CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2019-9826
https://notcve.org/view.php?id=CVE-2019-9826
The fulltext search component in phpBB before 3.2.6 allows Denial of Service. El componente de búsqueda de texto completo en PHP versión anterior a 3.2.6 permite una Denegación de Servicio, • http://www.openwall.com/lists/oss-security/2019/04/29/3 https://lists.debian.org/debian-lts-announce/2019/05/msg00004.html https://www.phpbb.com/community/viewtopic.php?f=14&t=2509941 • CWE-20: Improper Input Validation •
CVSS: 7.2EPSS: 59%CPEs: 2EXPL: 1CVE-2018-19274
https://notcve.org/view.php?id=CVE-2018-19274
Passing an absolute path to a file_exists check in phpBB before 3.2.4 allows Remote Code Execution through Object Injection by employing Phar deserialization when an attacker has access to the Admin Control Panel with founder permissions. El paso de una ruta absoluta a una comprobación file_exists en phpBB en versiones anteriores a la 3.2.4 permite la ejecución remota de código mediante una inyección de objetos al emplear la deserialización Phar cuando un atacante tiene acceso al panel de control de administrador con permisos de fundador. • https://blog.ripstech.com/2018/phpbb3-phar-deserialization-to-remote-code-execution https://lists.debian.org/debian-lts-announce/2018/11/msg00029.html https://www.phpbb.com/community/viewtopic.php?f=14&t=2492206 • CWE-502: Deserialization of Untrusted Data CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2017-1000419
https://notcve.org/view.php?id=CVE-2017-1000419
phpBB version 3.2.0 is vulnerable to SSRF in the Remote Avatar function resulting allowing an attacker to perform port scanning, requesting internal content and potentially attacking such internal services via the web application. phpBB, en su versión 3.2.0, es vulnerable a SSRF en la función Remote Avatar. Esto permite que un atacante realice un escaneo de puertos, solicitando contenido interno y atacando potencialmente tales servicios internos a través de la aplicación web. • https://www.phpbb.com/community/viewtopic.php?f=14&p=14782136 https://www.sec-consult.com/en/blog/advisories/phpbb-server-side-request-forgery-vulnerability/index.html • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 6.1EPSS: 0%CPEs: 23EXPL: 0CVE-2015-3880
https://notcve.org/view.php?id=CVE-2015-3880
Open redirect vulnerability in phpBB before 3.0.14 and 3.1.x before 3.1.4 allows remote attackers to redirect users of Google Chrome to arbitrary web sites and conduct phishing attacks via unspecified vectors. Una vulnerabilidad de redirección abierta en phpBB en versiones anteriores a la 3.0.14 y 3.1.x anteriores a la 3.1.4 permite que los atacantes remotos redireccionen a los usuarios de Google Chrome a sitios web arbitrarios y lleven a cabo ataques de phishing mediante vectores sin especificar. • http://www.openwall.com/lists/oss-security/2015/05/12/10 http://www.securityfocus.com/bid/74592 https://github.com/phpbb/phpbb/commit/1a3350619f428d9d69d196c52128727e27ef2f04 https://wiki.phpbb.com/Release_Highlights/3.0.14 https://wiki.phpbb.com/Release_Highlights/3.1.4 https://www.phpbb.com/community/viewtopic.php?f=14&t=2313941 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2015-1431
https://notcve.org/view.php?id=CVE-2015-1431
Cross-site scripting (XSS) vulnerability in includes/startup.php in phpBB before 3.0.13 allows remote attackers to inject arbitrary web script or HTML via vectors related to "Relative Path Overwrite." Vulnerabilidad de XSS en includes/startup.php en phpBB anterior a 3.0.13 permite a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a través de vectores relacionados con 'la sobrescritura de rutas relativas.' • http://seclists.org/oss-sec/2015/q1/373 http://www.securityfocus.com/bid/72405 https://exchange.xforce.ibmcloud.com/vulnerabilities/100670 https://github.com/phpbb/phpbb/commit/eaeb88133f1f028fa06f0ebe5639668436fd469e https://github.com/phpbb/phpbb/pull/3316 https://security.gentoo.org/glsa/201701-25 https://tracker.phpbb.com/browse/PHPBB3-13531 https://wiki.phpbb.com/Release_Highlights/3.0.13 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •