vBulletin 2.0.x2.2.x - members2.php Cross-Site Scripting

vBulletin 2.0.x2.2.x - members2.php Cross-Site Scripting source: https://www.securityfocus.com/bid/6246/info Due to insufficient sanitization of user supplied values, it is possible to exploit a vulnerability in VBulletin. By passing an invalid value to a variable located in 'members2.php', it is...

vBulletin 2.0.x/2.2.x - 'members2.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/6246/info Due to insufficient sanitization of user supplied values, it is possible to exploit a vulnerability in VBulletin. By passing an invalid value to a variable located in 'members2.php', it is possible to generate an error page which will include...

XSS bug in vBulletin

Vulnerable systems: Jelsoft vBulletin 2.2.9 and prior Exploit: http://www.vbulletin.com/forum/memberlist.php? s=23c37cf1af5d2ad05f49361b0407ad9e&what=""Scriptjavascript:alert document.cookie/Script you can use this code thanx for SP.IC: ?PHP // vBulletin XSS Injection Vulnerability: Exploit // --...

vBulletin 2.02.2.x - memberlist.php Cross-Site Scripting

vBulletin 2.02.2.x - memberlist.php Cross-Site Scripting source: https://www.securityfocus.com/bid/6226/info vBulletin does not filter HTML tags from URI parameters, making it prone to cross-site scripting attacks. As a result, it is possible for a remote attacker to create a malicious link...

vBulletin 2.0/2.2.x - 'memberlist.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/6226/info vBulletin does not filter HTML tags from URI parameters, making it prone to cross-site scripting attacks. As a result, it is possible for a remote attacker to create a malicious link containing script code which will be executed in the browser o...

vBulletin 2.2.72.2.8 - HTML Injection

vBulletin 2.2.72.2.8 - HTML Injection source: https://www.securityfocus.com/bid/6337/info Problems with vBulletin could make it possible for an attacker to inject arbitrary HTML in vBulletin forum messages. vBulletin does not sufficiently filter potentially malicious HTML code from posted message...

vBulletin 2.2.7/2.2.8 - HTML Injection

source: https://www.securityfocus.com/bid/6337/info Problems with vBulletin could make it possible for an attacker to inject arbitrary HTML in vBulletin forum messages. vBulletin does not sufficiently filter potentially malicious HTML code from posted messages. As a result, when a user chooses to...

vBulletin XSS Security Bug

.:: vBulletin XSS Security Bug vBulletin is a powerful and widely used bulletin board system, based on PHP language and MySQL database. One of its features is the usage of templates to modify the boards look. I discovered lately a Cross-Site Scripting vulnerability that would attackers to inject...

vBulletin 2.02.2.x - Cross-Site Scripting

vBulletin 2.02.2.x - Cross-Site Scripting source: https://www.securityfocus.com/bid/5997/info vBulletin does not filter HTML tags from URI parameters, making it prone to cross-site scripting attacks. As a result, it is possible for a remote attacker to create a malicious link containing script co...

vBulletin 2.0/2.2.x - Cross-Site Scripting

source: https://www.securityfocus.com/bid/5997/info vBulletin does not filter HTML tags from URI parameters, making it prone to cross-site scripting attacks. As a result, it is possible for a remote attacker to create a malicious link containing script code which will be executed in the browser o...

vBulletin 2.0.3 - calendar.php Command Execution

vBulletin 2.0.3 - calendar.php Command Execution source: https://www.securityfocus.com/bid/5820/info A remote command execution vulnerability has been reported for vBulletin. The vulnerability is due to vBulletin failing to properly sanitize user-supplied input from URI parameters. An attacker ca...

vBulletin 2.0.3 - 'calendar.php' Command Execution

source: https://www.securityfocus.com/bid/5820/info A remote command execution vulnerability has been reported for vBulletin. The vulnerability is due to vBulletin failing to properly sanitize user-supplied input from URI parameters. An attacker can exploit this vulnerability to execute malicious...

[IMG] tag vulnerability in vBulletin

product : vbulletin versions : 2.2.2, 2.2.0 , maybe others. Probleme : One knows that if one sendings this code in private message : IMGjavascript:alert'hum';/IMG a space will be placed between "java" and "script". This filter can be by-passed : IMGjavasript:alert'hop';/IMG More details in french...

memberlist.php of vBulletin

vBulletin ALL versions Vendor status: notified 3/18/2; no response Within the first few lines of code in memberlist.php, the variable $letterbits is evaled. Because of the way PHP initializes variables, we can inject HTML, or JavaScript into the document. So by directing a user to, for example:...

Crossite scripting in vBulletin

No description provided...

[img]-vulnerability in vBulletin Version 2.2.2 & 2.2.1 & maybe olders

Hi I've discovered a vulnerability in the vBulletins's img-Tag implementation, that allows users to inject vbs-code in posts and private messages img is switched on by default. Through that, an attacker is able to steal other users cookies and maybe hijack their accounts. The following code sends...

Fairly serious vulnerability in vBulletin 2.2.0

This is my first report to bugtraq, I hope this is useful. This has been tested on vBulletin version 2.2.0. The vendor is CC'd on this message. I would imagine this applies to many products, not just the vbulletin, which I would like to say is more secure than most. ------------ The Exploit:...

CVE-2001-0475

Vulnerability in vBulletin (Jelsoft) allows remote code execution by exploiting an uninitialized PHP variable used to store template information. An attacker can craft special requests via the templatecache parameter to execute arbitrary PHP code on the server through the vBulletin PHP script. Th...

CVE-2001-0475

index.php in Jelsoft vBulletin does not properly initialize a PHP variable that is used to store template information, which allows remote attackers to execute arbitrary PHP code via special characters in the templatecache parameter...

CVE-2001-0475: Undefined Security Weakness

index.php in Jelsoft vBulletin does not properly initialize a PHP variable that is used to store template information, which allows remote attackers to execute arbitrary PHP code via special characters in the templatecache parameter...