YaBB SE <= 1.5.5 profile.php user Parameter SQL Injection

Binary data 3669.prm...

CVE-2005-4426

Interpretation conflict in YaBB before 2.1 allows remote authenticated users to inject arbitrary web script or HTML via HTML in a file with a GIF file extension, which causes the HTML to be executed by a victim who views the file in Internet Explorer as a result of CVE-2005-3312. NOTE: it could b...

CVE-2005-4426

CVE-2005-4426 involves YaBB before 2.1 where an interpretation conflict allows remote authenticated users to inject arbitrary web script or HTML via HTML in a file with a GIF extension, causing the HTML to execute in Internet Explorer (as described for CVE-2005-3312). The issue is tied to YaBB’s ...

CVE-2005-4426

Interpretation conflict in YaBB before 2.1 allows remote authenticated users to inject arbitrary web script or HTML via HTML in a file with a GIF file extension, which causes the HTML to be executed by a victim who views the file in Internet Explorer as a result of CVE-2005-3312. NOTE: it could b...

CVE-2003-1277

CVE-2003-1277 describes cross-site scripting (XSS) in YaBB 1.5.0. The vulnerability allows remote attackers to execute arbitrary scripts as other users and potentially steal authentication information via cookies by injecting HTML/script into (1) news_icon of news_template.php and (2) threadid an...

CVE-2003-1277

Cross-site scripting XSS vulnerabilities in Yet Another Bulletin Board YaBB 1.5.0 allow remote attackers to execute arbitrary script as other users and possibly steal authentication information via cookies by injecting arbitrary HTML or script into 1 newsicon of newstemplate.php, and 2 threadid a...

[SA17411] YaBB Attachment Script Insertion Vulnerability

TITLE: YaBB Attachment Script Insertion Vulnerability SECUNIA ADVISORY ID: SA17411 VERIFY ADVISORY: http://secunia.com/advisories/17411/ CRITICAL: Moderately critical IMPACT: Unknown, Cross Site Scripting WHERE: From remote SOFTWARE: YaBB 2.x http://secunia.com/product/6070/ DESCRIPTION: A...

YaBB 1 GOLD SP 1.3.2 Multiple Vulnerabilities

Yet another Bulletin Board YaBB is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2004 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2004-2402

Cross-site scripting XSS vulnerability in YaBB.pl in YaBB 1 GOLD SP 1.3.2 allows remote attackers to inject arbitrary web script or HTML via a hex-encoded to parameter. NOTE: some sources say that the board parameter is affected, but this is incorrect...

CVE-2004-2403

Cross-site request forgery CSRF vulnerability in YaBB 1 GOLD SP 1.3.2 allows remote attackers to perform unauthorized actions as the administrative user via a link or IMG tag to YaBB.pl that specifies the desired action, id, and moda parameters...

CVE-2004-2403

CVE-2004-2403 describes a CSRF vulnerability in YaBB 1 GOLD SP 1.3.2. An attacker can cause the administrative user to perform unauthorized actions by enticing the admin to click a crafted link or view an IMG tag that targets YaBB.pl with specific action, id, and moda parameters. The vulnerabilit...

CVE-2004-2140

CRLF injection vulnerability in YaBB 1 Gold before 1.3.2 allows remote attackers to modify text file contents via the subject variable...

CVE-2004-2140

CVE-2004-2140 describes a CRLF injection in YaBB 1 Gold before 1.3.2, where an attacker can modify text file contents via the subject parameter. Affected product: YaBB 1 Gold web forum software (pre-1.3.2). Root cause: input handling allows CRLF injection in the subject field, enabling unauthoriz...

CVE-2004-2139

CVE-2004-2139 affects YaBB 1 Gold prior to 1.3.2. The vulnerability is described as an arbitrary code execution via the settings.pl path in Adminedit.pl, indicating a remote attacker could leverage this in the YaBB 1 Gold web forum software. Affected component/file: YaBB 1 Gold

CVE-2002-1846

Yet Another Bulletin Board YaBB 1.40 and 1.41 does not require a user to submit the correct password before changing it to a new password, which allows remote attackers to modify passwords by stealing the cookie of another user, modifying the expiretime setting, and submitting the change in a...

CVE-2002-1846

YaBB vulnerable: YaBB 1.40/1.41 allows changing a user’s password without providing the correct password, by leveraging a stolen cookie and submitting a profile2 action to index.php. This lets remote attackers modify the password and adjust the expiretime setting. Root cause is insufficient authe...

CVE-2002-1845

Cross-site scripting XSS vulnerability in index.php in Yet Another Bulletin Board YaBB 1.40 and 1.41 allows remote attackers to inject arbitrary web script or HTML via the password passwrd parameter...

CVE-2002-1845

CVE-2002-1845 is an XSS vulnerability in Yet Another Bulletin Board (YaBB) versions 1.40 and 1.41, where the password parameter (passwrd) can be exploited by remote attackers to inject arbitrary web script/HTML via index.php. The connected sources confirm the affected product/version and the vuln...

CVE-2004-1982

CVE-2004-1982 affects YaBB 1 Gold SP 1.2, where Post.pl allows remote attackers to modify records in the board’s .txt file by sending carriage return characters in the subject field. The available documents describe the vulnerability and impact as modification of board records, but do not provide...

CVE-2004-1827

CVE-2004-1827 is an XSS vulnerability in YaBB 1 Gold(SP1.3) and YaBB SE 1.5.1 Final. The issue allows remote attackers to inject arbitrary web script via the background:url property in (1) glow or (2) shadow tags. Affected software is YaBBForum components mentioned in the CVE record, with the vul...