vuln.html Vendor:http://www.vbulletin.com/ affected version:3.5.1 and prior Vuln. Description: "editavatar" XSS- avatar url field parameters isn't properly...

ibProArcade.txt

Sql injection in ibProArcade. This bug was discoverd in all of the versions of ibproarcade 2.x. It was tested and found perfectly working under vBulettin or Invision power board. Date:2005-11-5 The injection is here: module=report&user=userid Query: 'SELECT name FROM ibfmembers WHERE id=userid'...

Sql injection in ibProArcade

Sql injection in ibProArcade. This bug was discoverd in all of the versions of ibproarcade 2.x. It was tested and found perfectly working under vBulettin or Invision power board. Date:2005-11-5 The injection is here: module=report&user=userid Query: 'SELECT name FROM ibfmembers WHERE id=userid'...

Баг в vBulletin 3.x

Здравствуйте. Проверялись версии 3.0.3 и 3.0.9 Поле профиля Статус воспринимает опасные html-тэги по умолчанию эта опция включена и может использоваться для выполнения атак типа XSS а также некоторых других корыстных целях теми, кто может менять свой статус по умолчанию администрация, начиная от...

ibProArcade 2.x module (vBulletin/IPB) Remote SQL Injection Exploit

Exploit for unknown platform in category web applications =================================================================== ibProArcade 2.x module vBulletin/IPB Remote SQL Injection Exploit =================================================================== Rankings for name will state the md5...

ibProArcade 2.x module (vBulletin/IPB) Remote SQL Injection Exploit

No description provided by source. Rankings for name will state the md5 hash for the user /str0ke ibProArcade 2.x IPB: index.php?act=Arcade&module=report&user=-1 union select password from ibfmembers where id=anyuser vBulettin forums: index.php?act=ibProArcade&module=report&user=-1 union select...

ibProArcade 2.x - module 'vBulletin/IPB' SQL Injection

Rankings for name will state the md5 hash for the user /str0ke ibProArcade 2.x IPB: index.php?act=Arcade&module=report&user=-1 union select password from ibfmembers where id=anyuser vBulettin forums: index.php?act=ibProArcade&module=report&user=-1 union select password from user where...

ibProArcade 2.x - module vBulletinIPB SQL Injection

ibProArcade 2.x - module vBulletinIPB SQL Injection Rankings for name will state the md5 hash for the user /str0ke ibProArcade 2.x IPB: index.php?act=Arcade&module=report&user=-1 union select password from ibfmembers where id=anyuser vBulettin forums: index.php?act=ibProArcade&module=report&user=...

[SA17359] vBulletin Image Script Insertion Vulnerability

TITLE: vBulletin Image Script Insertion Vulnerability SECUNIA ADVISORY ID: SA17359 VERIFY ADVISORY: http://secunia.com/advisories/17359/ CRITICAL: Less critical IMPACT: Cross Site Scripting WHERE: From remote SOFTWARE: vBulletin 3.x http://secunia.com/product/3212/ vBulletin 2.x...

vBulletin Forumdisplay.PHP Remote Command Execution Vulnerability

The remote host is running vBulletin, a web based bulletin board system written in PHP. The remote version of this software is vulnerable to remote command execution flaw through the script OpenVAS Vulnerability Test $Id: vbulletinforumdisplayremotecmdexec.nasl 6046 2017-04-28 09:02:54Z teissa $...

vBulletin XSS(3)

The remote host is running vBulletin, a web based bulletin board system written in PHP. The remote version of this software seems to be prior or equal to version 2.3.5 or 3.0.5. These versions are vulnerable to a cross-site scripting issue, due to a failure of the application to properly sanitize...

vBulletin XSS

The remote host is running vBulletin, a web based bulletin board system written in PHP. The remote version of this software is vulnerable to a cross-site scripting issue, due to a failure of the application to properly sanitize user-supplied URI input. As a result of this vulnerability, it is...

vBulletin < 3.0.4 'forumdisplay.php' RCE Vulnerability - Active Check

vBulletin is prone to a remote command execution RCE vulnerability through the script SPDX-FileCopyrightText: 2005 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

vBulletin Init.PHP unspecified vulnerability

The remote host is running vBulletin, a web based bulletin board system written in PHP. The remote version of this software is vulnerable to an unspecified issue. It is reported that versions 3.0.0 through to 3.0.4 are prone to a security flaw in 'includes/init.php'. Successful exploitation...

vBulletin < 2.3.6, 3.0.x < 3.0.6 XSS Vulnerability

vBulletin is vulnerable to a cross-site scripting XSS issue, due to a failure of the application to properly sanitize user-supplied URI input. SPDX-FileCopyrightText: 2005 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective rig...