CVE-2011-0910

The cookie implementation in Vanilla Forums before 2.0.17.6 makes it easier for remote attackers to spoof signed requests, and consequently obtain access to arbitrary user accounts, via HMAC timing attacks...

Nearby Live: Gain access to any user's email address

An attacker can gain access to any user's email address by accessing the /points/buy page. This is a serious issue because the email address is used as one of the login credentials for the website. Steps to reproduce : 1. Go to https://www.wnmlive.com/account/points 2. Select "Get more points" +...

Code injection

The cookie implementation in Vanilla Forums before 2.0.17.6 makes it easier for remote attackers to spoof signed requests, and consequently obtain access to arbitrary user accounts, via HMAC timing attacks...