Vanilla 1.1.7 Cross Site Scripting

Author: Gerendi Sandor Attila Original advisory: http://gsasec.blogspot.com/2009/05/vanilla-v117-cross-site-scripting.html Date: May 14, 2009 Package: Vanilla 1.1.7 Product Homepage: http://getvanilla.com/ Versions Affected: v.1.1.7, 1.1.5 Other versions may also be affected Severity: Medium Inpu...

Lussumo Vanilla 1.1.5/1.1.7 - 'updatecheck.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/35124/info Vanilla is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of th...

Lussumo Vanilla 1.1.51.1.7 - updatecheck.php Cross-Site Scripting

Lussumo Vanilla 1.1.51.1.7 - updatecheck.php Cross-Site Scripting source: https://www.securityfocus.com/bid/35124/info Vanilla is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary scrip...

CVE-2008-3874

Cross-site scripting XSS vulnerability in account.php in Lussumo Vanilla 1.1.5-rc1, 1.1.4, and earlier allows remote authenticated users to inject arbitrary web script or HTML via the Value field aka Label == Value pairs. NOTE: some of these details are obtained from third party information...

Cross site scripting

Cross-site scripting XSS vulnerability in account.php in Lussumo Vanilla 1.1.5-rc1, 1.1.4, and earlier allows remote authenticated users to inject arbitrary web script or HTML via the Value field aka Label == Value pairs. NOTE: some of these details are obtained from third party information...

CVE-2008-3874

Cross-site scripting XSS vulnerability in account.php in Lussumo Vanilla 1.1.5-rc1, 1.1.4, and earlier allows remote authenticated users to inject arbitrary web script or HTML via the Value field aka Label == Value pairs. NOTE: some of these details are obtained from third party information...

CVE-2008-3874

CVE-2008-3874 describes a cross-site scripting (XSS) vulnerability in the Vanilla forum software. Affected product/version: Vanilla 1.1.5-rc1, 1.1.4, and earlier; vulnerable component: the file account.php . The underlying issue is an XSS flaw that allows remote authenticated users to inject arbi...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the sign-out page in Vanilla 1.1.4 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that trigger a logout via a SignOutNow action to people.php...

CVE-2008-3760

Cross-site request forgery CSRF vulnerability in the sign-out page in Vanilla 1.1.4 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that trigger a logout via a SignOutNow action to people.php...

CVE-2008-3759

Cross-site request forgery CSRF vulnerability in ajax/UpdateCheck.php in Vanilla 1.1.4 and earlier has unknown impact and remote attack vectors...

CVE-2008-3760

Cross-site request forgery CSRF vulnerability in the sign-out page in Vanilla 1.1.4 and earlier allows remote attackers to hijack the authentication of arbitrary users for requests that trigger a logout via a SignOutNow action to people.php...

CVE-2008-3758

Multiple cross-site scripting XSS vulnerabilities in Lussumo Vanilla 1.1.4 and earlier 1 allow remote attackers to inject arbitrary web script or HTML via the NewPassword parameter to people.php, and allow remote authenticated users to inject arbitrary web script or HTML via the 2 Account picture...

CVE-2008-3760

The CVE-2008-3760 entry documents a CSRF flaw in Vanilla CMS prior to and including version 1.1.4, located on the sign-out page. The vulnerability lets remote attackers hijack a user’s authenticated session by triggering a logout via a SignOutNow request to people.php, with no user interaction re...

CVE-2008-3758

CVE-2008-3758 involves multiple XSS vulnerabilities in Lussumo Vanilla 1.1.4 and earlier. The affected application is the Lussumo Vanilla content management system. The issues allow remote attackers to inject arbitrary web script or HTML via the NewPassword parameter to people.php , and allow rem...

CVE-2008-3759

Cross-site request forgery CSRF vulnerability in ajax/UpdateCheck.php in Vanilla 1.1.4 and earlier has unknown impact and remote attack vectors...

CVE-2008-3759

CVE-2008-3759 is a Cross-site Request Forgery (CSRF) vulnerability in Vanilla up to version 1.1.4, affecting ajax/UpdateCheck.php. The impact is described as unknown in the initial descriptions, with a CVSSv2 base score of 7.5 (NETWORK attack, LOW attack complexity, no authentication, partial con...

vanilla-xss.txt

GulfTech Security Research August 19, 2008 Vendor : Mark O'Sullivan URL : http://www.getvanilla.com/ Version : Vanilla alert document.cookie%3B The above example link would display the end users cookie to them. Of course this can also be used to steal the cookie data as mentioned earlier in this...

Vanilla <= 1.1.4 Script Injection/ XSS

GulfTech Security Research August 19, 2008 Vendor : Mark O'Sullivan URL : http://www.getvanilla.com/ Version : Vanilla = 1.1.4 Risk : Multiple Vulnerabilities Description: Vanilla is an open-source, standards-compliant, multi-lingual, fully extensible web based discussion forum. Unfortunately the...

Vanilla 1.1.4 - HTML Injection Cross-Site Scripting

Vanilla 1.1.4 - HTML Injection Cross-Site Scripting source: https://www.securityfocus.com/bid/30748/info Vanilla is prone to multiple HTML-injection vulnerabilities and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage these...

Vanilla 1.1.4 - HTML Injection / Cross-Site Scripting

source: https://www.securityfocus.com/bid/30748/info Vanilla is prone to multiple HTML-injection vulnerabilities and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browse...