436 matches found
CVE-2019-11574
Simple Machines Forum (SMF) prior to release 2.0.17 is affected by a server-side request forgery (SSRF) in Subs-Package.php and Subs.php, where user-supplied data is used directly in curl calls. Affects SMF versions before 2.0.17; CVE-2019-11574 details an SSRF condition with high impact per CVSS...
CVE-2013-4395
CVE-2013-4395 affects Simple Machines Forum (SMF) up to version 2.0.5, with a cross-site scripting (XSS) vulnerability. The connected records confirm the product and vulnerability class but do not provide technical details such as vulnerable components, exploit vectors, affected configurations, r...
CVE-2013-0192
File Disclosure in SMF SimpleMachines Forum = 2.0.3: Forum admin can read files such as the database config...
CVE-2013-0192
File Disclosure in SMF SimpleMachines Forum = 2.0.3: Forum admin can read files such as the database config...
CVE-2013-0192
CVE-2013-0192 affects Simple Machines Forum (SMF) up to version 2.0.3. The vulnerability is a file disclosure that enables a forum admin to read sensitive files, such as the database configuration, indicating insufficient access restrictions when handling file operations. The available sources (N...
CVE-2019-12490
An issue was discovered in Simple Machines Forum SMF before 2.0.16. Reverse tabnabbing can occur because of use of blank for external links...
CVE-2019-12490
SMF contains a reverse tabnabbing flaw (CVE-2019-12490) in which external links opened with _blank can enable credential theft when a user visits a crafted site. Affected: Simple Machines Forum before 2.0.16. Root cause: improper handling of external links (target="_blank"). Impact documented as ...
CVE-2009-5068
There is a file disclosure vulnerability in SMF Simple Machines Forum affecting versions through v2.0.3. On some configurations a SMF deployment is shared by several "co-admins" that are not trusted beyond the SMF deployment. This vulnerability allows them to read arbitrary files on the filesyste...
Arbitrary file deletion
There is a file disclosure vulnerability in SMF Simple Machines Forum affecting versions through v2.0.3. On some configurations a SMF deployment is shared by several "co-admins" that are not trusted beyond the SMF deployment. This vulnerability allows them to read arbitrary files on the filesyste...
CVE-2009-5068
There is a file disclosure vulnerability in SMF Simple Machines Forum affecting versions through v2.0.3. On some configurations a SMF deployment is shared by several "co-admins" that are not trusted beyond the SMF deployment. This vulnerability allows them to read arbitrary files on the filesyste...
CVE-2009-5068
The CVE concerns Simple Machines Forum (SMF) up to version 2.0.3. In some deployments, co-admins with access to the same SMF instance can read arbitrary files, including settings.php containing database passwords, enabling privilege escalation. No specific exploit details or mitigations are provi...
CVE-2005-4891
Simple Machine Forum SMF versions 1.0.4 and earlier have an SQL injection vulnerability that allows remote attackers to inject arbitrary SQL statements...
CVE-2005-4891
CVE-2005-4891 affects Simple Machine Forum (SMF) versions 1.0.4 and earlier. The vulnerability is an SQL injection in SMF that enables remote attackers to inject arbitrary SQL statements. Documented impact in sources indicates potential partial confidentiality, integrity, and availability effects...
Oracle Solaris Critical Patch Update : oct2019_SRU11_4_13_4_0
This Solaris system is missing necessary patches to address critical security updates : - Vulnerability in the Oracle Solaris product of Oracle Systems component: SMF services & legacy daemons. The supported version that is affected is 11. Difficult to exploit vulnerability allows low privileged...
CVE-2019-2961
Vulnerability in the Oracle Solaris product of Oracle Systems component: SMF services & legacy daemons. The supported version that is affected is 11. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Orac...
Design/Logic Flaw
Vulnerability in the Oracle Solaris product of Oracle Systems component: SMF services & legacy daemons. The supported version that is affected is 11. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Orac...
Directory traversal
Simple Machines Forum SMF 2.0.4 allows local file inclusion, with resultant remote code execution, in install.php via ../ directory traversal in the dbtype parameter if install.php remains present after installation...
CVE-2013-7468
Affected software: Simple Machines Forum (SMF) 2.0.4. Vulnerability: PHP Code Injection via the dictionary parameter in the index.php?action=admin;area=languages;sa=editlang path. Root cause (as described): unsafely processed user-supplied dictionary parameter enables code execution. Impact (as s...
CVE-2013-7467
CVE-2013-7467 : Concrete details across multiple sources show that Simple Machines Forum (SMF) 2.0.4 is vulnerable to a cross-site scripting (XSS) issue. The vulnerability is triggered by the parameter in index.php with action=pm;sa=settings;save sa, allowing injection of script that can affect u...