1660 matches found
vBulletin 5 - routestring Remote Code Execution
vBulletin 5 - routestring Remote Code Execution SSD Advisory – vBulletin routestring Unauthenticated Remote Code Execution Source: https://blogs.securiteam.com/index.php/archives/3569 Vulnerability Summary The following advisory describes a unauthenticated file inclusion vulnerability that leads ...
vBulletin 5.x - routestring Remote Code Execution
vBulletin 5.x - routestring Remote Code Execution SSD Advisory – vBulletin routestring Unauthenticated Remote Code Execution Source: https://blogs.securiteam.com/index.php/archives/3569 Vulnerability Summary The following advisory describes a unauthenticated file inclusion vulnerability that lead...
vBulletin 5.x - 'cacheTemplates' Remote Arbitrary File Deletion
SSD Advisory – vBulletin cacheTemplates Unauthenticated Remote Arbitrary File Deletion Source: https://blogs.securiteam.com/index.php/archives/3573 Vulnerability Summary The following advisory describes a unauthenticated deserialization vulnerability that leads to arbitrary delete files and, unde...
vBulletin 5.x - 'routestring' Remote Code Execution
SSD Advisory – vBulletin routestring Unauthenticated Remote Code Execution Source: https://blogs.securiteam.com/index.php/archives/3569 Vulnerability Summary The following advisory describes a unauthenticated file inclusion vulnerability that leads to remote code execution found in vBulletin...
CVE-2014-2023
Multiple SQL injection vulnerabilities in the Tapatalk plugin 4.9.0 and earlier and 5.x through 5.2.1 for vBulletin allow remote attackers to execute arbitrary SQL commands via a crafted xmlrpc API request to 1 unsubscribeforum.php or 2 unsubscribetopic.php in mobiquo/functions/...
Sql injection
Multiple SQL injection vulnerabilities in the Tapatalk plugin 4.9.0 and earlier and 5.x through 5.2.1 for vBulletin allow remote attackers to execute arbitrary SQL commands via a crafted xmlrpc API request to 1 unsubscribeforum.php or 2 unsubscribetopic.php in mobiquo/functions/...
CVE-2014-2023
Multiple SQL injection vulnerabilities in the Tapatalk plugin 4.9.0 and earlier and 5.x through 5.2.1 for vBulletin allow remote attackers to execute arbitrary SQL commands via a crafted xmlrpc API request to 1 unsubscribeforum.php or 2 unsubscribetopic.php in mobiquo/functions/...
CVE-2014-2023
Multiple SQL injection vulnerabilities in the Tapatalk plugin 4.9.0 and earlier and 5.x through 5.2.1 for vBulletin allow remote attackers to execute arbitrary SQL commands via a crafted xmlrpc API request to 1 unsubscribeforum.php or 2 unsubscribetopic.php in mobiquo/functions/...
CVE-2014-2023
CVE-2014-2023 describes SQL injection in the Tapatalk plugin for vBulletin (versions 4.9.0 and earlier and 5.x up to 5.2.1). A remote attacker can trigger arbitrary SQL execution via crafted XML-RPC requests to mobiquo/functions/unsubscribe_forum.php or unsubscribe_topic.php. Affected product: Ta...
vBulletin 5.x <= 5.1.6 'Private Messages' Authentication Bypass Vulnerability
vBulletin is prone to an authentication bypass vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:vbulletin:vbulletin...
vBulletin Security Feature Bypass Vulnerability
vBulletin is a forum program. A security vulnerability exists in vBulletin that allows remote attackers to exploit a vulnerability to construct malicious requests, bypass security restrictions, and inject private messages into a session...
vBulletin VBSEO 'visitormessage.php' Remote Code Injection Vulnerability
vBulletin is the United States Internet Brands and vBulletin Solutions, Inc. jointly developed an open source commercial Web forum program. vBulletin VBSEO module is one of the SEO management module . A security vulnerability exists in the functionsvbseohook.php file in the vBulletin VBSEO module...
Authorization
vBulletin 5.x through 5.1.6 allows remote authenticated users to bypass authorization checks and inject private messages into conversations via vectors related to an input validation failure...
CVE-2015-3419
vBulletin 5.x through 5.1.6 allows remote authenticated users to bypass authorization checks and inject private messages into conversations via vectors related to an input validation failure...
CVE-2015-3419
vBulletin 5.x through 5.1.6 allows remote authenticated users to bypass authorization checks and inject private messages into conversations via vectors related to an input validation failure...
CVE-2015-3419
vBulletin 5.x up to 5.1.6 is affected by CVE-2015-3419, where remote authenticated users can bypass authorization and inject private messages into conversations due to an input validation failure. Affected product: vBulletin 5.x (≤ 5.1.6). Root cause: input validation failure enabling unauthorize...
Code injection
functionsvbseohook.php in the VBSEO module for vBulletin allows remote authenticated users to execute arbitrary code via the HTTP Referer header to visitormessage.php...
CVE-2014-9463
functionsvbseohook.php in the VBSEO module for vBulletin allows remote authenticated users to execute arbitrary code via the HTTP Referer header to visitormessage.php...
CVE-2014-9463
The CVE-2014-9463 issue concerns the VBSEO module for vBulletin, specifically the functions_vbseo_hook.php file. Multiple sources (NVD CVE entry and CNVD) describe a remote code execution vulnerability triggered by a crafted HTTP Referer header directed at visitormessage.php, allowing remoteAuthe...