CVSS: 4.3EPSS: 0%CPEs: 17EXPL: 1CVE-2008-3184 – vBulletin 3.7.1 - 'admincp/faq.php?Injection adminlog.php' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2008-3184
Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 3.6.10 PL2 and earlier, and 3.7.2 and earlier 3.7.x versions, allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO (PHP_SELF) or (2) the do parameter, as demonstrated by requests to upload/admincp/faq.php. NOTE: this issue can be leveraged to execute arbitrary PHP code. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en vBulletin 3.6.10 PL2 y anteriores, y 3.7.2 versiones anteriores a 3.7.x; permiten a atacantes remotos inyectar secuencias de comandos Web o HTML de su elección mediante (1) el PATH_INFO (PHP_SELF) o (2) el parámetro do, como se ha demostrado en peticiones a upload/admincp/faq.php. NOTA: Esta vulnerabilidad puede ser aprovechada para ejecutar código PHP arbitrario. • https://www.exploit-db.com/exploits/32017 http://secunia.com/advisories/30991 http://securityreason.com/securityalert/4000 http://www.securityfocus.com/archive/1/494049/100/0/threaded http://www.securityfocus.com/bid/30134 http://www.vbulletin.com/forum/showthread.php?t=277945 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 2CVE-2008-2744 – vBulletin 3.6.10/3.7.1 - 'redirect' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2008-2744
Cross-site scripting (XSS) vulnerability in vBulletin 3.6.10 and 3.7.1 allows remote attackers to inject arbitrary web script or HTML via unknown vectors and an "obscure method." NOTE: the vector is probably in the redirect parameter to the Admin Control Panel (admincp/index.php). Vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en vBulletin 3.6.10 y 3.7.1, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores desconocidos y un "método oscuro". NOTA: el vector de ataque probablemente sea el parámetro redirect en el Admin Control Panel (admincp/index.php). • https://www.exploit-db.com/exploits/31910 http://secunia.com/advisories/30733 http://securityreason.com/securityalert/3946 http://www.securityfocus.com/archive/1/493340/100/0/threaded http://www.securityfocus.com/bid/29704 http://www.securitytracker.com/id?1020322 http://www.vbulletin.com/forum/showthread.php?t=274882 https://exchange.xforce.ibmcloud.com/vulnerabilities/43090 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2008-2460
https://notcve.org/view.php?id=CVE-2008-2460
SQL injection vulnerability in faq.php in vBulletin 3.7.0 Gold allows remote attackers to execute arbitrary SQL commands via the q parameter in a search action. Vulnerabilidad de inyección SQL en faq.php de vBulletin 3.7.0 Gold permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro q en una acción search. • http://www.securityfocus.com/archive/1/492290/100/0/threaded http://www.securityfocus.com/bid/29293 https://exchange.xforce.ibmcloud.com/vulnerabilities/42541 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2007-4453
https://notcve.org/view.php?id=CVE-2007-4453
Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 3.6.8 allow remote attackers to inject arbitrary web code or HTML via the (1) s parameter to index.php, and the (2) q parameter to (a) faq.php, (b) member.php, (c) memberlist.php, (d) calendar.php, (e) search.php, (f) forumdisplay.php, (g) showgroups.php, (h) online.php, and (i) sendmessage.php. NOTE: these issues have been disputed by the vendor, stating "I can't reproduce a single one of these". The researcher is known to be unreliable ** IMPUGNADA ** Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en vBulletin 3.6.8 permiten a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través del parámetro (2) s de index.php, y el parámetro (2) q de (a) faq.php, (b) member.php, (c) memberlist.php, (d) calendar.php, (e) search.php, (f) forumdisplay.php, (g) showgroups.php, (h) online.php, y (i) sendmessage.php. NOTA: estos problemas han sido negados por el fabricante, afirmando que "no puede reproducir ni uno solo de ellos". Se sabe que el investigador no es fiable. • http://www.securityfocus.com/archive/1/476924/100/0/threaded http://www.securityfocus.com/archive/1/476940/100/0/threaded https://exchange.xforce.ibmcloud.com/vulnerabilities/36084 •
CVSS: 9.3EPSS: 1%CPEs: 1EXPL: 1CVE-2007-4120
https://notcve.org/view.php?id=CVE-2007-4120
Multiple PHP remote file inclusion vulnerabilities in Jelsoft vBulletin 3.6.5 allow remote attackers to execute arbitrary PHP code via a URL in the (1) classfile parameter to includes/functions.php, the (2) nextitem parameter to includes/functions_cron.php, and the (3) specialtemplates parameter to includes/functions_forumdisplay.php. NOTE: this issue is disputed by a reliable third party who states "further investigation has revealed that the application is not vulnerable to this issue." The original researcher also has a history of erroneous claims ** IMPUGNADA ** Múltiples vulnerabilidades de inclusión remota de archivo en PHP en Jelsoft vBulletin 3.6.5 permite a atacantes remotos ejecutar código PHP de su elección mediante un URL en los parámetros (1) classfile a includes/functions.php, (2) nextitem a includes/functions_cron.php, y (3) specialtemplates a includes/functions_forumdisplay.php. NOTA: este asunto es impugnado por una tercera parte de fiar que afirma "investigaciones posteriores han revelado que la aplicación no es vulnerable a este asunto". El investigador original también tiene un historial de reclamaciones erróneas. • http://securityreason.com/securityalert/2941 http://www.securityfocus.com/archive/1/475105/100/0/threaded http://www.securityfocus.com/archive/1/475151/100/0/threaded http://www.securityfocus.com/bid/25141 •