232 matches found
CVE-2009-4467
misc.php in DeluxeBB 1.3 allows remote attackers to register accounts without a valid email address via a valemail action with the valmem set to a pre-assigned user ID, which is visible from a memberlist action...
Cross site scripting
Cross-site scripting XSS vulnerability in misc.php in DeluxeBB 1.3 allows remote attackers to inject arbitrary web script or HTML via the page parameter...
Code injection
DeluxeBB 1.3 allows remote attackers to obtain sensitive information via a crafted page parameter to misc.php, which reveals the installation path in an error message. NOTE: this issue might be resultant from improperly controlled computation in tools.php that leads to a denial of service CPU or...
Improper access control
DeluxeBB 1.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain user and configuration information, log data, and gain administrative access via a direct request to scripts in 1 templates/ including 2 templates/deluxe/admincp/...
Deserialization of untrusted data
misc.php in DeluxeBB 1.3 allows remote attackers to register accounts without a valid email address via a valemail action with the valmem set to a pre-assigned user ID, which is visible from a memberlist action...
CVE-2009-4468
DeluxeBB 1.3 is affected by a Cross-site Scripting (XSS) vulnerability in misc.php via the page parameter. This is a client-side script injection risk in the web interface. The CVE entry CVE-2009-4468 states the vulnerability allows remote attackers to inject arbitrary web script or HTML. Connect...
CVE-2009-4466
DeluxeBB 1.3 allows remote attackers to obtain sensitive information via a crafted page parameter to misc.php, which reveals the installation path in an error message. NOTE: this issue might be resultant from improperly controlled computation in tools.php that leads to a denial of service CPU or...
CVE-2009-4467
CVE-2009-4467 affects DeluxeBB 1.3. The vulnerability arises in the valemail flow used during registration, where a pre-assigned USER_ID can be exploited to register accounts without a valid email address, with the USER_ID visible via a memberlist. The underlying issue is input/validation weaknes...
CVE-2009-4467
misc.php in DeluxeBB 1.3 allows remote attackers to register accounts without a valid email address via a valemail action with the valmem set to a pre-assigned user ID, which is visible from a memberlist action...
CVE-2009-4468
Cross-site scripting XSS vulnerability in misc.php in DeluxeBB 1.3 allows remote attackers to inject arbitrary web script or HTML via the page parameter...
CVE-2009-4466
DeluxeBB 1.3 is affected by CVE-2009-4466, where a crafted value for the page parameter in misc.php can cause an information disclosure by revealing the installation path in an error message. The issue may stem from how tools.php handles computations, potentially contributing to a denial of servi...
CVE-2009-4465
DeluxeBB 1.3 is affected by multiple vulnerabilities related to improper access control that expose sensitive files under web root. The issues allow remote attackers to retrieve user/configuration data, logs, and potentially gain administrative access by requesting unprotected paths such as templ...
CVE-2009-4465
DeluxeBB 1.3 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain user and configuration information, log data, and gain administrative access via a direct request to scripts in 1 templates/ including 2 templates/deluxe/admincp/...
DeluxeBB <= 1.3 Multiple Vulnerabilities
Exploit for unknown platform in category web applications ======================================== DeluxeBB = 1.3 Multiple Vulnerabilities ======================================== Vendor: http://www.deluxebb.com Directory Listing http://server/templates/ http://server/images/ http://server/logs/...
DeluxeBB <= 1.3 Multiple Vulnerabilities
No description provided by source. Author: cp77fk4r | Empty0pagEShift+2gmail.comhttp://gmail.com Vendor: http://www.deluxebb.com Directory Listing http://server/templates/ http://server/images/ http://server/logs/ http://server/wysiwyg/ http://server/docs/ http://server/classes http://server/lang...
DeluxeBB 1.3 - Multiple Vulnerabilities
Author: cp77fk4r | Empty0pagEShift+2gmail.com Vendor: http://www.deluxebb.com Directory Listing http://server/templates/ http://server/images/ http://server/logs/ http://server/wysiwyg/ http://server/docs/ http://server/classes http://server/lang http://server/settings/ Cross Site Scripting...
DeluxeBB 1.3 XSS / Bypass
Author: cp77fk4r | Empty0pagEShift+2gmail.com Vendor: http://www.deluxebb.com Directory Listing http://server/templates/ http://server/images/ http://server/logs/ http://server/wysiwyg/ http://server/docs/ http://server/classes http://server/lang http://server/settings/ Cross Site Scripting...
DeluxeBB misc.php模块SQL注入漏洞
BUGTRAQ ID: 34174 DeluxeBB是一款基于PHP的论坛程序。 DeluxeBB的misc.php模块中没有正确地验证用户所提交的$qorder参数： $getsel = $db-query"SELECT FROM ".$prefix."users ".$qfilter." ".$qorder." == ".$sort." LIMIT ".$pageinfo0.",".$pageinfo1; 远程攻击者可以通过提交恶意的查询请求执行SQL注入攻击，导致读取论坛所有注册用户的用户名和口令MD5。 DeluxeBB = 1.3 厂商补丁：...
Sql injection
SQL injection vulnerability in misc.php in DeluxeBB 1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the qorder parameter, a different vector than CVE-2005-2989 and CVE-2006-2503...
CVE-2009-1033
SQL injection vulnerability in misc.php in DeluxeBB 1.3 and earlier allows remote attackers to execute arbitrary SQL commands via the qorder parameter, a different vector than CVE-2005-2989 and CVE-2006-2503...