CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-9826
https://notcve.org/view.php?id=CVE-2019-9826
The fulltext search component in phpBB before 3.2.6 allows Denial of Service. El componente de búsqueda de texto completo en PHP versión anterior a 3.2.6 permite una Denegación de Servicio, • http://www.openwall.com/lists/oss-security/2019/04/29/3 https://lists.debian.org/debian-lts-announce/2019/05/msg00004.html https://www.phpbb.com/community/viewtopic.php?f=14&t=2509941 • CWE-20: Improper Input Validation •
CVSS: 7.2EPSS: 51%CPEs: 2EXPL: 1CVE-2018-19274
https://notcve.org/view.php?id=CVE-2018-19274
Passing an absolute path to a file_exists check in phpBB before 3.2.4 allows Remote Code Execution through Object Injection by employing Phar deserialization when an attacker has access to the Admin Control Panel with founder permissions. El paso de una ruta absoluta a una comprobación file_exists en phpBB en versiones anteriores a la 3.2.4 permite la ejecución remota de código mediante una inyección de objetos al emplear la deserialización Phar cuando un atacante tiene acceso al panel de control de administrador con permisos de fundador. • https://blog.ripstech.com/2018/phpbb3-phar-deserialization-to-remote-code-execution https://lists.debian.org/debian-lts-announce/2018/11/msg00029.html https://www.phpbb.com/community/viewtopic.php?f=14&t=2492206 • CWE-502: Deserialization of Untrusted Data CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2017-1000419
https://notcve.org/view.php?id=CVE-2017-1000419
phpBB version 3.2.0 is vulnerable to SSRF in the Remote Avatar function resulting allowing an attacker to perform port scanning, requesting internal content and potentially attacking such internal services via the web application. phpBB, en su versión 3.2.0, es vulnerable a SSRF en la función Remote Avatar. Esto permite que un atacante realice un escaneo de puertos, solicitando contenido interno y atacando potencialmente tales servicios internos a través de la aplicación web. • https://www.phpbb.com/community/viewtopic.php?f=14&p=14782136 https://www.sec-consult.com/en/blog/advisories/phpbb-server-side-request-forgery-vulnerability/index.html • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 6.1EPSS: 0%CPEs: 23EXPL: 0CVE-2015-3880
https://notcve.org/view.php?id=CVE-2015-3880
Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of Google Chrome to arbitrary web sites and conduct phishing attacks via unspecified vectors. Una vulnerabilidad de redirección abierta en phpBB en versiones anteriores a la 3.0.14 y 3.1.x anteriores a la 3.1.4 permite que los atacantes remotos redireccionen a los usuarios de Google Chrome a sitios web arbitrarios y lleven a cabo ataques de phishing mediante vectores sin especificar. • http://www.openwall.com/lists/oss-security/2015/05/12/10 http://www.securityfocus.com/bid/74592 https://github.com/phpbb/phpbb/commit/1a3350619f428d9d69d196c52128727e27ef2f04 https://wiki.phpbb.com/Release_Highlights/3.0.14 https://wiki.phpbb.com/Release_Highlights/3.1.4 https://www.phpbb.com/community/viewtopic.php?f=14&t=2313941 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-1432
https://notcve.org/view.php?id=CVE-2015-1432
The message_options function in includes/ucp/ucp_pm_options.php in phpBB before 3.0.13 does not properly validate the form key, which allows remote attackers to conduct CSRF attacks and change the full folder setting via unspecified vectors. La función message_options en includes/ucp/ucp_pm_options.php en phpBB anterior a 3.0.13 no valida correctamente la clave del formulario, lo que permite a atacantes remotos realizar ataques de CSRF y cambiar la configuración de ficheros completos a través de vectores no especificados. • http://seclists.org/oss-sec/2015/q1/373 http://www.securityfocus.com/bid/72399 https://exchange.xforce.ibmcloud.com/vulnerabilities/100671 https://github.com/phpbb/phpbb/commit/23069a13e203985ab124d1139e8de74b12778449 https://github.com/phpbb/phpbb/pull/3311 https://security.gentoo.org/glsa/201701-25 https://tracker.phpbb.com/browse/PHPBB3-13526 https://wiki.phpbb.com/Release_Highlights/3.0.13 • CWE-352: Cross-Site Request Forgery (CSRF) •