CVSS: 10.0EPSS: 0%CPEs: 57EXPL: 0CVE-2011-1127
https://notcve.org/view.php?id=CVE-2011-1127
SSI.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, does not properly restrict guest access, which allows remote attackers to have an unspecified impact via unknown vectors. SSI.php en Simple Machines Forum ( SMF ) antes de v1.1.13, y v2.x antes de v2.0 RC5, no restringe correctamente el acceso de invitados, lo que permite a atacantes remotos tener un impacto no especificado a través de vectores desconocidos. • http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip http://www.openwall.com/lists/oss-security/2011/02/22/17 http://www.openwall.com/lists/oss-security/2011/03/02/4 http://www.simplemachines.org/community/index.php?topic=421547.0 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 0%CPEs: 57EXPL: 0CVE-2011-1128
https://notcve.org/view.php?id=CVE-2011-1128
The loadUserSettings function in Load.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, does not properly handle invalid login attempts, which might make it easier for remote attackers to obtain access or cause a denial of service via a brute-force attack. La función loadUserSettings en ??load.php en Simple Machines Forum (SMF ) antes de v1.1.13, y v2.x antes de v2.0 RC5, no controla correctamente intentos fallidos de inicio de sesión, lo que podría facilitar a los atacantes remotos obtener acceso o causar una denegación de servicio a través de un ataque de fuerza bruta. • http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip http://www.openwall.com/lists/oss-security/2011/02/22/17 http://www.openwall.com/lists/oss-security/2011/03/02/4 http://www.simplemachines.org/community/index.php?topic=421547.0 • CWE-310: Cryptographic Issues •
CVSS: 3.5EPSS: 0%CPEs: 57EXPL: 0CVE-2011-1129
https://notcve.org/view.php?id=CVE-2011-1129
Cross-site scripting (XSS) vulnerability in the EditNews function in ManageNews.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, might allow remote authenticated users to inject arbitrary web script or HTML via a save_items action. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en la función EditNews en ManageNews.php de Simple Machines Forum antes de v1.1.13 y v2.x antes de 2.0 RC5 , permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de la acción save_items. • http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip http://www.openwall.com/lists/oss-security/2011/02/22/17 http://www.openwall.com/lists/oss-security/2011/03/02/4 http://www.simplemachines.org/community/index.php?topic=421547.0 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 57EXPL: 0CVE-2011-1131
https://notcve.org/view.php?id=CVE-2011-1131
The PlushSearch2 function in Search.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, uses certain cached data in a situation where a temporary table has been created, even though this cached data is intended only for situations where a temporary table has not been created, which might allow remote attackers to obtain sensitive information via a search. La función PlushSearch2 en Search.php de Simple Machines Forum (SMF)antes de v1.1.13 y v2.x antes de v2.0 RC5, usa ciertos datos almacenados en caché en una situación en la que ha sido creada una tabla temporal , a pesar de estos datos en caché solo se usan en situaciones en las que una tabla temporal no se ha creado, lo que podría permitir a atacantes remotos obtener información sensible a través de una búsqueda. • http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip http://www.openwall.com/lists/oss-security/2011/02/22/17 http://www.openwall.com/lists/oss-security/2011/03/02/4 http://www.simplemachines.org/community/index.php?topic=421547.0 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 11%CPEs: 7EXPL: 2CVE-2008-6971 – Simple Machines Forum (SMF) 1.1.5 (Windows x86) - Admin Reset Password
https://notcve.org/view.php?id=CVE-2008-6971
The password reset functionality in Simple Machines Forum (SMF) 1.0.x before 1.0.14, 1.1.x before 1.1.6, and 2.0 before 2.0 beta 4 includes clues about the random number generator state within a hidden form field and generates predictable validation codes, which allows remote attackers to modify passwords of other users and gain privileges. La funcionalidad de reinicio de contraseña en Simple Machines Forum (SMF) v1.0.x anteriores a v1.0.14, v1.1.x anteriores a v1.1.6, y v2.0 anteriores a v2.0 beta 4 incluye pistas acerca del estado del generador de número aleatorios con un campo del formulario escondido y genera códigos validados predecibles, lo que permite a los atacantes remotos, modificar la contraseña de otros usuario y obtener privilegios. • https://www.exploit-db.com/exploits/6392 http://osvdb.org/47945 http://secunia.com/advisories/31750 http://www.securityfocus.com/bid/31053 http://www.simplemachines.org/community/index.php?topic=260145.0 https://exchange.xforce.ibmcloud.com/vulnerabilities/44931 • CWE-255: Credentials Management Errors •