PunBB 1.2.x - 'p' Parameter Multiple Cross-Site Scripting Vulnerabilities

PunBB 1.2.x 'p' Parameter Multiple Cross-Site Scripting Vulnerabilities. Webapps exploit for php platform source: http://www.securityfocus.com/bid/31082/info PunBB is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may...

PunBB多个远程跨站脚本漏洞

BUGTRAQ ID: 30396 CVECAN ID: CVE-2008-3336 PunBB是一款基于PHP的论坛程序。 PunBB的include/parser.php和moderate.php文件没有正确地验证某些参数便返回给了用户，远程攻击者可以通过向论坛提交恶意请求执行脚本注入或跨站脚本攻击。 PunBB 1.x PunBB ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://punbb.informer.com/download/punbb-1.2.19.tar.gz...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in PunBB before 1.2.19 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors in 1 include/parser.php and 2 moderate.php...

CVE-2008-3335

Unspecified vulnerability in PunBB before 1.2.19 allows remote attackers to inject arbitrary SMTP commands via unknown vectors...

CVE-2008-3336

Multiple cross-site scripting XSS vulnerabilities in PunBB before 1.2.19 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors in 1 include/parser.php and 2 moderate.php...

Sql injection

Unspecified vulnerability in PunBB before 1.2.19 allows remote attackers to inject arbitrary SMTP commands via unknown vectors...

CVE-2008-3335

PunBB prior to version 1.2.19 contains an unspecified vulnerability that allows remote attackers to inject arbitrary SMTP commands via unknown vectors. The issue is rated high severity (CVSSv2 base score 10.0) with network attack requirements and full impact on confidentiality, integrity, and ava...

CVE-2008-3335

Unspecified vulnerability in PunBB before 1.2.19 allows remote attackers to inject arbitrary SMTP commands via unknown vectors...

CVE-2008-3336

Multiple cross-site scripting XSS vulnerabilities in PunBB before 1.2.19 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors in 1 include/parser.php and 2 moderate.php...

CVE-2008-3336

CVE-2008-3336 affects PunBB prior to 1.2.19. The vulnerability lies in include/parser.php and moderate.php, where insufficient validation allows remote attackers to inject arbitrary script/HTML (XSS). Impact is web-script injection via unspecified vectors; no exploit details are provided in the s...

Cross site scripting

Cross-site scripting XSS vulnerability in PunBB 1.2.16 and earlier allows remote attackers to inject arbitrary web script or HTML via the gethost parameter to moderate.php...

Design/Logic Flaw

The password reset feature in PunBB 1.2.16 and earlier uses predictable random numbers based on the system time, which allows remote authenticated users to determine the new password via a brute force attack on a seed that is based on the approximate creation time of the targeted account. NOTE:...

CVE-2008-1485

Cross-site scripting XSS vulnerability in PunBB 1.2.16 and earlier allows remote attackers to inject arbitrary web script or HTML via the gethost parameter to moderate.php...

CVE-2008-1484

The password reset feature in PunBB 1.2.16 and earlier uses predictable random numbers based on the system time, which allows remote authenticated users to determine the new password via a brute force attack on a seed that is based on the approximate creation time of the targeted account. NOTE:...

CVE-2008-1485

The CVE-2008-1485 issue is a Cross-site Scripting (XSS) vulnerability in PunBB 1.2.16 and earlier. The flaw allows remote attackers to inject arbitrary web script or HTML via the get_host parameter to moderate.php, exposing users to scripted payloads when the affected page is viewed. The availabl...

CVE-2008-1484

The password reset feature in PunBB 1.2.16 and earlier uses predictable random numbers based on the system time, which allows remote authenticated users to determine the new password via a brute force attack on a seed that is based on the approximate creation time of the targeted account. NOTE:...

CVE-2008-1485

Cross-site scripting XSS vulnerability in PunBB 1.2.16 and earlier allows remote attackers to inject arbitrary web script or HTML via the gethost parameter to moderate.php...

CVE-2008-1484

PunBB 1.2.16 and earlier has a vulnerability in the password reset mechanism where the seed for the reset token is derived from the system time, enabling remote authenticated users to brute-force and determine a new password. The issue affects PunBB’s password reset function and can be exploited ...

PunBB口令重置弱随机数绕过安全限制漏洞

BUGTRAQ ID: 27908 PunBB是一款基于PHP的论坛程序。 PunBB的口令重置功能实现上存在漏洞，远程攻击者可能利用此漏洞在特定条件重置用户的口令。 如果用户忘记了口令的话，可使用PunBB的口令重置功能重置。在请求口令重置后，论坛会向用户发送一封邮件，包含有一个新的随机口令以及激活链接，用户必须点击这个链接才能使口令更改生效。...

Advisory SE-2008-01: PunBB Blind Password Recovery Vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SektionEins GmbH www.sektioneins.de -= Security Advisory =- Advisory: PunBB Blind Password Recovery Vulnerability Release Date: 2008/02/20 Last Modified: 2008/02/20 Author: Stefan Esser stefan.esseratsektioneins.de Application: PunBB = 1.2.16 Severity...