CVSS: 7.2EPSS: 51%CPEs: 2EXPL: 1CVE-2018-19274
https://notcve.org/view.php?id=CVE-2018-19274
Passing an absolute path to a file_exists check in phpBB before 3.2.4 allows Remote Code Execution through Object Injection by employing Phar deserialization when an attacker has access to the Admin Control Panel with founder permissions. El paso de una ruta absoluta a una comprobación file_exists en phpBB en versiones anteriores a la 3.2.4 permite la ejecución remota de código mediante una inyección de objetos al emplear la deserialización Phar cuando un atacante tiene acceso al panel de control de administrador con permisos de fundador. • https://blog.ripstech.com/2018/phpbb3-phar-deserialization-to-remote-code-execution https://lists.debian.org/debian-lts-announce/2018/11/msg00029.html https://www.phpbb.com/community/viewtopic.php?f=14&t=2492206 • CWE-502: Deserialization of Untrusted Data CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') •
CVSS: 6.1EPSS: 0%CPEs: 23EXPL: 0CVE-2015-3880
https://notcve.org/view.php?id=CVE-2015-3880
Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of Google Chrome to arbitrary web sites and conduct phishing attacks via unspecified vectors. Una vulnerabilidad de redirección abierta en phpBB en versiones anteriores a la 3.0.14 y 3.1.x anteriores a la 3.1.4 permite que los atacantes remotos redireccionen a los usuarios de Google Chrome a sitios web arbitrarios y lleven a cabo ataques de phishing mediante vectores sin especificar. • http://www.openwall.com/lists/oss-security/2015/05/12/10 http://www.securityfocus.com/bid/74592 https://github.com/phpbb/phpbb/commit/1a3350619f428d9d69d196c52128727e27ef2f04 https://wiki.phpbb.com/Release_Highlights/3.0.14 https://wiki.phpbb.com/Release_Highlights/3.1.4 https://www.phpbb.com/community/viewtopic.php?f=14&t=2313941 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-1432
https://notcve.org/view.php?id=CVE-2015-1432
The message_options function in includes/ucp/ucp_pm_options.php in phpBB before 3.0.13 does not properly validate the form key, which allows remote attackers to conduct CSRF attacks and change the full folder setting via unspecified vectors. La función message_options en includes/ucp/ucp_pm_options.php en phpBB anterior a 3.0.13 no valida correctamente la clave del formulario, lo que permite a atacantes remotos realizar ataques de CSRF y cambiar la configuración de ficheros completos a través de vectores no especificados. • http://seclists.org/oss-sec/2015/q1/373 http://www.securityfocus.com/bid/72399 https://exchange.xforce.ibmcloud.com/vulnerabilities/100671 https://github.com/phpbb/phpbb/commit/23069a13e203985ab124d1139e8de74b12778449 https://github.com/phpbb/phpbb/pull/3311 https://security.gentoo.org/glsa/201701-25 https://tracker.phpbb.com/browse/PHPBB3-13526 https://wiki.phpbb.com/Release_Highlights/3.0.13 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2015-1431
https://notcve.org/view.php?id=CVE-2015-1431
Cross-site scripting (XSS) vulnerability in includes/startup.php in phpBB before 3.0.13 allows remote attackers to inject arbitrary web script or HTML via vectors related to "Relative Path Overwrite." Vulnerabilidad de XSS en includes/startup.php en phpBB anterior a 3.0.13 permite a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través de vectores relacionados con 'la sobrescritura de rutas relativas.' • http://seclists.org/oss-sec/2015/q1/373 http://www.securityfocus.com/bid/72405 https://exchange.xforce.ibmcloud.com/vulnerabilities/100670 https://github.com/phpbb/phpbb/commit/eaeb88133f1f028fa06f0ebe5639668436fd469e https://github.com/phpbb/phpbb/pull/3316 https://security.gentoo.org/glsa/201701-25 https://tracker.phpbb.com/browse/PHPBB3-13531 https://wiki.phpbb.com/Release_Highlights/3.0.13 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2010-1627
https://notcve.org/view.php?id=CVE-2010-1627
feed.php in phpBB 3.0.7 before 3.0.7-PL1 does not properly check permissions for feeds, which allows remote attackers to bypass intended access restrictions via unspecified attack vectors related to permission settings on a private forum. feed.php en phpBB v3.0.7 anterior a v3.0.7-PL1 no comprueba correctamente los permisos para feeds, lo que permite a usuarios remotos saltarse las restricciones de acceso a través de vectores de ataque no especificados, relacionados con las configuraciones de permisos en un foro privado. • http://www.openwall.com/lists/oss-security/2010/05/16/1 http://www.openwall.com/lists/oss-security/2010/05/18/6 http://www.phpbb.com/community/viewtopic.php?f=14&t=2014195 • CWE-264: Permissions, Privileges, and Access Controls •