Authorization

vBulletin 5.x through 5.1.6 allows remote authenticated users to bypass authorization checks and inject private messages into conversations via vectors related to an input validation failure...

CVE-2015-3419

vBulletin 5.x through 5.1.6 allows remote authenticated users to bypass authorization checks and inject private messages into conversations via vectors related to an input validation failure...

CVE-2015-3419

vBulletin 5.x up to 5.1.6 is affected by CVE-2015-3419, where remote authenticated users can bypass authorization and inject private messages into conversations due to an input validation failure. Affected product: vBulletin 5.x (≤ 5.1.6). Root cause: input validation failure enabling unauthorize...

CVE-2015-3419

vBulletin 5.x through 5.1.6 allows remote authenticated users to bypass authorization checks and inject private messages into conversations via vectors related to an input validation failure...

CVE-2014-9463

functionsvbseohook.php in the VBSEO module for vBulletin allows remote authenticated users to execute arbitrary code via the HTTP Referer header to visitormessage.php...

Code injection

functionsvbseohook.php in the VBSEO module for vBulletin allows remote authenticated users to execute arbitrary code via the HTTP Referer header to visitormessage.php...

CVE-2014-9463

The CVE-2014-9463 issue concerns the VBSEO module for vBulletin, specifically the functions_vbseo_hook.php file. Multiple sources (NVD CVE entry and CNVD) describe a remote code execution vulnerability triggered by a crafted HTTP Referer header directed at visitormessage.php, allowing remoteAuthe...

CVE-2014-9463

functionsvbseohook.php in the VBSEO module for vBulletin allows remote authenticated users to execute arbitrary code via the HTTP Referer header to visitormessage.php...

vBulletin Forum 'forum/help' Page XSS Vulnerability

vBulletin is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Cross site scripting

Cross-site scripting XSS vulnerability in vBulletin 3.5.4, 3.6.0, 3.6.7, 3.8.7, 4.2.2, 5.0.5, and 5.1.3...

CVE-2014-9469

Cross-site scripting XSS vulnerability in vBulletin 3.5.4, 3.6.0, 3.6.7, 3.8.7, 4.2.2, 5.0.5, and 5.1.3...

CVE-2014-9469

Cross-site scripting XSS vulnerability in vBulletin 3.5.4, 3.6.0, 3.6.7, 3.8.7, 4.2.2, 5.0.5, and 5.1.3...

CVE-2014-9469

CVE-2014-9469: A cross-site scripting (XSS) vulnerability affects vBulletin Forum versions 3.5.4, 3.6.0, 3.6.7, 3.8.7, 4.2.2, 5.0.5 and 5.1.3. Connected sources identify a vBulletin Forum XSS vulnerability on the orum/helpulpage, with the OpenVAS entry calling it a vBulletin Forum 'forum/help' ...

SSRF, Memcached and other key-value injections in the wild

Back in 2012 we released SSRF a different techniques to exploit Memcached servers and other services with host-based authentication through SSRF. Two years after, in 2014, I presented a Memcached injection techniques at Black Hat USA . There I mentioned that it’s possible to exploit it as a Remot...

vBulletin 5.1.2 < 5.1.9 - Unserialize Code Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'vBulletin 5.1.2 Unserialize Code Execution', 'Description' = %q This module exploits a PHP object injection vulnerability in vBulletin 5.1.2 to...

vBulletin < 5.3.0 'parse_url' SSRF Vulnerability

vBulletin is prone to a server-side request forgery SSRF vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

vBulletin Security Bypass Vulnerability

vBulletin is the United States Internet Brands and vBulletin Solutions, Inc. jointly developed an open source commercial Web forum program . A security bypass vulnerability exists in versions of vBulletin prior to 5.3.0. A remote attacker could exploit this vulnerability to conduct a server-side...

CVE-2017-7569

In vBulletin before 5.3.0, remote attackers can bypass the CVE-2016-6483 patch and conduct SSRF attacks by leveraging the behavior of the PHP parseurl function, aka VBV-17037...

CVE-2017-7569

In vBulletin before 5.3.0, remote attackers can bypass the CVE-2016-6483 patch and conduct SSRF attacks by leveraging the behavior of the PHP parseurl function, aka VBV-17037...

Server side request forgery (ssrf)

In vBulletin before 5.3.0, remote attackers can bypass the CVE-2016-6483 patch and conduct SSRF attacks by leveraging the behavior of the PHP parseurl function, aka VBV-17037...