91 matches found
CVE-2006-4272
Jelsoft vBulletin 3.5.4 allows remote attackers to register multiple arbitrary users and cause a denial of service resource consumption via a large number of requests to register.php. NOTE: the vendor has disputed this vulnerability, stating "If you have the CAPTCHA enabled then the registrations...
CVE-2006-4273
Affected software: Jelsoft vBulletin 3.5.4 and 3.6.0. Vulnerability type/trigger: Cross-site scripting (XSS) via uploading a .pdf attachment containing JavaScript, which is processed as script by Internet Explorer 6. Impact (as stated): enables remote script execution; documents indicate partial ...
CVE-2006-4273
Cross-site scripting XSS vulnerability in Jelsoft vBulletin 3.5.4 and 3.6.0 allows remote attackers to inject arbitrary web script or HTML by uploading an attachment with a .pdf extension that contains JavaScript, which is processed as script by Microsoft Internet Explorer 6...
CVE-2006-2335
Jelsoft vBulletin accepts uploads of Cascading Style Sheets CSS and processes them in a way that allows remote authenticated administrators to gain shell access by uploading a CSS file that contains PHP code, then selecting the file via the style chooser, which causes the PHP code to be executed...
Code injection
Jelsoft vBulletin accepts uploads of Cascading Style Sheets CSS and processes them in a way that allows remote authenticated administrators to gain shell access by uploading a CSS file that contains PHP code, then selecting the file via the style chooser, which causes the PHP code to be executed...
CVE-2006-2335
Jelsoft vBulletin (CSS upload handling) is affected by a vulnerability where uploading a CSS file containing PHP code and selecting it via the style chooser can result in the PHP code being executed. The issue is described as enabling remote authenticated administrators to gain shell access throu...
CVE-2006-2335
Jelsoft vBulletin accepts uploads of Cascading Style Sheets CSS and processes them in a way that allows remote authenticated administrators to gain shell access by uploading a CSS file that contains PHP code, then selecting the file via the style chooser, which causes the PHP code to be executed...
[VulnWatch] XSS & Header Injection in Drupal and vBulletin
A fake image header with actual html body content was able to get past phpbb's input validation. An exploit was issued for phpbb a month ago and that sparked me to check some other webapps. vbulletin 3.5.0 forum file attachments did not sanitize against this, as a result Jelsoft quickly issued...
CVE-2004-2288
Cross-site scripting XSS vulnerability in index.php in Jelsoft vBulletin allows remote attackers to spoof parts of a website via the loc parameter...
CVE-2004-2288
The CVE-2004-2288 entry refers to a cross-site scripting (XSS) vulnerability in Jelsoft vBulletin, specifically in index.php via the loc parameter, allowing remote attackers to spoof parts of a website. Documents collectively confirm the affected product and vulnerable parameter; however, they do...
CVE-2002-1922
Cross-site scripting XSS vulnerability in global.php in Jelsoft vBulletin 2.0.0 through 2.2.8 allows remote attackers to inject arbitrary web script or HTML via the 1 $scriptpath or 2 $url variables...
CVE-2002-1922
CVE-2002-1922 describes a Cross-site Scripting (XSS) vulnerability in Jelsoft vBulletin, affecting versions 2.0.0 through 2.2.8. The issue allows remote attackers to inject arbitrary web script or HTML via the (1) $scriptpath or (2) $url variables in global.php. The connected documents confirm th...
CVE-2002-1679
CVE-2002-1679 is a cross-site scripting (XSS) vulnerability in Jelsoft vBulletin 2.2.0 that allows remote attackers to execute arbitrary script as other users by injecting script into a bulletin board message. The provided connected documents confirm the affected product and version and describe ...
CVE-2002-1678
The CVE-2002-1678 entry describes a Cross-site scripting (XSS) vulnerability in Jelsoft’s vBulletin 2.0 rc2 through 2.2.4, specifically in memberlist.php, allowing remote attackers to steal authentication credentials by injecting a/script into $letterbits. Affected software is Jelsoft vBulletin 2...
CVE-2002-1679
Cross-site scripting XSS vulnerability in Jelsoft vBulletin 2.2.0 allows remote attackers to execute arbitrary script as other users by injecting script into a bulletin board message...
CVE-2002-1678
Cross-site scripting XSS vulnerability in memberlist.php in Jelsoft vBulletin 2.0 rc 2 through 2.2.4 allows remote attackers to steal authentication credentials by injecting script into $letterbits...
CVE-2004-2076
Cross-site scripting XSS vulnerability in search.php for Jelsoft vBulletin 3.0.0 RC4 allows remote attackers to inject arbitrary web script or HTML via the query parameter...
CVE-2004-2076
The CVE-2004-2076 entry describes a cross-site scripting (XSS) vulnerability in Jelsoft vBulletin 3.0.0 RC4 identified via search.php. The vulnerability allows remote attackers to inject arbitrary web script or HTML by manipulating the query parameter, enabling possible theft of cookies or sessio...
CVE-2004-1823
Multiple cross-site scripting XSS vulnerabilities in Jelsoft vBulletin 2.0 beta 3 through 3.0 can4 allows remote attackers to inject arbitrary web script or HTML via the 1 page parameter to showthread.php or 2 order parameter to forumdisplay.php...