CVE-2007-2912

Unspecified vulnerability in Jelsoft vBulletin before 3.6.6, when unauthenticated User Infraction Permissions is disabled, allows remote attackers to see the infraction "red flag" for a deleted user...

Cross site scripting

Cross-site scripting XSS vulnerability in calendar.php in Jelsoft vBulletin before 3.6.6 allows remote attackers to inject arbitrary web script or HTML via the title field in a single add action...

CVE-2007-2909

Cross-site scripting XSS vulnerability in calendar.php in Jelsoft vBulletin 3.6.x before 3.6.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to the vbcalendar366xssfixplugin.xml update...

CVE-2007-2908

Cross-site scripting XSS vulnerability in calendar.php in Jelsoft vBulletin before 3.6.6 allows remote attackers to inject arbitrary web script or HTML via the title field in a single add action...

Design/Logic Flaw

Unspecified vulnerability in Jelsoft vBulletin before 3.6.6, when unauthenticated User Infraction Permissions is disabled, allows remote attackers to see the infraction "red flag" for a deleted user...

CVE-2007-2912

CVE-2007-2912 affects Jelsoft vBulletin prior to 3.6.6. The issue arises when the system’s unauthenticated User Infraction Permissions feature is disabled, allowing remote attackers to view the infraction “red flag” for a deleted user. This constitutes an information-disclosure risk due to an acc...

CVE-2007-2912

Unspecified vulnerability in Jelsoft vBulletin before 3.6.6, when unauthenticated User Infraction Permissions is disabled, allows remote attackers to see the infraction "red flag" for a deleted user...

CVE-2007-2911

CVE-2007-2911 : A SQL injection in Jelsoft’s vBulletin admincp/attachment.php (before 3.6.6) allows remote authenticated administrators to execute arbitrary SQL via the "Attached After" field (GPC['search']['datelineafter']). This is related to CVE-2007-1573. Affected product/version: vBulletin p...

CVE-2007-2908

The CVE-2007-2908 entry describes a cross-site scripting (XSS) vulnerability in Jelsoft vBulletin’s calendar.php, exploitable to inject arbitrary HTML/Script via the title field during a single add action. Affected software is vBulletin prior to version 3.6.6. The underlying issue is an input han...

CVE-2007-2910

CVE-2007-2909 and CVE-2007-2910 are XSS vulnerabilities in Jelsoft vBulletin 3.6.x before 3.6.7 (PL1). CVE-2007-2909 affects calendar.php; CVE-2007-2910 affects calendar.php as well (update vb_calendar366_xss_fix_plugin.xml for CVE-2007-2909, vb_367_xss_fix_plugin.xml for CVE-2007-2910). Root cau...

CVE-2007-2910

Cross-site scripting XSS vulnerability in Jelsoft vBulletin before 3.6.7 PL1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to the vb367xssfixplugin.xml update, a related issue to CVE-2007-2909...

Sql injection

SQL injection vulnerability in admincp/attachment.php in Jelsoft vBulletin 3.6.5 allows remote authenticated administrators to execute arbitrary SQL commands via the "Attached Before" field...

CVE-2007-1573

SQL injection vulnerability in admincp/attachment.php in Jelsoft vBulletin 3.6.5 allows remote authenticated administrators to execute arbitrary SQL commands via the "Attached Before" field...

CVE-2007-1573

SQL injection vulnerability in admincp/attachment.php in Jelsoft vBulletin 3.6.5 allows remote authenticated administrators to execute arbitrary SQL commands via the "Attached Before" field...

CVE-2007-1342

Cross-site scripting XSS vulnerability in admincp/index.php in Jelsoft vBulletin 3.6.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the add rss url form...

CVE-2007-1342

Cross-site scripting XSS vulnerability in admincp/index.php in Jelsoft vBulletin 3.6.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the add rss url form...

CVE-2007-1342

CVE-2007-1342 describes a cross-site scripting (XSS) vulnerability in the admincp/index.php component of Jelsoft vBulletin 3.6.5 and earlier. The flaw allows remote attackers to inject arbitrary web script or HTML via the add rss url form. Public records (NVD/NVD-derived entries) confirm the affe...

Sql injection

SQL injection vulnerability in inlinemod.php in Jelsoft vBulletin before 3.5.8, and before 3.6.5 in the 3.6.x series, might allow remote authenticated users to execute arbitrary SQL commands via the postids parameter. NOTE: the vendor states that the attack is feasible only in circumstances "almo...

CVE-2007-1292

SQL injection vulnerability in inlinemod.php in Jelsoft vBulletin before 3.5.8, and before 3.6.5 in the 3.6.x series, might allow remote authenticated users to execute arbitrary SQL commands via the postids parameter. NOTE: the vendor states that the attack is feasible only in circumstances "almo...

CVE-2007-1292

SQL injection vulnerability in inlinemod.php in Jelsoft vBulletin before 3.5.8, and before 3.6.5 in the 3.6.x series, might allow remote authenticated users to execute arbitrary SQL commands via the postids parameter. NOTE: the vendor states that the attack is feasible only in circumstances "almo...