CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2013-2057
https://notcve.org/view.php?id=CVE-2013-2057
YaBB through 2.5.2: 'guestlanguage' Cookie Parameter Local File Include Vulnerability YaBB versiones hasta 2.5.2: Vulnerabilidad de Inclusión de Archivo Local del Parámetro de Cookie "guestlanguage". • http://www.openwall.com/lists/oss-security/2013/05/05/1 http://www.securityfocus.com/bid/59643 https://exchange.xforce.ibmcloud.com/vulnerabilities/84034 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2007-3295
https://notcve.org/view.php?id=CVE-2007-3295
Directory traversal vulnerability in Yet another Bulletin Board (YaBB) 2.1 and earlier allows remote authenticated users to execute arbitrary Perl code via a .. (dot dot) in the userlanguage profile setting, which sets the userlanguage key of the member hash, and is propagated to the language variable in (1) HelpCentre.pl and (2) ICQPager.pl, (3) the use_lang variable in Subs.pl, and the actlang variable in (4) Post.pl and (5) InstantMessage.pl; as demonstrated by pointing userlanguage to the English folder, modifying English/HelpCentre.lng file to contain Perl statements, and then invoking the help action in YaBB.pl. Vulnerabilidad de salto de directorio en Yet another Bulletin Board (YaBB) 2.1 y anteriores permite a usuarios remotos autenticados ejecutar código perl de su elección mediante una secuencia .. (punto punto) en la configuración de lenguaje del perfil del usuario, el cual establece la clave userlanguage del hash del miembro, y es propagada a la variable language en (1) HelpCentre.pl y (2) ICQPager.pl, (3) la variable use_lang en Subs.pl, y la variable actlang en (4) Post.pl y (5) InstantMessage.pl; como ha sido demostrado indicando el lenguaje de usuario en la carpeta English, modificando el fichero English/HelpCentre.lng que contiene sentencias Perl, y entonces invocando la acción help en YaBB.pl. • http://osvdb.org/37238 http://secunia.com/advisories/25734 http://securityreason.com/securityalert/2818 http://www.securityfocus.com/archive/1/471733/100/0/threaded http://www.securityfocus.com/bid/24529 https://exchange.xforce.ibmcloud.com/vulnerabilities/34932 •
CVSS: 4.0EPSS: 0%CPEs: 12EXPL: 0CVE-2005-4426
https://notcve.org/view.php?id=CVE-2005-4426
Interpretation conflict in YaBB before 2.1 allows remote authenticated users to inject arbitrary web script or HTML via HTML in a file with a GIF file extension, which causes the HTML to be executed by a victim who views the file in Internet Explorer as a result of CVE-2005-3312. NOTE: it could be argued that this vulnerability is due to a design flaw in Internet Explorer and the proper fix should be in that browser; if so, then this should not be treated as a vulnerability in YaBB. • http://secunia.com/advisories/17411 http://www.securityfocus.com/bid/15368 http://www.yabbforum.com/downloads.php https://exchange.xforce.ibmcloud.com/vulnerabilities/23020 •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2005-0785
https://notcve.org/view.php?id=CVE-2005-0785
Cross-site scripting (XSS) vulnerability in usersrecentposts in YaBB 2.0 rc1 allows remote attackers to inject arbitrary web script or HTML via the username parameter. • http://marc.info/?l=bugtraq&m=111083400601759&w=2 http://securitytracker.com/id?1013420 http://www.securityfocus.com/bid/12756 https://exchange.xforce.ibmcloud.com/vulnerabilities/19671 •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 2CVE-2005-0741 – YaBB 2.0 - Remote UsersRecentPosts Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2005-0741
Cross-site scripting (XSS) vulnerability in YaBB.pl for YaBB 2.0 RC1 allows remote attackers to inject arbitrary web script or HTML via the username parameter in a usersrecentposts action. • https://www.exploit-db.com/exploits/25199 http://securitytracker.com/id?1013420 http://www.securityfocus.com/bid/12756 •