Vanilla Forums 2.0.17.1 - 2.0.17.5 Cross Site Scripting

OVERVIEW The Vanilla Forums 2.0.17.1 till 2.0.17.5 were vulnerable to Cross Site Scripting. 2. BACKGROUND Vanilla Forums are open-source, standards-compliant, customizable discussion forums. It is specially made to help small communities grow larger through SEO mojo, totally customizable social...

Vanilla Forums 2.0.17.x - p Cross-Site Scripting

Vanilla Forums 2.0.17.x - p Cross-Site Scripting source: https://www.securityfocus.com/bid/46486/info Vanilla Forums is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code...

CVE-2011-0526

Cross-site scripting XSS vulnerability in index.php in Vanilla Forums before 2.0.17 allows remote attackers to inject arbitrary web script or HTML via the Target parameter in a /entry/signin action...

CVE-2011-0909

Cross-site scripting XSS vulnerability in Vanilla Forums before 2.0.17.6 allows remote attackers to inject arbitrary web script or HTML via the p parameter to an unspecified component, a different vulnerability than CVE-2011-0526...

CVE-2011-0908

Open redirect vulnerability in Vanilla Forums before 2.0.17.6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the Target parameter to an unspecified component, a different vulnerability than CVE-2011-0526...

CVE-2011-0910

The cookie implementation in Vanilla Forums before 2.0.17.6 makes it easier for remote attackers to spoof signed requests, and consequently obtain access to arbitrary user accounts, via HMAC timing attacks...

Open redirect

Open redirect vulnerability in Vanilla Forums before 2.0.17.6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the Target parameter to an unspecified component, a different vulnerability than CVE-2011-0526...

Code injection

The cookie implementation in Vanilla Forums before 2.0.17.6 makes it easier for remote attackers to spoof signed requests, and consequently obtain access to arbitrary user accounts, via HMAC timing attacks...

Cross site scripting

Cross-site scripting XSS vulnerability in Vanilla Forums before 2.0.17.6 allows remote attackers to inject arbitrary web script or HTML via the p parameter to an unspecified component, a different vulnerability than CVE-2011-0526...

CVE-2011-0526

Cross-site scripting XSS vulnerability in index.php in Vanilla Forums before 2.0.17 allows remote attackers to inject arbitrary web script or HTML via the Target parameter in a /entry/signin action...

CVE-2011-0910

Vanilla Forums vulnerability CVE-2011-0910 affects versions before 2.0.17.6. The cookie implementation allows remote attackers to spoof signed requests and potentially gain access to arbitrary user accounts via HMAC timing attacks. Root cause: flawed cookie handling enabling timing-based forgery....

CVE-2011-0909

Vanilla Forums is affected by CVE-2011-0909 (before 2.0.17.6). The vulnerability is a Cross-site Scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via the p parameter to an unspecified component. Connected Red Hat CVE entries corroborate the same description...

CVE-2011-0908

Open redirect vulnerability in Vanilla Forums before 2.0.17.6 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the Target parameter to an unspecified component, a different vulnerability than CVE-2011-0526...

CVE-2011-0908

CVE-2011-0908 concerns Vanilla Forums before 2.0.17.6, with an open redirect vulnerability that can send users to arbitrary sites via a URL in the Target parameter to an unspecified component (open redirect, not CVE-2011-0526). Red Hat entries corroborate the same description. The sources do not ...

CVE-2011-0526

CVE-2011-0526 is a documented XSS in Vanilla Forums prior to 2.0.17. An attacker could inject arbitrary script/HTML via the Target parameter in the /entry/signin action (index.php). The Red Hat and NVD entries confirm the affected product and vector, with no exploitation details provided in the s...

CVE-2011-0909

Cross-site scripting XSS vulnerability in Vanilla Forums before 2.0.17.6 allows remote attackers to inject arbitrary web script or HTML via the p parameter to an unspecified component, a different vulnerability than CVE-2011-0526...

Vanilla Forums 2.0.16 <= Cross Site Scripting Vulnerability

============================================================================== Vanilla Forums 2.0.16 = Cross Site Scripting Vulnerability ============================================================================== 1. OVERVIEW The Vanilla Forums 2.0.16 and lower versions were vulnerable to Cros...

Vanilla Forums 2.0.16 - Target Cross-Site Scripting

Vanilla Forums 2.0.16 - Target Cross-Site Scripting source: https://www.securityfocus.com/bid/46039/info Vanilla Forums is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script...

Vanilla Forums 2.0.16 Cross Site Scripting

============================================================================== Vanilla Forums 2.0.16 = Cross Site Scripting Vulnerability ============================================================================== 1. OVERVIEW The Vanilla Forums 2.0.16 and lower versions were vulnerable to Cros...

Vanilla Forums 2.0.16 - 'Target' Cross-Site Scripting

source: https://www.securityfocus.com/bid/46039/info Vanilla Forums is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the...