Show filters
9 Total Results
Displaying 1-9 of 9
Sort by:
Attacker Value
Unknown

CVE-2005-4426

Disclosure Date: December 20, 2005 (last updated February 22, 2025)
Interpretation conflict in YaBB before 2.1 allows remote authenticated users to inject arbitrary web script or HTML via HTML in a file with a GIF file extension, which causes the HTML to be executed by a victim who views the file in Internet Explorer as a result of CVE-2005-3312. NOTE: it could be argued that this vulnerability is due to a design flaw in Internet Explorer and the proper fix should be in that browser; if so, then this should not be treated as a vulnerability in YaBB.
0
0
Attacker Value
Unknown

CVE-2004-2402

Disclosure Date: December 31, 2004 (last updated February 22, 2025)
Cross-site scripting (XSS) vulnerability in YaBB.pl in YaBB 1 GOLD SP 1.3.2 allows remote attackers to inject arbitrary web script or HTML via a hex-encoded to parameter. NOTE: some sources say that the board parameter is affected, but this is incorrect.
0
0
Attacker Value
Unknown

CVE-2004-2140

Disclosure Date: December 31, 2004 (last updated February 22, 2025)
CRLF injection vulnerability in YaBB 1 Gold before 1.3.2 allows remote attackers to modify text file contents via the subject variable.
0
0
Attacker Value
Unknown

CVE-2004-2403

Disclosure Date: December 31, 2004 (last updated February 22, 2025)
Cross-site request forgery (CSRF) vulnerability in YaBB 1 GOLD SP 1.3.2 allows remote attackers to perform unauthorized actions as the administrative user via a link or IMG tag to YaBB.pl that specifies the desired action, id, and moda parameters.
0
0
Attacker Value
Unknown

CVE-2004-2139

Disclosure Date: December 31, 2004 (last updated February 22, 2025)
Unknown vulnerability in Adminedit.pl YaBB 1 Gold before 1.3.2 allows attackers to execute arbitrary code via settings.pl.
0
0
Attacker Value
Unknown

CVE-2004-1982

Disclosure Date: May 03, 2004 (last updated February 22, 2025)
Post.pl in YaBB 1 Gold SP 1.2 allows remote attackers to modify records in the board's .txt file via carriage return characters in the subject field.
0
0
Attacker Value
Unknown

CVE-2004-1827

Disclosure Date: March 15, 2004 (last updated February 22, 2025)
Cross-site scripting (XSS) vulnerability in YaBB 1 Gold(SP1.3) and YaBB SE 1.5.1 Final allows remote attackers to inject arbitrary web script via the background:url property in (1) glow or (2) shadow tags.
0
0
Attacker Value
Unknown

CVE-2002-2296

Disclosure Date: December 31, 2002 (last updated February 22, 2025)
Cross-site scripting (XSS) vulnerability in YaBB.pl in Yet Another Bulletin Board (YaBB) 1 Gold SP 1 allows remote attackers to inject arbitrary web script or HTML via the num parameter.
0
0
Attacker Value
Unknown

CVE-2002-0955

Disclosure Date: October 04, 2002 (last updated February 22, 2025)
Cross-site scripting vulnerability in YaBB.cgi for Yet Another Bulletin Board (YaBB) 1 Gold SP1 and earlier allows remote attackers to execute arbitrary script as other web site visitors via script in the num parameter, which is not filtered in the resulting error message.
0
0