Vulnerabilites related to ilia_alshanetsky - fudforum
cve-2013-5309
Vulnerability from cvelistv5
Published
2013-08-16 17:00
Modified
2024-08-06 17:06
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in install/forum_data/src/custom_fields.inc.t in FUDforum 3.0.4.1 and earlier, when registering a new user, allows remote attackers to inject arbitrary web script or HTML via a custom profile field to index.php. NOTE: some of these details are obtained from third party information.
References
| ▼ | URL | Tags |
|---|---|---|
| http://sourceforge.net/p/fudforum/code/5589/ | x_refsource_CONFIRM | |
| http://secunia.com/advisories/54293 | third-party-advisory, x_refsource_SECUNIA | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/86030 | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T17:06:52.321Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://sourceforge.net/p/fudforum/code/5589/"
},
{
"name": "54293",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/54293"
},
{
"name": "fudforum-index-xss(86030)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/86030"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-07-29T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in install/forum_data/src/custom_fields.inc.t in FUDforum 3.0.4.1 and earlier, when registering a new user, allows remote attackers to inject arbitrary web script or HTML via a custom profile field to index.php. NOTE: some of these details are obtained from third party information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://sourceforge.net/p/fudforum/code/5589/"
},
{
"name": "54293",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/54293"
},
{
"name": "fudforum-index-xss(86030)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/86030"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-5309",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in install/forum_data/src/custom_fields.inc.t in FUDforum 3.0.4.1 and earlier, when registering a new user, allows remote attackers to inject arbitrary web script or HTML via a custom profile field to index.php. NOTE: some of these details are obtained from third party information."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://sourceforge.net/p/fudforum/code/5589/",
"refsource": "CONFIRM",
"url": "http://sourceforge.net/p/fudforum/code/5589/"
},
{
"name": "54293",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/54293"
},
{
"name": "fudforum-index-xss(86030)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/86030"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-5309",
"datePublished": "2013-08-16T17:00:00",
"dateReserved": "2013-08-16T00:00:00",
"dateUpdated": "2024-08-06T17:06:52.321Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2002-1422
Vulnerability from cvelistv5
Published
2003-03-18 05:00
Modified
2024-08-08 03:26
Severity ?
EPSS score ?
Summary
admbrowse.php in FUDforum before 2.2.0 allows remote attackers to create or delete files via URL-encoded pathnames in the cur and dest parameters.
References
| ▼ | URL | Tags |
|---|---|---|
| http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0082.html | mailing-list, x_refsource_VULNWATCH | |
| http://www.securityfocus.com/bid/5502 | vdb-entry, x_refsource_BID | |
| http://online.securityfocus.com/archive/1/288042 | mailing-list, x_refsource_BUGTRAQ | |
| http://www.iss.net/security_center/static/9901.php | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T03:26:28.305Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20020818 FUDforum file access and SQL Injection",
"tags": [
"mailing-list",
"x_refsource_VULNWATCH",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0082.html"
},
{
"name": "5502",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/5502"
},
{
"name": "20020818 FUDforum file access and SQL Injection",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://online.securityfocus.com/archive/1/288042"
},
{
"name": "fudforum-admnbrowse-modify-files(9901)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "http://www.iss.net/security_center/static/9901.php"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2002-08-18T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "admbrowse.php in FUDforum before 2.2.0 allows remote attackers to create or delete files via URL-encoded pathnames in the cur and dest parameters."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2003-03-21T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20020818 FUDforum file access and SQL Injection",
"tags": [
"mailing-list",
"x_refsource_VULNWATCH"
],
"url": "http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0082.html"
},
{
"name": "5502",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/5502"
},
{
"name": "20020818 FUDforum file access and SQL Injection",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://online.securityfocus.com/archive/1/288042"
},
{
"name": "fudforum-admnbrowse-modify-files(9901)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "http://www.iss.net/security_center/static/9901.php"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2002-1422",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "admbrowse.php in FUDforum before 2.2.0 allows remote attackers to create or delete files via URL-encoded pathnames in the cur and dest parameters."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20020818 FUDforum file access and SQL Injection",
"refsource": "VULNWATCH",
"url": "http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0082.html"
},
{
"name": "5502",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/5502"
},
{
"name": "20020818 FUDforum file access and SQL Injection",
"refsource": "BUGTRAQ",
"url": "http://online.securityfocus.com/archive/1/288042"
},
{
"name": "fudforum-admnbrowse-modify-files(9901)",
"refsource": "XF",
"url": "http://www.iss.net/security_center/static/9901.php"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2002-1422",
"datePublished": "2003-03-18T05:00:00",
"dateReserved": "2003-02-05T00:00:00",
"dateUpdated": "2024-08-08T03:26:28.305Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-2600
Vulnerability from cvelistv5
Published
2005-08-17 04:00
Modified
2024-08-07 22:30
Severity ?
EPSS score ?
Summary
FUDForum 2.6.15 with "Tree View" enabled, as used in other products such as phpgroupware and egroupware, allows remote attackers to read private posts via a modified mid parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/16414 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/14556 | vdb-entry, x_refsource_BID | |
| http://archives.neohapsis.com/archives/fulldisclosure/2005-08/0383.html | mailing-list, x_refsource_FULLDISC | |
| http://www.debian.org/security/2005/dsa-798 | vendor-advisory, x_refsource_DEBIAN | |
| http://www.debian.org/security/2005/dsa-899 | vendor-advisory, x_refsource_DEBIAN | |
| http://secunia.com/advisories/17643 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T22:30:01.811Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "16414",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/16414"
},
{
"name": "14556",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/14556"
},
{
"name": "20050811 Fudforum: incompletely check of user rights in tree view gaining access to all messages",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2005-08/0383.html"
},
{
"name": "DSA-798",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2005/dsa-798"
},
{
"name": "DSA-899",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2005/dsa-899"
},
{
"name": "17643",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17643"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-08-12T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "FUDForum 2.6.15 with \"Tree View\" enabled, as used in other products such as phpgroupware and egroupware, allows remote attackers to read private posts via a modified mid parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2005-09-03T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "16414",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/16414"
},
{
"name": "14556",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/14556"
},
{
"name": "20050811 Fudforum: incompletely check of user rights in tree view gaining access to all messages",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2005-08/0383.html"
},
{
"name": "DSA-798",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2005/dsa-798"
},
{
"name": "DSA-899",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2005/dsa-899"
},
{
"name": "17643",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17643"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-2600",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "FUDForum 2.6.15 with \"Tree View\" enabled, as used in other products such as phpgroupware and egroupware, allows remote attackers to read private posts via a modified mid parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "16414",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/16414"
},
{
"name": "14556",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/14556"
},
{
"name": "20050811 Fudforum: incompletely check of user rights in tree view gaining access to all messages",
"refsource": "FULLDISC",
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2005-08/0383.html"
},
{
"name": "DSA-798",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2005/dsa-798"
},
{
"name": "DSA-899",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2005/dsa-899"
},
{
"name": "17643",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17643"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-2600",
"datePublished": "2005-08-17T04:00:00",
"dateReserved": "2005-08-17T00:00:00",
"dateUpdated": "2024-08-07T22:30:01.811Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2002-1421
Vulnerability from cvelistv5
Published
2003-03-18 05:00
Modified
2024-08-08 03:26
Severity ?
EPSS score ?
Summary
SQL injection vulnerabilities in FUDforum before 2.2.0 allow remote attackers to perform unauthorized database operations via (1) report.php, (2) selmsg.php, and (3) showposts.php.
References
| ▼ | URL | Tags |
|---|---|---|
| http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0082.html | mailing-list, x_refsource_VULNWATCH | |
| http://www.iss.net/security_center/static/9912.php | vdb-entry, x_refsource_XF | |
| http://online.securityfocus.com/archive/1/288042 | mailing-list, x_refsource_BUGTRAQ | |
| http://www.securityfocus.com/bid/5500 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T03:26:27.550Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20020818 FUDforum file access and SQL Injection",
"tags": [
"mailing-list",
"x_refsource_VULNWATCH",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0082.html"
},
{
"name": "fudforum-sql-injection(9912)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "http://www.iss.net/security_center/static/9912.php"
},
{
"name": "20020818 FUDforum file access and SQL Injection",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://online.securityfocus.com/archive/1/288042"
},
{
"name": "5500",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/5500"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2002-08-18T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerabilities in FUDforum before 2.2.0 allow remote attackers to perform unauthorized database operations via (1) report.php, (2) selmsg.php, and (3) showposts.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2003-03-21T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20020818 FUDforum file access and SQL Injection",
"tags": [
"mailing-list",
"x_refsource_VULNWATCH"
],
"url": "http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0082.html"
},
{
"name": "fudforum-sql-injection(9912)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "http://www.iss.net/security_center/static/9912.php"
},
{
"name": "20020818 FUDforum file access and SQL Injection",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://online.securityfocus.com/archive/1/288042"
},
{
"name": "5500",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/5500"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2002-1421",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "SQL injection vulnerabilities in FUDforum before 2.2.0 allow remote attackers to perform unauthorized database operations via (1) report.php, (2) selmsg.php, and (3) showposts.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20020818 FUDforum file access and SQL Injection",
"refsource": "VULNWATCH",
"url": "http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0082.html"
},
{
"name": "fudforum-sql-injection(9912)",
"refsource": "XF",
"url": "http://www.iss.net/security_center/static/9912.php"
},
{
"name": "20020818 FUDforum file access and SQL Injection",
"refsource": "BUGTRAQ",
"url": "http://online.securityfocus.com/archive/1/288042"
},
{
"name": "5500",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/5500"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2002-1421",
"datePublished": "2003-03-18T05:00:00",
"dateReserved": "2003-02-05T00:00:00",
"dateUpdated": "2024-08-08T03:26:27.550Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2002-1423
Vulnerability from cvelistv5
Published
2003-03-18 05:00
Modified
2024-08-08 03:26
Severity ?
EPSS score ?
Summary
tmp_view.php in FUDforum before 2.2.0 allows remote attackers to read arbitrary files via an absolute pathname in the file parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0082.html | mailing-list, x_refsource_VULNWATCH | |
| http://online.securityfocus.com/archive/1/288042 | mailing-list, x_refsource_BUGTRAQ | |
| http://www.securityfocus.com/bid/5501 | vdb-entry, x_refsource_BID | |
| http://www.iss.net/security_center/static/9896.php | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T03:26:27.521Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20020818 FUDforum file access and SQL Injection",
"tags": [
"mailing-list",
"x_refsource_VULNWATCH",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0082.html"
},
{
"name": "20020818 FUDforum file access and SQL Injection",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://online.securityfocus.com/archive/1/288042"
},
{
"name": "5501",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/5501"
},
{
"name": "fudforum-tmpview-download-files(9896)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "http://www.iss.net/security_center/static/9896.php"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2002-08-18T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "tmp_view.php in FUDforum before 2.2.0 allows remote attackers to read arbitrary files via an absolute pathname in the file parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2003-03-21T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20020818 FUDforum file access and SQL Injection",
"tags": [
"mailing-list",
"x_refsource_VULNWATCH"
],
"url": "http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0082.html"
},
{
"name": "20020818 FUDforum file access and SQL Injection",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://online.securityfocus.com/archive/1/288042"
},
{
"name": "5501",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/5501"
},
{
"name": "fudforum-tmpview-download-files(9896)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "http://www.iss.net/security_center/static/9896.php"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2002-1423",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "tmp_view.php in FUDforum before 2.2.0 allows remote attackers to read arbitrary files via an absolute pathname in the file parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20020818 FUDforum file access and SQL Injection",
"refsource": "VULNWATCH",
"url": "http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0082.html"
},
{
"name": "20020818 FUDforum file access and SQL Injection",
"refsource": "BUGTRAQ",
"url": "http://online.securityfocus.com/archive/1/288042"
},
{
"name": "5501",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/5501"
},
{
"name": "fudforum-tmpview-download-files(9896)",
"refsource": "XF",
"url": "http://www.iss.net/security_center/static/9896.php"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2002-1423",
"datePublished": "2003-03-18T05:00:00",
"dateReserved": "2003-02-05T00:00:00",
"dateUpdated": "2024-08-08T03:26:27.521Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-2781
Vulnerability from cvelistv5
Published
2005-09-02 04:00
Modified
2024-08-07 22:45
Severity ?
EPSS score ?
Summary
The Avatar upload feature in FUD Forum before 2.7.0 does not properly verify uploaded files, which allows remote attackers to execute arbitrary PHP code via a file with a .php extension that contains image data followed by PHP code.
References
| ▼ | URL | Tags |
|---|---|---|
| http://marc.info/?l=bugtraq&m=112534235403406&w=2 | mailing-list, x_refsource_BUGTRAQ | |
| http://secunia.com/advisories/16627/ | third-party-advisory, x_refsource_SECUNIA | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/22076 | vdb-entry, x_refsource_XF | |
| http://secunia.com/advisories/20203 | third-party-advisory, x_refsource_SECUNIA | |
| http://fudforum.org/forum/index.php?t=msg&th=5470&start=0& | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/14678 | vdb-entry, x_refsource_BID | |
| http://www.debian.org/security/2006/dsa-1063 | vendor-advisory, x_refsource_DEBIAN | |
| http://www.securityfocus.com/archive/1/500406/100/0/threaded | mailing-list, x_refsource_BUGTRAQ |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T22:45:02.220Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20050828 FUD Forum \u003c 2.7.1 PHP code injection vurnelability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=112534235403406\u0026w=2"
},
{
"name": "16627",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/16627/"
},
{
"name": "fudforum-avatar-file-upload(22076)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/22076"
},
{
"name": "20203",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/20203"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://fudforum.org/forum/index.php?t=msg\u0026th=5470\u0026start=0\u0026"
},
{
"name": "14678",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/14678"
},
{
"name": "DSA-1063",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2006/dsa-1063"
},
{
"name": "20090127 Re: FUD Forum \u003c 2.7.1 PHP code injection vurnelability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/500406/100/0/threaded"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-08-28T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The Avatar upload feature in FUD Forum before 2.7.0 does not properly verify uploaded files, which allows remote attackers to execute arbitrary PHP code via a file with a .php extension that contains image data followed by PHP code."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-19T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20050828 FUD Forum \u003c 2.7.1 PHP code injection vurnelability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=112534235403406\u0026w=2"
},
{
"name": "16627",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/16627/"
},
{
"name": "fudforum-avatar-file-upload(22076)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/22076"
},
{
"name": "20203",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/20203"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://fudforum.org/forum/index.php?t=msg\u0026th=5470\u0026start=0\u0026"
},
{
"name": "14678",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/14678"
},
{
"name": "DSA-1063",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2006/dsa-1063"
},
{
"name": "20090127 Re: FUD Forum \u003c 2.7.1 PHP code injection vurnelability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/500406/100/0/threaded"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-2781",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Avatar upload feature in FUD Forum before 2.7.0 does not properly verify uploaded files, which allows remote attackers to execute arbitrary PHP code via a file with a .php extension that contains image data followed by PHP code."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20050828 FUD Forum \u003c 2.7.1 PHP code injection vurnelability",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=112534235403406\u0026w=2"
},
{
"name": "16627",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/16627/"
},
{
"name": "fudforum-avatar-file-upload(22076)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/22076"
},
{
"name": "20203",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/20203"
},
{
"name": "http://fudforum.org/forum/index.php?t=msg\u0026th=5470\u0026start=0\u0026",
"refsource": "CONFIRM",
"url": "http://fudforum.org/forum/index.php?t=msg\u0026th=5470\u0026start=0\u0026"
},
{
"name": "14678",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/14678"
},
{
"name": "DSA-1063",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2006/dsa-1063"
},
{
"name": "20090127 Re: FUD Forum \u003c 2.7.1 PHP code injection vurnelability",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/500406/100/0/threaded"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-2781",
"datePublished": "2005-09-02T04:00:00",
"dateReserved": "2005-09-02T00:00:00",
"dateUpdated": "2024-08-07T22:45:02.220Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Vulnerability from fkie_nvd
Published
2003-04-11 04:00
Modified
2024-11-20 23:41
Severity ?
Summary
tmp_view.php in FUDforum before 2.2.0 allows remote attackers to read arbitrary files via an absolute pathname in the file parameter.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0082.html | ||
| cve@mitre.org | http://online.securityfocus.com/archive/1/288042 | Exploit, Vendor Advisory | |
| cve@mitre.org | http://www.iss.net/security_center/static/9896.php | Patch, Vendor Advisory | |
| cve@mitre.org | http://www.securityfocus.com/bid/5501 | Exploit, Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0082.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://online.securityfocus.com/archive/1/288042 | Exploit, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.iss.net/security_center/static/9896.php | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/5501 | Exploit, Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ilia_alshanetsky | fudforum | 1.2.8 | |
| ilia_alshanetsky | fudforum | 1.9.8 | |
| ilia_alshanetsky | fudforum | 2.0.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:1.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "0B682FAA-1B15-4552-B3F0-5C10D91D3446",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:1.9.8:*:*:*:*:*:*:*",
"matchCriteriaId": "FFCF6FA4-EF68-42DF-937B-9D0073D55D85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "142EC0E1-3286-4FC1-90CB-8D36FD97E59C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "tmp_view.php in FUDforum before 2.2.0 allows remote attackers to read arbitrary files via an absolute pathname in the file parameter."
},
{
"lang": "es",
"value": "tmp_view.php en FUDforum anteriores a 2.2.0 permite a atacantes remotos leer ficheros arbitrarios mediante una ruta absoluta en el par\u00e1metro de fichero."
}
],
"id": "CVE-2002-1423",
"lastModified": "2024-11-20T23:41:16.327",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2003-04-11T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0082.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://online.securityfocus.com/archive/1/288042"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.iss.net/security_center/static/9896.php"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/5501"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0082.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://online.securityfocus.com/archive/1/288042"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.iss.net/security_center/static/9896.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/5501"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-08-17 04:00
Modified
2024-11-20 23:59
Severity ?
Summary
FUDForum 2.6.15 with "Tree View" enabled, as used in other products such as phpgroupware and egroupware, allows remote attackers to read private posts via a modified mid parameter.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ilia_alshanetsky | fudforum | 2.6.15 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.6.15:*:*:*:*:*:*:*",
"matchCriteriaId": "A90D1C9D-E8C2-43D1-A87E-89DA4CBDE4BA",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "FUDForum 2.6.15 with \"Tree View\" enabled, as used in other products such as phpgroupware and egroupware, allows remote attackers to read private posts via a modified mid parameter."
}
],
"id": "CVE-2005-2600",
"lastModified": "2024-11-20T23:59:56.103",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-08-17T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2005-08/0383.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/16414"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/17643"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2005/dsa-798"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2005/dsa-899"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/14556"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2005-08/0383.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/16414"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/17643"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2005/dsa-798"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2005/dsa-899"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/14556"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-09-02 23:03
Modified
2024-11-21 00:00
Severity ?
Summary
The Avatar upload feature in FUD Forum before 2.7.0 does not properly verify uploaded files, which allows remote attackers to execute arbitrary PHP code via a file with a .php extension that contains image data followed by PHP code.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "5E66CD67-55D1-48A0-9A19-D3153B7DC787",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A21D4EA6-C739-4BA0-ABBD-1E95CDD5E808",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F68DB291-A958-4296-855A-B3CF19704E70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A8A9D296-6C54-4436-AE77-0D5291415DBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "81684C0A-B31D-46F5-998F-21F1FDDFBBEC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "5A41890E-4C88-4161-9DE3-C273272176E3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FDB8AF21-93A9-4756-B2E8-313FA6638158",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "B14E676F-8A71-4607-80DC-F538F697E674",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "2C42CAF4-3936-455F-AE02-312278C84FD9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "00EB1238-BD1C-4A5E-9491-8AC343868FFC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C07DA566-0075-4297-8531-A5E7C03877FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D5428C3B-997C-417E-932D-CD2E9139891D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B49C1DE2-FE7A-4AE0-AFB4-15C323C47817",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.3.3:*:*:*:*:*:*:*",
"matchCriteriaId": "63E5AFE9-C5FC-448D-B3FB-411C0CAB2174",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.3.4:*:*:*:*:*:*:*",
"matchCriteriaId": "CFA28579-5406-471B-A015-00DE3283B8C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1CC947E3-E98A-4673-B6A4-22C63BDAADBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.3.6:*:*:*:*:*:*:*",
"matchCriteriaId": "2BF1BF48-11AE-4737-9F65-E01A3F8D5EA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.3.7:*:*:*:*:*:*:*",
"matchCriteriaId": "4D94B04F-E6E4-452E-883A-B88DDDDF6AE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "C253560E-D233-43B0-86E6-F41690BEEDCC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1AB63A18-0C81-4C18-91CE-E9FC1497CB82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E0A0F3EF-9345-407B-8110-C6F8E44861CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "8F6480F8-D5AF-418F-BBB7-E09941EAA56E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E20EC310-AF18-4001-913C-849D60C86047",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6C5A8FE4-FD41-4FB5-B0FA-C3C4669E42C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "699C28AF-95BD-44EA-BD50-F9616B53FBF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "3A60D274-69FA-4C37-A472-FEB1D18DA6C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3C4219A0-F0EA-4303-B46F-D170EB6B05B3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "9837B11A-A3AA-4CE7-A0BE-E9709D42ECD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.6.6:*:*:*:*:*:*:*",
"matchCriteriaId": "0590709E-FD1E-4BF4-8158-09B243B87648",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.6.7:*:*:*:*:*:*:*",
"matchCriteriaId": "EA4DAE8A-8F53-4A66-9A42-BC468569D31B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.6.8:*:*:*:*:*:*:*",
"matchCriteriaId": "C4331016-C28D-4C17-B6A2-11A7E45873E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.6.9:*:*:*:*:*:*:*",
"matchCriteriaId": "DFADD332-B80D-4D04-AA20-147F00F3CB0F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.6.10:*:*:*:*:*:*:*",
"matchCriteriaId": "8A60EFEB-036F-4828-8D17-069C0CF448D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.6.11:*:*:*:*:*:*:*",
"matchCriteriaId": "51906E70-8317-4B8A-A384-13F62B0D24B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.6.12:*:*:*:*:*:*:*",
"matchCriteriaId": "50A53ED7-CB9B-4D83-8C67-BF14DDD5A081",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.6.13:*:*:*:*:*:*:*",
"matchCriteriaId": "3E2D688C-2A06-4381-A2FF-27CA81606A69",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.6.14:*:*:*:*:*:*:*",
"matchCriteriaId": "F035957A-5FF8-43AA-8DF9-C132051FF1E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.6.15:*:*:*:*:*:*:*",
"matchCriteriaId": "A90D1C9D-E8C2-43D1-A87E-89DA4CBDE4BA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A616B2B6-49D7-42D2-8FFE-7D9B3B7FE13B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The Avatar upload feature in FUD Forum before 2.7.0 does not properly verify uploaded files, which allows remote attackers to execute arbitrary PHP code via a file with a .php extension that contains image data followed by PHP code."
}
],
"id": "CVE-2005-2781",
"lastModified": "2024-11-21T00:00:25.163",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-09-02T23:03:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://fudforum.org/forum/index.php?t=msg\u0026th=5470\u0026start=0\u0026"
},
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=112534235403406\u0026w=2"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/16627/"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/20203"
},
{
"source": "cve@mitre.org",
"url": "http://www.debian.org/security/2006/dsa-1063"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/500406/100/0/threaded"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/14678"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/22076"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://fudforum.org/forum/index.php?t=msg\u0026th=5470\u0026start=0\u0026"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=112534235403406\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/16627/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/20203"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2006/dsa-1063"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/500406/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/14678"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/22076"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2003-04-11 04:00
Modified
2024-11-20 23:41
Severity ?
Summary
SQL injection vulnerabilities in FUDforum before 2.2.0 allow remote attackers to perform unauthorized database operations via (1) report.php, (2) selmsg.php, and (3) showposts.php.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0082.html | ||
| cve@mitre.org | http://online.securityfocus.com/archive/1/288042 | Exploit, Vendor Advisory | |
| cve@mitre.org | http://www.iss.net/security_center/static/9912.php | Patch, Vendor Advisory | |
| cve@mitre.org | http://www.securityfocus.com/bid/5500 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0082.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://online.securityfocus.com/archive/1/288042 | Exploit, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.iss.net/security_center/static/9912.php | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/5500 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ilia_alshanetsky | fudforum | 1.2.8 | |
| ilia_alshanetsky | fudforum | 1.9.8 | |
| ilia_alshanetsky | fudforum | 2.0.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:1.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "0B682FAA-1B15-4552-B3F0-5C10D91D3446",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:1.9.8:*:*:*:*:*:*:*",
"matchCriteriaId": "FFCF6FA4-EF68-42DF-937B-9D0073D55D85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "142EC0E1-3286-4FC1-90CB-8D36FD97E59C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerabilities in FUDforum before 2.2.0 allow remote attackers to perform unauthorized database operations via (1) report.php, (2) selmsg.php, and (3) showposts.php."
},
{
"lang": "es",
"value": "Vulnerabilidades por inyecci\u00f3n de SQL en FUDforum anteriores a la 2.2.0 permite a atacantes remotos realizar operaciones no autorizadas en las Bases de Datos mediante:\r\n\r\nreport.php\r\nselmsg.php\r\nshowposts.php"
}
],
"id": "CVE-2002-1421",
"lastModified": "2024-11-20T23:41:16.047",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2003-04-11T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0082.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://online.securityfocus.com/archive/1/288042"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.iss.net/security_center/static/9912.php"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/5500"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0082.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://online.securityfocus.com/archive/1/288042"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.iss.net/security_center/static/9912.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/5500"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2003-04-11 04:00
Modified
2024-11-20 23:41
Severity ?
Summary
admbrowse.php in FUDforum before 2.2.0 allows remote attackers to create or delete files via URL-encoded pathnames in the cur and dest parameters.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0082.html | ||
| cve@mitre.org | http://online.securityfocus.com/archive/1/288042 | Exploit, Vendor Advisory | |
| cve@mitre.org | http://www.iss.net/security_center/static/9901.php | Patch, Vendor Advisory | |
| cve@mitre.org | http://www.securityfocus.com/bid/5502 | Exploit, Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0082.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://online.securityfocus.com/archive/1/288042 | Exploit, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.iss.net/security_center/static/9901.php | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/5502 | Exploit, Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ilia_alshanetsky | fudforum | 1.2.8 | |
| ilia_alshanetsky | fudforum | 1.9.8 | |
| ilia_alshanetsky | fudforum | 2.0.2 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:1.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "0B682FAA-1B15-4552-B3F0-5C10D91D3446",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:1.9.8:*:*:*:*:*:*:*",
"matchCriteriaId": "FFCF6FA4-EF68-42DF-937B-9D0073D55D85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "142EC0E1-3286-4FC1-90CB-8D36FD97E59C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "admbrowse.php in FUDforum before 2.2.0 allows remote attackers to create or delete files via URL-encoded pathnames in the cur and dest parameters."
},
{
"lang": "es",
"value": "admbrowse.php en FUDforum anteriores a 2.2.0 permite a atacantes remotos crear o borrar ficheros mediante nombres de ruta codificados para URL (URL-encoded)en los par\u00e1metros cur y dest"
}
],
"id": "CVE-2002-1422",
"lastModified": "2024-11-20T23:41:16.190",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2003-04-11T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0082.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://online.securityfocus.com/archive/1/288042"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.iss.net/security_center/static/9901.php"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/5502"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://archives.neohapsis.com/archives/vulnwatch/2002-q3/0082.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://online.securityfocus.com/archive/1/288042"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.iss.net/security_center/static/9901.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/5502"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-08-16 17:55
Modified
2024-11-21 01:57
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in install/forum_data/src/custom_fields.inc.t in FUDforum 3.0.4.1 and earlier, when registering a new user, allows remote attackers to inject arbitrary web script or HTML via a custom profile field to index.php. NOTE: some of these details are obtained from third party information.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:fudforum:fudforum:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FA807086-1C52-4E6E-864F-BCF54CB70A98",
"versionEndIncluding": "3.0.4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fudforum:fudforum:2.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "EE4BE982-3DC7-4C12-9819-4BA350B6C643",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fudforum:fudforum:2.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "904FA9DD-9285-48ED-A61E-041565988423",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fudforum:fudforum:2.7.4:*:*:*:*:*:*:*",
"matchCriteriaId": "C9607FD0-EF6C-4649-9404-ED934089FE49",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fudforum:fudforum:2.7.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1A550500-C6B3-407F-B072-C4C4F6F2FC8E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fudforum:fudforum:2.7.6:*:*:*:*:*:*:*",
"matchCriteriaId": "B0CFA30F-D841-4211-833B-E1B9636A2EBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fudforum:fudforum:2.7.7:*:*:*:*:*:*:*",
"matchCriteriaId": "E6EAC485-AD70-4615-864D-273A5BEA99C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fudforum:fudforum:2.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DD3E131E-43D2-4721-95DC-2A18EAB6F30D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fudforum:fudforum:2.8.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1A42EF2B-288F-4333-8AE2-899913A0E09A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fudforum:fudforum:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E62B292F-15F3-453E-A274-84B60835C11B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fudforum:fudforum:3.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "5367204C-615C-4C1B-8F8C-BF3D0DDC58F8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fudforum:fudforum:3.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "291A28FC-DDD8-444B-927C-01F6688E4877",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fudforum:fudforum:3.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "28411B91-90E8-421D-AC18-39EB4A3CB042",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:fudforum:fudforum:3.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "21311578-9C04-4A3A-8DD0-B371663BFB72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:1.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "0B682FAA-1B15-4552-B3F0-5C10D91D3446",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:1.9.8:*:*:*:*:*:*:*",
"matchCriteriaId": "FFCF6FA4-EF68-42DF-937B-9D0073D55D85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "142EC0E1-3286-4FC1-90CB-8D36FD97E59C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "5E66CD67-55D1-48A0-9A19-D3153B7DC787",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A21D4EA6-C739-4BA0-ABBD-1E95CDD5E808",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "F68DB291-A958-4296-855A-B3CF19704E70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A8A9D296-6C54-4436-AE77-0D5291415DBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "81684C0A-B31D-46F5-998F-21F1FDDFBBEC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "5A41890E-4C88-4161-9DE3-C273272176E3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FDB8AF21-93A9-4756-B2E8-313FA6638158",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "B14E676F-8A71-4607-80DC-F538F697E674",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "2C42CAF4-3936-455F-AE02-312278C84FD9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "00EB1238-BD1C-4A5E-9491-8AC343868FFC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C07DA566-0075-4297-8531-A5E7C03877FA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D5428C3B-997C-417E-932D-CD2E9139891D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B49C1DE2-FE7A-4AE0-AFB4-15C323C47817",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.3.3:*:*:*:*:*:*:*",
"matchCriteriaId": "63E5AFE9-C5FC-448D-B3FB-411C0CAB2174",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.3.4:*:*:*:*:*:*:*",
"matchCriteriaId": "CFA28579-5406-471B-A015-00DE3283B8C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1CC947E3-E98A-4673-B6A4-22C63BDAADBD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.3.6:*:*:*:*:*:*:*",
"matchCriteriaId": "2BF1BF48-11AE-4737-9F65-E01A3F8D5EA3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.3.7:*:*:*:*:*:*:*",
"matchCriteriaId": "4D94B04F-E6E4-452E-883A-B88DDDDF6AE2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "C253560E-D233-43B0-86E6-F41690BEEDCC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1AB63A18-0C81-4C18-91CE-E9FC1497CB82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "E0A0F3EF-9345-407B-8110-C6F8E44861CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "8F6480F8-D5AF-418F-BBB7-E09941EAA56E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E20EC310-AF18-4001-913C-849D60C86047",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6C5A8FE4-FD41-4FB5-B0FA-C3C4669E42C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "699C28AF-95BD-44EA-BD50-F9616B53FBF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "3A60D274-69FA-4C37-A472-FEB1D18DA6C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3C4219A0-F0EA-4303-B46F-D170EB6B05B3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "9837B11A-A3AA-4CE7-A0BE-E9709D42ECD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.6.6:*:*:*:*:*:*:*",
"matchCriteriaId": "0590709E-FD1E-4BF4-8158-09B243B87648",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.6.7:*:*:*:*:*:*:*",
"matchCriteriaId": "EA4DAE8A-8F53-4A66-9A42-BC468569D31B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.6.8:*:*:*:*:*:*:*",
"matchCriteriaId": "C4331016-C28D-4C17-B6A2-11A7E45873E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.6.9:*:*:*:*:*:*:*",
"matchCriteriaId": "DFADD332-B80D-4D04-AA20-147F00F3CB0F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.6.10:*:*:*:*:*:*:*",
"matchCriteriaId": "8A60EFEB-036F-4828-8D17-069C0CF448D5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.6.11:*:*:*:*:*:*:*",
"matchCriteriaId": "51906E70-8317-4B8A-A384-13F62B0D24B5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.6.12:*:*:*:*:*:*:*",
"matchCriteriaId": "50A53ED7-CB9B-4D83-8C67-BF14DDD5A081",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.6.13:*:*:*:*:*:*:*",
"matchCriteriaId": "3E2D688C-2A06-4381-A2FF-27CA81606A69",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.6.14:*:*:*:*:*:*:*",
"matchCriteriaId": "F035957A-5FF8-43AA-8DF9-C132051FF1E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.6.15:*:*:*:*:*:*:*",
"matchCriteriaId": "A90D1C9D-E8C2-43D1-A87E-89DA4CBDE4BA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A616B2B6-49D7-42D2-8FFE-7D9B3B7FE13B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ilia_alshanetsky:fudforum:2.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "ECCD51B8-AFBA-4D41-84ED-A5D41E4FAFC8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in install/forum_data/src/custom_fields.inc.t in FUDforum 3.0.4.1 and earlier, when registering a new user, allows remote attackers to inject arbitrary web script or HTML via a custom profile field to index.php. NOTE: some of these details are obtained from third party information."
},
{
"lang": "es",
"value": "Vulnerabilidad Cross-site scripting (XSS) en install/forum_data/src/custom_fields.inc.t en FUDforum v3.0.4.1 y anteriores, cuando se registra un nuevo usuario, permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s del campo de perfil personalizado a index.php. NOTA: algunos de estos detalles han sido obtenidos de informaci\u00f3n de terceros."
}
],
"id": "CVE-2013-5309",
"lastModified": "2024-11-21T01:57:16.923",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2013-08-16T17:55:09.740",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/54293"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "http://sourceforge.net/p/fudforum/code/5589/"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/86030"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/54293"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "http://sourceforge.net/p/fudforum/code/5589/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/86030"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}