CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2013-2057
https://notcve.org/view.php?id=CVE-2013-2057
11 Feb 2020 — YaBB through 2.5.2: 'guestlanguage' Cookie Parameter Local File Include Vulnerability YaBB versiones hasta 2.5.2: Vulnerabilidad de Inclusión de Archivo Local del Parámetro de Cookie "guestlanguage". • http://www.openwall.com/lists/oss-security/2013/05/05/1 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 8.8EPSS: 1%CPEs: 4EXPL: 0CVE-2007-3295
https://notcve.org/view.php?id=CVE-2007-3295
20 Jun 2007 — Directory traversal vulnerability in Yet another Bulletin Board (YaBB) 2.1 and earlier allows remote authenticated users to execute arbitrary Perl code via a .. (dot dot) in the userlanguage profile setting, which sets the userlanguage key of the member hash, and is propagated to the language variable in (1) HelpCentre.pl and (2) ICQPager.pl, (3) the use_lang variable in Subs.pl, and the actlang variable in (4) Post.pl and (5) InstantMessage.pl; as demonstrated by pointing userlanguage to the English folder... • http://osvdb.org/37238 •
CVSS: 10.0EPSS: 12%CPEs: 1EXPL: 0CVE-2007-3208
https://notcve.org/view.php?id=CVE-2007-3208
14 Jun 2007 — CRLF injection vulnerability in Yet another Bulletin Board (YaBB) 2.1 allows remote attackers to obtain administrative access via requests to (1) register.pl or (2) profile.pl that write CRLF sequences to a .vars file. NOTE: this can be leveraged to execute arbitrary code. Vulnerabilidad de inyección CRLF en Yet another Bulletin Board (YaBB) 2.1 permite a atacantes remotos obtener acceso de administrador a través de respuestas en (1) register.pl o (2) profile.pl que escribe secuencias CRLF en un archivo .va... • http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=538 •
CVSS: 6.1EPSS: 0%CPEs: 10EXPL: 3CVE-2004-2402
https://notcve.org/view.php?id=CVE-2004-2402
31 Dec 2004 — Cross-site scripting (XSS) vulnerability in YaBB.pl in YaBB 1 GOLD SP 1.3.2 allows remote attackers to inject arbitrary web script or HTML via a hex-encoded to parameter. NOTE: some sources say that the board parameter is affected, but this is incorrect. • http://archives.neohapsis.com/archives/bugtraq/2004-09/0227.html •
CVSS: 10.0EPSS: 1%CPEs: 10EXPL: 3CVE-2004-2403
https://notcve.org/view.php?id=CVE-2004-2403
31 Dec 2004 — Cross-site request forgery (CSRF) vulnerability in YaBB 1 GOLD SP 1.3.2 allows remote attackers to perform unauthorized actions as the administrative user via a link or IMG tag to YaBB.pl that specifies the desired action, id, and moda parameters. • http://archives.neohapsis.com/archives/bugtraq/2004-09/0227.html •
CVSS: 7.5EPSS: 6%CPEs: 4EXPL: 3CVE-2002-0117 – YaBB 9.1.2000 - Cross-Agent Scripting
https://notcve.org/view.php?id=CVE-2002-0117
25 Mar 2002 — Cross-site scripting vulnerability in Yet Another Bulletin Board (YaBB) 1 Gold SP 1 and earlier allows remote attackers to execute arbitrary script and steal cookies via a message containing encoded Javascript in an IMG tag. Vulnerabilidad Cross-site todavía en el Bulletin Board de (YaBB) 1 Gold SP 1 y anteriores permite a atacantes remotos ejecutar scripts arbitrarios y cookiess de robo vía un mensaje que contiene Javascript codificado en una etiqueta IMG. • https://www.exploit-db.com/exploits/21208 •