CVSS: 7.5EPSS: 0%CPEs: 62EXPL: 0CVE-2011-3615
https://notcve.org/view.php?id=CVE-2011-3615
Multiple SQL injection vulnerabilities in Simple Machines Forum (SMF) before 1.1.15 and 2.x before 2.0.1 allow remote attackers to execute arbitrary SQL commands via vectors involving a (1) HTML entity or (2) display name. NOTE: some of these details are obtained from third party information. Multiples vulnerabilidades de inyección SQL en Simple Machines Forum (SMF) anterios a v1.1.15 y v2.x anteriores a 2.0.1 que permiten a atacantes remotos ejecutar comandos SQL de su elección a traves de vectores que incluyen una (1) entidad HTML o (2) muestran nombre. NOTA: algunos de estos detalles han sido obtenidos a partir de la información de terceros. • http://openwall.com/lists/oss-security/2011/10/09/3 http://openwall.com/lists/oss-security/2011/10/10/6 http://secunia.com/advisories/46386 http://www.simplemachines.org/community/index.php?topic=452888.0 https://exchange.xforce.ibmcloud.com/vulnerabilities/70617 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 57EXPL: 0CVE-2011-1130
https://notcve.org/view.php?id=CVE-2011-1130
Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, does not properly validate the start parameter, which might allow remote attackers to conduct SQL injection attacks, obtain sensitive information, or cause a denial of service via a crafted value, related to the cleanRequest function in QueryString.php and the constructPageIndex function in Subs.php. Simple Machines Forum (SMF ) antes de v1.1.13, y v2.x antes de v2.0 RC5, no valida correctamente los parámetros de inicio, lo que podría permitir a atacantes remotos realizar ataques de inyección SQL, obtener información sensible o causar una denegación de servicio a través de un valor creado, en relación con la función cleanRequest en QueryString.php y la función constructPageIndex en Subs.php. • http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip http://www.openwall.com/lists/oss-security/2011/02/22/17 http://www.openwall.com/lists/oss-security/2011/03/02/4 http://www.simplemachines.org/community/index.php?topic=421547.0 • CWE-20: Improper Input Validation •
CVSS: 10.0EPSS: 0%CPEs: 57EXPL: 0CVE-2011-1127
https://notcve.org/view.php?id=CVE-2011-1127
SSI.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, does not properly restrict guest access, which allows remote attackers to have an unspecified impact via unknown vectors. SSI.php en Simple Machines Forum ( SMF ) antes de v1.1.13, y v2.x antes de v2.0 RC5, no restringe correctamente el acceso de invitados, lo que permite a atacantes remotos tener un impacto no especificado a través de vectores desconocidos. • http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip http://www.openwall.com/lists/oss-security/2011/02/22/17 http://www.openwall.com/lists/oss-security/2011/03/02/4 http://www.simplemachines.org/community/index.php?topic=421547.0 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.5EPSS: 0%CPEs: 57EXPL: 0CVE-2011-1128
https://notcve.org/view.php?id=CVE-2011-1128
The loadUserSettings function in Load.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, does not properly handle invalid login attempts, which might make it easier for remote attackers to obtain access or cause a denial of service via a brute-force attack. La función loadUserSettings en ??load.php en Simple Machines Forum (SMF ) antes de v1.1.13, y v2.x antes de v2.0 RC5, no controla correctamente intentos fallidos de inicio de sesión, lo que podría facilitar a los atacantes remotos obtener acceso o causar una denegación de servicio a través de un ataque de fuerza bruta. • http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip http://www.openwall.com/lists/oss-security/2011/02/22/17 http://www.openwall.com/lists/oss-security/2011/03/02/4 http://www.simplemachines.org/community/index.php?topic=421547.0 • CWE-310: Cryptographic Issues •
CVSS: 3.5EPSS: 0%CPEs: 57EXPL: 0CVE-2011-1129
https://notcve.org/view.php?id=CVE-2011-1129
Cross-site scripting (XSS) vulnerability in the EditNews function in ManageNews.php in Simple Machines Forum (SMF) before 1.1.13, and 2.x before 2.0 RC5, might allow remote authenticated users to inject arbitrary web script or HTML via a save_items action. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en la función EditNews en ManageNews.php de Simple Machines Forum antes de v1.1.13 y v2.x antes de 2.0 RC5 , permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de la acción save_items. • http://custom.simplemachines.org/mods/downloads/smf_patch_2.0-RC4_security.zip http://www.openwall.com/lists/oss-security/2011/02/22/17 http://www.openwall.com/lists/oss-security/2011/03/02/4 http://www.simplemachines.org/community/index.php?topic=421547.0 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •