CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 4CVE-2014-2022 – vBulletin 4.x - breadcrumbs via xmlrpc API (Authenticated) SQL Injection
https://notcve.org/view.php?id=CVE-2014-2022
SQL injection vulnerability in includes/api/4/breadcrumbs_create.php in vBulletin 4.2.2, 4.2.1, 4.2.0 PL2, and earlier allows remote authenticated users to execute arbitrary SQL commands via the conceptid argument in an xmlrpc API request. Vulnerabilidad de inyección SQL en includes/api/4/breadcrumbs_create.php en vButellin 4.2.2, 4.2.1, 4.2.0 PL2, y anteriores permite a usuarios remotos autenticados ejecutar comandos SQL arbitrarios a través del argumento conceptid en una petición API a xmlrpc. vBulletin version 4.x suffers from a remote SQL injection vulnerability via the xmlrpc API. • https://www.exploit-db.com/exploits/40115 http://packetstormsecurity.com/files/128696/vBulletin-4.x-SQL-Injection.html http://seclists.org/fulldisclosure/2014/Oct/56 http://www.securityfocus.com/bid/70417 http://www.securitytracker.com/id/1031001 https://github.com/tintinweb/pub/tree/master/pocs/cve-2014-2022 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 3.5EPSS: 0%CPEs: 7EXPL: 5CVE-2014-2021 – vBulletin 4.x/5.x - AdminCP/ApiLog via xmlrpc API (Authenticated) Persistent Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2014-2021
Cross-site scripting (XSS) vulnerability in admincp/apilog.php in vBulletin 4.2.2 and earlier, and 5.0.x through 5.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted XMLRPC API request, as demonstrated using the client name. Vulnerabilidad de XSS en admincp/apilog.php en vBulletin 4.2.2 y versiones anteriores y 5.0.x hasta la versión 5.0.5 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a través de una petición API XMLRPC manipulada, según lo demostrado usando el nombre client. vBulletin versions 5.x and 4.x suffer from a persistent cross site scripting vulnerability. • https://www.exploit-db.com/exploits/40114 http://packetstormsecurity.com/files/128691/vBulletin-5.x-4.x-Persistent-Cross-Site-Scripting.html http://seclists.org/fulldisclosure/2014/Oct/55 http://seclists.org/fulldisclosure/2014/Oct/63 http://www.securityfocus.com/bid/70577 http://www.securitytracker.com/id/1031000 https://exchange.xforce.ibmcloud.com/vulnerabilities/97026 https://github.com/tintinweb/pub/tree/master/pocs/cve-2014-2021 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 9EXPL: 0CVE-2012-4328
https://notcve.org/view.php?id=CVE-2012-4328
Unspecified vulnerability in the MAPI in vBulletin Suite 4.1.2 through 4.1.12, Forum 4.1.2 through 4.1.12, and the MAPI plugin 1.4.3 for vBulletin 3.x has unknown impact and attack vectors. Una vulnerabilidad no especificada en MAPI en vBulletin Suite v4.1.2 a v4.1.12, Forum v4.1.2 a 4.1.12, y el plugin MAPI v1.4.3 para vBulletin v3.x tiene un impacto y vectores de ataque desconocidos. • http://osvdb.org/81474 http://secunia.com/advisories/48917 http://www.securityfocus.com/bid/53226 https://exchange.xforce.ibmcloud.com/vulnerabilities/75160 https://www.vbulletin.com/forum/showthread.php/400162-vBulletin-3-x-MAPI-Plugin-1-4-3-released-with-security-patch-04-23-2012 https://www.vbulletin.com/forum/showthread.php/400164-vBulletin-Security-Patch-for-vBulletin-4-1-2-4-1-11-for-Suite-amp-Forum-04-23-2012 https://www.vbulletin.com/forum/showthread.php/400165-vBulletin-Security&# •
CVSS: 5.8EPSS: 0%CPEs: 13EXPL: 0CVE-2011-5251 – vBulletin 4.1.3 Open Redirect
https://notcve.org/view.php?id=CVE-2011-5251
Open redirect vulnerability in forum/login.php in vBulletin 4.1.3 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the url parameter in a lostpw action. Vulnerabilidad de redirección abierta en forum/login.php en vBulletin v4.1.3 y anteriores, permite a atacantes remotos redirigir a usuarios a sitios web de su elección y llevar a cabo ataques de phishing a través del parámetro url en una acción lostpw. vBulletin versions 3 through 4.1.3 suffer from an open redirect vulnerability. • http://www.vbulletin.com/forum/showthread.php/381014-Potential-Phishing-Vector?p=2166441 • CWE-20: Improper Input Validation •
CVSS: 5.8EPSS: 0%CPEs: 1EXPL: 0CVE-2007-3326
https://notcve.org/view.php?id=CVE-2007-3326
Multiple directory traversal vulnerabilities in vBulletin 3.x.x allow remote attackers to redirect visitors to arbitrary local files via a .. (dot dot) in (1) the loc parameter to admincp/index.php and (2) the Hyperlink information URl field for post Topic in showthread.php, enabling cross-site scripting (XSS) and other attacks, a different vulnerability than CVE-2005-3025.2. Múltiples vulnerabilidades de escalado de directorio en el vBulletin 3.x.x permite a atacantes remotos redirigir a los visitantes a ficheros locales de su elección a través de .. (punto punto) en el (1) parámetro loc del admincp/index.php y (2) el campo URI de información de hiper-enlace para el post Topic en el showthread.php, habilitando secuencias de comandos en sitios cruzados (XSS) y otros ataques. Vulnerabilidad diferente a la CVE-2005-3025.2. • http://securityreason.com/securityalert/2820 http://www.securityfocus.com/archive/1/471835/100/0/threaded http://www.securityfocus.com/archive/1/471838/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/34956 •