vanillaforums vanilla 2.0.17.1 vulnerabilities and exploits

(subscribe to this query)

Open redirect vulnerability in Vanilla Forums prior to 2.0.17.6 allows remote malicious users to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the Target parameter to an unspecified component, a different vulnerability than CVE-2011-0526.

Vanillaforums Vanilla 2.0.11 Vanillaforums Vanilla 2.0.12 Vanillaforums Vanilla 2.0.13 Vanillaforums Vanilla 2.0.14 Vanillaforums Vanilla 2.0.15 Vanillaforums Vanilla 2.0.17.2 Vanillaforums Vanilla 2.0.17.3 Vanillaforums Vanilla 2.0.17.4 Vanillaforums Vanilla Vanillaforums Vanilla 2.0.16 Vanillaforums Vanilla 2.0.17 Vanillaforums Vanilla 2.0.10 Vanillaforums Vanilla 2.0.9 Vanillaforums Vanilla 2.0.17.1

Cross-site scripting (XSS) vulnerability in Vanilla Forums prior to 2.0.17.6 allows remote malicious users to inject arbitrary web script or HTML via the p parameter to an unspecified component, a different vulnerability than CVE-2011-0526.

Vanillaforums Vanilla 2.0.17.2 Vanillaforums Vanilla 2.0.17.3 Vanillaforums Vanilla 2.0.17.4 Vanillaforums Vanilla Vanillaforums Vanilla 2.0.12 Vanillaforums Vanilla 2.0.13 Vanillaforums Vanilla 2.0.14 Vanillaforums Vanilla 2.0.15 Vanillaforums Vanilla 2.0.10 Vanillaforums Vanilla 2.0.9 Vanillaforums Vanilla 2.0.17.1 Vanillaforums Vanilla 2.0.11 Vanillaforums Vanilla 2.0.16 Vanillaforums Vanilla 2.0.17

The cookie implementation in Vanilla Forums prior to 2.0.17.6 makes it easier for remote malicious users to spoof signed requests, and consequently obtain access to arbitrary user accounts, via HMAC timing attacks.

Vanillaforums Vanilla 2.0.10 Vanillaforums Vanilla 2.0.11 Vanillaforums Vanilla 2.0.12 Vanillaforums Vanilla 2.0.13 Vanillaforums Vanilla 2.0.17 Vanillaforums Vanilla 2.0.17.1 Vanillaforums Vanilla 2.0.17.2 Vanillaforums Vanilla 2.0.17.3 Vanillaforums Vanilla 2.0.15 Vanillaforums Vanilla 2.0.9 Vanillaforums Vanilla 2.0.17.4 Vanillaforums Vanilla 2.0.14 Vanillaforums Vanilla 2.0.16 Vanillaforums Vanilla

The edit-profile page in Vanilla Forums prior to 2.1a32 allows remote authenticated users to modify arbitrary profile settings by replacing the UserID value during a man-in-the-middle attack, related to a "parameter manipulation" issue.

Multiple SQL injection vulnerabilities in Vanilla Forums prior to 2.0.18.8 allow remote malicious users to execute arbitrary SQL commands via the parameter name in the Form/Email array to (1) entry/signin or (2) entry/passwordrequest.

1 EDB exploit

Vanilla Forums 2.0.17.1 up to and including 2.0.17.5 has XSS in /vanilla/index.php via the p parameter.

Vanillaforums Vanilla

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook