Show filters
100 Total Results
Displaying 41-50 of 100
Sort by:
Attacker Value
Unknown
CVE-2012-4328
Disclosure Date: August 14, 2012 (last updated October 04, 2023)
Unspecified vulnerability in the MAPI in vBulletin Suite 4.1.2 through 4.1.12, Forum 4.1.2 through 4.1.12, and the MAPI plugin 1.4.3 for vBulletin 3.x has unknown impact and attack vectors.
0
Attacker Value
Unknown
CVE-2012-3844
Disclosure Date: July 03, 2012 (last updated October 04, 2023)
Cross-site scripting (XSS) vulnerability in vBulletin 4.1.12 allows remote attackers to inject arbitrary web script or HTML via a long string in the subject parameter when creating a post.
0
Attacker Value
Unknown
CVE-2009-2172
Disclosure Date: June 23, 2009 (last updated October 04, 2023)
Cross-site scripting (XSS) vulnerability in forum/radioandtv.php in the Radio and TV Player addon for vBulletin allows remote registered users to inject arbitrary web script or HTML via the station parameter.
0
Attacker Value
Unknown
CVE-2008-6256
Disclosure Date: February 24, 2009 (last updated October 04, 2023)
SQL injection vulnerability in admincp/admincalendar.php in vBulletin 3.7.3.pl1 allows remote authenticated administrators to execute arbitrary SQL commands via the holidayinfo[recurring] parameter, a different vector than CVE-2005-3022.
0
Attacker Value
Unknown
CVE-2008-6255
Disclosure Date: February 24, 2009 (last updated October 04, 2023)
Multiple SQL injection vulnerabilities in vBulletin 3.7.4 allow remote authenticated administrators to execute arbitrary SQL commands via the (1) answer parameter to admincp/verify.php, (2) extension parameter in an edit action to admincp/attachmentpermission.php, and the (3) iperm parameter to admincp/image.php.
0
Attacker Value
Unknown
CVE-2008-3773
Disclosure Date: August 22, 2008 (last updated October 04, 2023)
Cross-site scripting (XSS) vulnerability in vBulletin 3.7.2 PL1 and 3.6.10 PL3, when "Show New Private Message Notification Pop-Up" is enabled, allows remote authenticated users to inject arbitrary web script or HTML via a private message subject (aka newpm[title]).
0
Attacker Value
Unknown
CVE-2008-3184
Disclosure Date: July 15, 2008 (last updated October 04, 2023)
Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 3.6.10 PL2 and earlier, and 3.7.2 and earlier 3.7.x versions, allow remote attackers to inject arbitrary web script or HTML via (1) the PATH_INFO (PHP_SELF) or (2) the do parameter, as demonstrated by requests to upload/admincp/faq.php. NOTE: this issue can be leveraged to execute arbitrary PHP code.
0
Attacker Value
Unknown
CVE-2008-2744
Disclosure Date: June 17, 2008 (last updated October 04, 2023)
Cross-site scripting (XSS) vulnerability in vBulletin 3.6.10 and 3.7.1 allows remote attackers to inject arbitrary web script or HTML via unknown vectors and an "obscure method." NOTE: the vector is probably in the redirect parameter to the Admin Control Panel (admincp/index.php).
0
Attacker Value
Unknown
CVE-2008-2460
Disclosure Date: May 27, 2008 (last updated October 04, 2023)
SQL injection vulnerability in faq.php in vBulletin 3.7.0 Gold allows remote attackers to execute arbitrary SQL commands via the q parameter in a search action.
0
Attacker Value
Unknown
CVE-2007-4453
Disclosure Date: August 21, 2007 (last updated November 08, 2023)
Multiple cross-site scripting (XSS) vulnerabilities in vBulletin 3.6.8 allow remote attackers to inject arbitrary web code or HTML via the (1) s parameter to index.php, and the (2) q parameter to (a) faq.php, (b) member.php, (c) memberlist.php, (d) calendar.php, (e) search.php, (f) forumdisplay.php, (g) showgroups.php, (h) online.php, and (i) sendmessage.php. NOTE: these issues have been disputed by the vendor, stating "I can't reproduce a single one of these". The researcher is known to be unreliable
0
