Vulnerabilites related to phorum - phorum
Vulnerability from fkie_nvd
Published
2004-03-15 05:00
Modified
2024-11-20 23:51
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Phorum 3.1 through 5.0.3 beta allow remote attackers to inject arbitrary web script or HTML via the (1) HTTP_REFERER parameter to login.php, (2) HTTP_REFERER parameter to register.php, or (3) target parameter to profile.php.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phorum | phorum | 3.1 | |
| phorum | phorum | 3.1.1 | |
| phorum | phorum | 3.1.1_pre | |
| phorum | phorum | 3.1.1_rc2 | |
| phorum | phorum | 3.1.1a | |
| phorum | phorum | 3.1.2 | |
| phorum | phorum | 3.2 | |
| phorum | phorum | 3.2.2 | |
| phorum | phorum | 3.2.3 | |
| phorum | phorum | 3.2.3a | |
| phorum | phorum | 3.2.3b | |
| phorum | phorum | 3.2.4 | |
| phorum | phorum | 3.2.5 | |
| phorum | phorum | 3.2.6 | |
| phorum | phorum | 3.2.7 | |
| phorum | phorum | 3.2.8 | |
| phorum | phorum | 3.3.1 | |
| phorum | phorum | 3.3.1a | |
| phorum | phorum | 3.3.2 | |
| phorum | phorum | 3.3.2a | |
| phorum | phorum | 3.3.2b3 | |
| phorum | phorum | 3.4 | |
| phorum | phorum | 3.4.1 | |
| phorum | phorum | 3.4.2 | |
| phorum | phorum | 3.4.3 | |
| phorum | phorum | 3.4.4 | |
| phorum | phorum | 3.4.5 | |
| phorum | phorum | 3.4.6 | |
| phorum | phorum | 5.0.3_beta |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "32D7E47E-10F5-4F50-8940-951B2C0011CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16042FAE-7370-425C-8810-4F9363B7CAA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.1_pre:*:*:*:*:*:*:*",
"matchCriteriaId": "B4A25A6F-62CA-4C76-9D4C-821B1E15FB1B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.1_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "6247DB0C-37B6-44EF-8B92-8CFCDA537039",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.1a:*:*:*:*:*:*:*",
"matchCriteriaId": "4C46298C-2492-4102-A264-E2A1D45AD423",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1A2AD59F-42DF-407A-8FCA-E6E0067A2B3A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "17E1044B-2101-4719-8749-17DD22F46055",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B7E17261-A010-4929-99E5-A2511F205B72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A461E2EB-9964-44DE-9C25-562D239201F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.3a:*:*:*:*:*:*:*",
"matchCriteriaId": "9CB6A4EC-D351-4EF8-8C6A-294A47DDCCC7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.3b:*:*:*:*:*:*:*",
"matchCriteriaId": "2B10230A-7D72-418E-8A29-E9F20762C43A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "368C8142-836A-4FDB-9CD8-385FE06B9A62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1470761E-DA6E-4D2A-B226-1ED782FB3654",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "FEB3ED23-821D-42FA-A24F-F2EDDA43D7B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "88BA8736-5998-42E0-81E4-76E3669F8112",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "DC9811C9-EE92-4115-B81F-7A3030390BD1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "5A196AD2-7E48-40F4-923E-437FA76C97D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.1a:*:*:*:*:*:*:*",
"matchCriteriaId": "91D147F0-FF83-4FF4-AEF1-71366E874876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D87C46-D9EC-418B-9C8C-71E7149C72D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.2a:*:*:*:*:*:*:*",
"matchCriteriaId": "A7F6BE0A-7E2F-457D-B4BA-6BAE1B44E7D3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.2b3:*:*:*:*:*:*:*",
"matchCriteriaId": "C990B390-4768-41B0-BB8B-A56C2524623F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6650BE9D-5F4B-4B22-BD7E-ABCC067D5455",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1B8E0CA9-F6D4-4DD3-A3EA-F3A40965261B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7F67B233-3087-43E6-94F2-5DF39FAA36B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "7725AEF3-1C47-46B4-A35E-97152A84E731",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "F3F6C52C-F602-4C2A-8C8F-4A19DA41186F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "45F290E5-6508-4F62-8572-31B33750D341",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6D941B5F-B704-4596-8739-BFE34225DBA7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.3_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "9A31EA2D-2B01-4928-9B3E-9D666FD2758B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Phorum 3.1 through 5.0.3 beta allow remote attackers to inject arbitrary web script or HTML via the (1) HTTP_REFERER parameter to login.php, (2) HTTP_REFERER parameter to register.php, or (3) target parameter to profile.php."
}
],
"id": "CVE-2004-1822",
"lastModified": "2024-11-20T23:51:49.497",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2004-03-15T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=107939479713136\u0026w=2"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://phorum.org/changelog.txt"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/11157"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1009433"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/4333"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/4334"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/4335"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/9882"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15494"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=107939479713136\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://phorum.org/changelog.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/11157"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1009433"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/4333"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/4334"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/4335"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/9882"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15494"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-09-19 14:55
Modified
2024-11-21 01:46
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the admin interface in Phorum before 5.2.19 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phorum | phorum | * | |
| phorum | phorum | 5.2 | |
| phorum | phorum | 5.2.1 | |
| phorum | phorum | 5.2.2 | |
| phorum | phorum | 5.2.3 | |
| phorum | phorum | 5.2.4 | |
| phorum | phorum | 5.2.5 | |
| phorum | phorum | 5.2.6 | |
| phorum | phorum | 5.2.7 | |
| phorum | phorum | 5.2.8 | |
| phorum | phorum | 5.2.9 | |
| phorum | phorum | 5.2.10 | |
| phorum | phorum | 5.2.10 | |
| phorum | phorum | 5.2.11 | |
| phorum | phorum | 5.2.12 | |
| phorum | phorum | 5.2.12 | |
| phorum | phorum | 5.2.13 | |
| phorum | phorum | 5.2.14 | |
| phorum | phorum | 5.2.15 | |
| phorum | phorum | 5.2.15 | |
| phorum | phorum | 5.2.16 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B7658DEE-525F-4A02-9577-4830FFE9CB1F",
"versionEndIncluding": "5.2.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A4C4E79D-EBE6-456C-A74F-B94F32736383",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D3596808-8399-4EA9-B885-5443CA91C3C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.2:beta:*:*:*:*:*:*",
"matchCriteriaId": "B5409C8A-8B57-48FB-B01E-411C00153E9B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "74DB422C-E79C-46B2-BB52-8C457822A0BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.4:rc2:*:*:*:*:*:*",
"matchCriteriaId": "37881B2C-0CD0-4E2A-A11D-9758772640E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "66BE61C7-E1DD-4DA9-B433-0C698C482C57",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "A29F39E2-B0F1-483C-AFD5-9E95EEFBA8C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "13E5E276-4567-4897-A663-496A7E1AD2BB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "FB5E063A-F59F-4CEB-9950-2FE8D25FF9FF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.9:*:*:*:*:*:*:*",
"matchCriteriaId": "F0A35F3F-6BBF-4B84-AE19-870F03C1E9DC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.10:*:*:*:*:*:*:*",
"matchCriteriaId": "90FC064F-B462-47F8-880F-CB26A340477E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.10:rc1:*:*:*:*:*:*",
"matchCriteriaId": "D083445E-48ED-4666-98A8-932B01A0F9B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.11:*:*:*:*:*:*:*",
"matchCriteriaId": "A79911F1-C1C3-4DD1-BA37-AFC77D7B0D90",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.12:*:*:*:*:*:*:*",
"matchCriteriaId": "2200E549-30F8-4803-A570-FBF08B97B7CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.12:a:*:*:*:*:*:*",
"matchCriteriaId": "A94B0DAF-C8AC-483F-A280-CCF4B6D17BF0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.13:*:*:*:*:*:*:*",
"matchCriteriaId": "D9876C40-4537-4622-90D5-175AB59609D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "51638139-DB4F-4B8C-B125-1FE9AFC86B21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.15:*:*:*:*:*:*:*",
"matchCriteriaId": "6362BDF1-A90C-40A8-A80C-024788426315",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.15:a:*:*:*:*:*:*",
"matchCriteriaId": "211355E8-5707-4873-AE47-26DFE6061725",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.16:*:*:*:*:*:*:*",
"matchCriteriaId": "61C297BC-DF74-42FD-957B-6130AEAA3A04",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the admin interface in Phorum before 5.2.19 allows remote attackers to inject arbitrary web script or HTML via a crafted URL."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en la interfaz de administraci\u00f3n en Phorum anterior a 5.2.19 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de una URL manipulada."
}
],
"id": "CVE-2012-6659",
"lastModified": "2024-11-21T01:46:38.167",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2014-09-19T14:55:07.227",
"references": [
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/50445"
},
{
"source": "cve@mitre.org",
"url": "http://www.phorum.org/phorum5/read.php?64%2C151943"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/50445"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phorum.org/phorum5/read.php?64%2C151943"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2003-06-16 04:00
Modified
2024-11-20 23:44
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in Phorum before 3.4.3 allows remote attackers to inject arbitrary web script and HTML tags via a message with a "<<" before a tag name in the (1) subject, (2) author's name, or (3) author's e-mail.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FF1EE47F-2A43-4ABB-9D97-05F4D9DFCD20",
"versionEndIncluding": "3.4.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Phorum before 3.4.3 allows remote attackers to inject arbitrary web script and HTML tags via a message with a \"\u003c\u003c\" before a tag name in the (1) subject, (2) author\u0027s name, or (3) author\u0027s e-mail."
},
{
"lang": "es",
"value": "Vulnerabilidad de secuencias de comandos en sitios cruzados en Phorum anterior a la 3.4.3 permite que atacantes remotos inyecten script web arbitrario y tags HTML mediante un mensaje con una \"\u003c\u003c\" anterior a un nombre de etiqueta en (1) asunto, (2) nombre de autor, \u00f3 (3) direcci\u00f3n de correo electr\u00f3nico del autor."
}
],
"id": "CVE-2003-0283",
"lastModified": "2024-11-20T23:44:23.160",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2003-06-16T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=105251043821533\u0026w=2"
},
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=105251421925394\u0026w=2"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/7545"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11974"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=105251043821533\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=105251421925394\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/7545"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11974"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2003-12-31 05:00
Modified
2024-11-20 23:47
Severity ?
Summary
Unspecified vulnerability in Phorum 3.4 through 3.4.2 allows remote attackers to use Phorum as a connection proxy to other sites via (1) register.php or (2) login.php.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6650BE9D-5F4B-4B22-BD7E-ABCC067D5455",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1B8E0CA9-F6D4-4DD3-A3EA-F3A40965261B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7F67B233-3087-43E6-94F2-5DF39FAA36B7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in Phorum 3.4 through 3.4.2 allows remote attackers to use Phorum as a connection proxy to other sites via (1) register.php or (2) login.php."
}
],
"id": "CVE-2003-1466",
"lastModified": "2024-11-20T23:47:13.587",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2003-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://securityreason.com/securityalert/3288"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/archive/1/321310"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/7581"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/7583"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/3288"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/archive/1/321310"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/7581"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/7583"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2009-02-09 20:30
Modified
2024-11-21 01:00
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in Phorum before 5.2.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:*:rc1:*:*:*:*:*:*",
"matchCriteriaId": "2536ED84-80A0-44D3-B16C-DBF47B901C8D",
"versionEndIncluding": "5.2.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "740F974F-D679-472C-966A-3E4C334E3C0A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "32D7E47E-10F5-4F50-8940-951B2C0011CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16042FAE-7370-425C-8810-4F9363B7CAA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.1_pre:*:*:*:*:*:*:*",
"matchCriteriaId": "B4A25A6F-62CA-4C76-9D4C-821B1E15FB1B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.1_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "6247DB0C-37B6-44EF-8B92-8CFCDA537039",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.1a:*:*:*:*:*:*:*",
"matchCriteriaId": "4C46298C-2492-4102-A264-E2A1D45AD423",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1A2AD59F-42DF-407A-8FCA-E6E0067A2B3A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "17E1044B-2101-4719-8749-17DD22F46055",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B7E17261-A010-4929-99E5-A2511F205B72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A461E2EB-9964-44DE-9C25-562D239201F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.3a:*:*:*:*:*:*:*",
"matchCriteriaId": "9CB6A4EC-D351-4EF8-8C6A-294A47DDCCC7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.3b:*:*:*:*:*:*:*",
"matchCriteriaId": "2B10230A-7D72-418E-8A29-E9F20762C43A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "368C8142-836A-4FDB-9CD8-385FE06B9A62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1470761E-DA6E-4D2A-B226-1ED782FB3654",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "FEB3ED23-821D-42FA-A24F-F2EDDA43D7B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "88BA8736-5998-42E0-81E4-76E3669F8112",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "DC9811C9-EE92-4115-B81F-7A3030390BD1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "5A196AD2-7E48-40F4-923E-437FA76C97D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.1a:*:*:*:*:*:*:*",
"matchCriteriaId": "91D147F0-FF83-4FF4-AEF1-71366E874876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D87C46-D9EC-418B-9C8C-71E7149C72D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.2a:*:*:*:*:*:*:*",
"matchCriteriaId": "A7F6BE0A-7E2F-457D-B4BA-6BAE1B44E7D3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.2b3:*:*:*:*:*:*:*",
"matchCriteriaId": "C990B390-4768-41B0-BB8B-A56C2524623F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6650BE9D-5F4B-4B22-BD7E-ABCC067D5455",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1B8E0CA9-F6D4-4DD3-A3EA-F3A40965261B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7F67B233-3087-43E6-94F2-5DF39FAA36B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "7725AEF3-1C47-46B4-A35E-97152A84E731",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "F3F6C52C-F602-4C2A-8C8F-4A19DA41186F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "45F290E5-6508-4F62-8572-31B33750D341",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6D941B5F-B704-4596-8739-BFE34225DBA7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "FF13359B-162A-41DF-BB4F-DDD6CA2752F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "7D1AE057-A85C-49D9-981A-3314BD945D08",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.8a:*:*:*:*:*:*:*",
"matchCriteriaId": "EAC1F375-34EF-4FEC-B0F4-6A081B6A3B53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:4.3.7:*:*:*:*:*:*:*",
"matchCriteriaId": "1E532A66-A12D-48DD-B405-2345E5B715C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.0_alpha:*:*:*:*:*:*:*",
"matchCriteriaId": "26E2C5A7-8B52-4BDF-80F1-5D45AEBE6E25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.1_alpha:*:*:*:*:*:*:*",
"matchCriteriaId": "0E8DF602-0A22-45A9-A286-C237180701C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.2_alpha:*:*:*:*:*:*:*",
"matchCriteriaId": "AB109C36-BF0F-41E3-A1F4-0DB264BD4A55",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.3_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "9A31EA2D-2B01-4928-9B3E-9D666FD2758B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.4_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "E87DE16C-7C68-4DA8-9BD9-C61D74E61D6E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.4a_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "5001527E-FE93-4BE7-BF79-7717D64CAF2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.5_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "D15ED599-6B84-4E03-8BA4-36E1D55F1F75",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.6_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "D491A2B9-949A-4A56-A41F-23A222C03BA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.7_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "01CFDB0B-6FBD-49F3-8238-81E92661297E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.7a_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "EC73A23F-2399-41B0-B6BD-289DF63F2C6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.8_rc:*:*:*:*:*:*:*",
"matchCriteriaId": "AD59DD99-1FC7-498B-9EA1-1AA8FE132EEE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "1655572D-7D56-4D9D-9E0F-A67DF23FC934",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "387E0B83-B240-4922-8C57-CE0CDB000888",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "CF5B09FF-92DF-4F8D-9A7B-E5086E2B954D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "D02321D7-2F3E-40F9-9A76-CFF339C93199",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "3B908D49-F64A-488F-95F3-163AB9DAB02D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.13a:*:*:*:*:*:*:*",
"matchCriteriaId": "1A26F8E5-0FFE-473D-BDA1-2D5340B5A4A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.14:*:*:*:*:*:*:*",
"matchCriteriaId": "0FF0655C-7C83-4363-A444-993B35D7A7EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.14a:*:*:*:*:*:*:*",
"matchCriteriaId": "B3D0F7C4-902D-4186-8EFF-3876D6D6633E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.15:*:*:*:*:*:*:*",
"matchCriteriaId": "6F87C476-6A55-4B19-97B0-24204E96A63E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.15a:*:*:*:*:*:*:*",
"matchCriteriaId": "83F8F544-1B09-4B22-B1F3-2CD1E8D7AECD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.16:*:*:*:*:*:*:*",
"matchCriteriaId": "8ACC6DD4-384B-44DE-9BC7-6F1DD374E6B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.17:*:*:*:*:*:*:*",
"matchCriteriaId": "17D0AC3E-97F7-4A13-8E65-7E424D055E38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.17a:*:*:*:*:*:*:*",
"matchCriteriaId": "D184385A-763A-4971-8051-20564D020787",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.18:*:*:*:*:*:*:*",
"matchCriteriaId": "04B508F8-CFCC-4841-BF70-1ABB28EB1ABC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.19:*:*:*:*:*:*:*",
"matchCriteriaId": "C365D62D-ACB1-44D3-935D-F79A79642684",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.20:*:*:*:*:*:*:*",
"matchCriteriaId": "F4B45305-FF8B-42F8-A726-F8604BADC323",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.13:*:*:*:*:*:*:*",
"matchCriteriaId": "70F4AB87-2D63-4208-8982-BBF978392285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.14:*:*:*:*:*:*:*",
"matchCriteriaId": "149A6B5A-84FC-4B6F-B053-0AC881BC03D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.17:*:*:*:*:*:*:*",
"matchCriteriaId": "375346D4-CEA4-4BAE-83DF-639E86C3DECC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.18:*:*:*:*:*:*:*",
"matchCriteriaId": "3C6E0429-3241-47B0-B853-66D3167CE4F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.20:*:*:*:*:*:*:*",
"matchCriteriaId": "121F0F96-F901-479F-A64F-3DAE1AC0AFAF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.21:*:*:*:*:*:*:*",
"matchCriteriaId": "F837829B-28E5-41B3-9A23-C4D4A7FE636A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.25:*:*:*:*:*:*:*",
"matchCriteriaId": "700B9165-B956-4CAB-B980-42885FFA418F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A4C4E79D-EBE6-456C-A74F-B94F32736383",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D3596808-8399-4EA9-B885-5443CA91C3C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.2:beta:*:*:*:*:*:*",
"matchCriteriaId": "B5409C8A-8B57-48FB-B01E-411C00153E9B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "74DB422C-E79C-46B2-BB52-8C457822A0BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.4:rc2:*:*:*:*:*:*",
"matchCriteriaId": "37881B2C-0CD0-4E2A-A11D-9758772640E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "66BE61C7-E1DD-4DA9-B433-0C698C482C57",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "FB5E063A-F59F-4CEB-9950-2FE8D25FF9FF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.9:*:*:*:*:*:*:*",
"matchCriteriaId": "F0A35F3F-6BBF-4B84-AE19-870F03C1E9DC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Phorum before 5.2.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
},
{
"lang": "es",
"value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en Phorum anterior a v5.2.10 permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s de vectores sin especificar."
}
],
"id": "CVE-2009-0488",
"lastModified": "2024-11-21T01:00:01.377",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2009-02-09T20:30:02.750",
"references": [
{
"source": "cve@mitre.org",
"url": "http://www.phorum.org/phorum5/read.php?64%2C136129"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/33657"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phorum.org/phorum5/read.php?64%2C136129"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/33657"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-05-02 04:00
Modified
2024-11-20 23:55
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Phorum before 5.0.15 allow remote attackers to inject arbitrary web script or HTML via (1) the subject line to follow.php or (2) the subject line in the user's personal control panel.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.14:*:*:*:*:*:*:*",
"matchCriteriaId": "0FF0655C-7C83-4363-A444-993B35D7A7EA",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Phorum before 5.0.15 allow remote attackers to inject arbitrary web script or HTML via (1) the subject line to follow.php or (2) the subject line in the user\u0027s personal control panel."
}
],
"id": "CVE-2005-0784",
"lastModified": "2024-11-20T23:55:53.663",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-05-02T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=111083279031544\u0026w=2"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://secunia.com/advisories/14554"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/12800"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=111083279031544\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://secunia.com/advisories/14554"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/12800"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2004-12-31 05:00
Modified
2024-11-20 23:52
Severity ?
Summary
SQL injection vulnerability in register.php in Phorum before 3.4.6 allows remote attackers to execute arbitrary SQL commands via the hide_email parameter.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1628D391-59B4-4D58-8409-5D099D45E8B4",
"versionEndIncluding": "3.4.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in register.php in Phorum before 3.4.6 allows remote attackers to execute arbitrary SQL commands via the hide_email parameter."
}
],
"id": "CVE-2004-2110",
"lastModified": "2024-11-20T23:52:31.077",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2004-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=107487971405960\u0026w=2"
},
{
"source": "cve@mitre.org",
"url": "http://phorum.org/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=107487971405960\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phorum.org/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-09-24 00:55
Modified
2024-11-21 01:31
Severity ?
Summary
Phorum 5.2.15a allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by css.php and certain other files.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.15a:*:*:*:*:*:*:*",
"matchCriteriaId": "AE2F9B2A-BECA-4EE9-BDDA-4FE27CB8AE37",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Phorum 5.2.15a allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by css.php and certain other files."
},
{
"lang": "es",
"value": "Phorum v5.2.15a permite a atacantes remotos obtener informaci\u00f3n sensible a trav\u00e9s de una petici\u00f3n directa a un archivo .php, lo que revela la ruta de instalaci\u00f3n en un mensaje de error, como se demostr\u00f3 con css.php y algunos otros archivos."
}
],
"id": "CVE-2011-3768",
"lastModified": "2024-11-21T01:31:13.183",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2011-09-24T00:55:01.990",
"references": [
{
"source": "cve@mitre.org",
"url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README"
},
{
"source": "cve@mitre.org",
"url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/phorum-5.2.15a"
},
{
"source": "cve@mitre.org",
"url": "http://www.openwall.com/lists/oss-security/2011/06/27/6"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/70604"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/phorum-5.2.15a"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2011/06/27/6"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/70604"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2000-12-31 05:00
Modified
2024-11-20 23:34
Severity ?
Summary
code.php3 in Phorum 3.0.7 allows remote attackers to read arbitrary files in the phorum directory via the query string.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:3.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "740F974F-D679-472C-966A-3E4C334E3C0A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "code.php3 in Phorum 3.0.7 allows remote attackers to read arbitrary files in the phorum directory via the query string."
}
],
"id": "CVE-2000-1231",
"lastModified": "2024-11-20T23:34:19.137",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2000-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html"
},
{
"source": "cve@mitre.org",
"url": "http://hispahack.ccc.de/mi020.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://hispahack.ccc.de/mi020.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2008-03-24 23:44
Modified
2024-11-21 00:44
Severity ?
Summary
SQL injection vulnerability in Phorum before 5.2.6, when mysql_use_ft is disabled, allows remote attackers to execute arbitrary SQL commands via the non-fulltext search.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phorum | phorum | * | |
| phorum | phorum | 5.0.0_alpha | |
| phorum | phorum | 5.0.1_alpha | |
| phorum | phorum | 5.0.2_alpha | |
| phorum | phorum | 5.0.3_beta | |
| phorum | phorum | 5.0.4_beta | |
| phorum | phorum | 5.0.4a_beta | |
| phorum | phorum | 5.0.5_beta | |
| phorum | phorum | 5.0.6_beta | |
| phorum | phorum | 5.0.7_beta | |
| phorum | phorum | 5.0.7a_beta | |
| phorum | phorum | 5.0.8_rc | |
| phorum | phorum | 5.0.9 | |
| phorum | phorum | 5.0.10 | |
| phorum | phorum | 5.0.11 | |
| phorum | phorum | 5.0.12 | |
| phorum | phorum | 5.0.13 | |
| phorum | phorum | 5.0.13a | |
| phorum | phorum | 5.0.14 | |
| phorum | phorum | 5.0.14a | |
| phorum | phorum | 5.0.15 | |
| phorum | phorum | 5.0.15a | |
| phorum | phorum | 5.0.16 | |
| phorum | phorum | 5.0.17 | |
| phorum | phorum | 5.0.17a | |
| phorum | phorum | 5.0.18 | |
| phorum | phorum | 5.0.19 | |
| phorum | phorum | 5.0.20 | |
| phorum | phorum | 5.1.13 | |
| phorum | phorum | 5.1.14 | |
| phorum | phorum | 5.1.17 | |
| phorum | phorum | 5.1.18 | |
| phorum | phorum | 5.1.20 | |
| phorum | phorum | 5.1.21 | |
| phorum | phorum | 5.1.25 | |
| phorum | phorum | 5.2 | |
| phorum | phorum | 5.2.1 | |
| phorum | phorum | 5.2.2 | |
| phorum | phorum | 5.2.3 | |
| phorum | phorum | 5.2.4 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:*:*:*:*:*:*:*:*",
"matchCriteriaId": "51F00681-EE3F-40FA-B516-19C64B76B973",
"versionEndIncluding": "5.2.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.0_alpha:*:*:*:*:*:*:*",
"matchCriteriaId": "26E2C5A7-8B52-4BDF-80F1-5D45AEBE6E25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.1_alpha:*:*:*:*:*:*:*",
"matchCriteriaId": "0E8DF602-0A22-45A9-A286-C237180701C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.2_alpha:*:*:*:*:*:*:*",
"matchCriteriaId": "AB109C36-BF0F-41E3-A1F4-0DB264BD4A55",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.3_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "9A31EA2D-2B01-4928-9B3E-9D666FD2758B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.4_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "E87DE16C-7C68-4DA8-9BD9-C61D74E61D6E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.4a_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "5001527E-FE93-4BE7-BF79-7717D64CAF2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.5_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "D15ED599-6B84-4E03-8BA4-36E1D55F1F75",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.6_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "D491A2B9-949A-4A56-A41F-23A222C03BA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.7_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "01CFDB0B-6FBD-49F3-8238-81E92661297E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.7a_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "EC73A23F-2399-41B0-B6BD-289DF63F2C6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.8_rc:*:*:*:*:*:*:*",
"matchCriteriaId": "AD59DD99-1FC7-498B-9EA1-1AA8FE132EEE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "1655572D-7D56-4D9D-9E0F-A67DF23FC934",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "387E0B83-B240-4922-8C57-CE0CDB000888",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "CF5B09FF-92DF-4F8D-9A7B-E5086E2B954D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "D02321D7-2F3E-40F9-9A76-CFF339C93199",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "3B908D49-F64A-488F-95F3-163AB9DAB02D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.13a:*:*:*:*:*:*:*",
"matchCriteriaId": "1A26F8E5-0FFE-473D-BDA1-2D5340B5A4A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.14:*:*:*:*:*:*:*",
"matchCriteriaId": "0FF0655C-7C83-4363-A444-993B35D7A7EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.14a:*:*:*:*:*:*:*",
"matchCriteriaId": "B3D0F7C4-902D-4186-8EFF-3876D6D6633E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.15:*:*:*:*:*:*:*",
"matchCriteriaId": "6F87C476-6A55-4B19-97B0-24204E96A63E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.15a:*:*:*:*:*:*:*",
"matchCriteriaId": "83F8F544-1B09-4B22-B1F3-2CD1E8D7AECD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.16:*:*:*:*:*:*:*",
"matchCriteriaId": "8ACC6DD4-384B-44DE-9BC7-6F1DD374E6B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.17:*:*:*:*:*:*:*",
"matchCriteriaId": "17D0AC3E-97F7-4A13-8E65-7E424D055E38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.17a:*:*:*:*:*:*:*",
"matchCriteriaId": "D184385A-763A-4971-8051-20564D020787",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.18:*:*:*:*:*:*:*",
"matchCriteriaId": "04B508F8-CFCC-4841-BF70-1ABB28EB1ABC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.19:*:*:*:*:*:*:*",
"matchCriteriaId": "C365D62D-ACB1-44D3-935D-F79A79642684",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.20:*:*:*:*:*:*:*",
"matchCriteriaId": "F4B45305-FF8B-42F8-A726-F8604BADC323",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.13:*:*:*:*:*:*:*",
"matchCriteriaId": "70F4AB87-2D63-4208-8982-BBF978392285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.14:*:*:*:*:*:*:*",
"matchCriteriaId": "149A6B5A-84FC-4B6F-B053-0AC881BC03D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.17:*:*:*:*:*:*:*",
"matchCriteriaId": "375346D4-CEA4-4BAE-83DF-639E86C3DECC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.18:*:*:*:*:*:*:*",
"matchCriteriaId": "3C6E0429-3241-47B0-B853-66D3167CE4F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.20:*:*:*:*:*:*:*",
"matchCriteriaId": "121F0F96-F901-479F-A64F-3DAE1AC0AFAF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.21:*:*:*:*:*:*:*",
"matchCriteriaId": "F837829B-28E5-41B3-9A23-C4D4A7FE636A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.25:*:*:*:*:*:*:*",
"matchCriteriaId": "700B9165-B956-4CAB-B980-42885FFA418F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A4C4E79D-EBE6-456C-A74F-B94F32736383",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D3596808-8399-4EA9-B885-5443CA91C3C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.2:beta:*:*:*:*:*:*",
"matchCriteriaId": "B5409C8A-8B57-48FB-B01E-411C00153E9B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "74DB422C-E79C-46B2-BB52-8C457822A0BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.4:rc2:*:*:*:*:*:*",
"matchCriteriaId": "37881B2C-0CD0-4E2A-A11D-9758772640E9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in Phorum before 5.2.6, when mysql_use_ft is disabled, allows remote attackers to execute arbitrary SQL commands via the non-fulltext search."
},
{
"lang": "es",
"value": "Una vulnerabilidad de inyecci\u00f3n SQL en Phorum versiones anteriores a 5.2.6, cuando la funci\u00f3n mysql_use_ft est\u00e1 deshabilitado, permite a los atacantes remotos ejecutar comandos SQL arbitrarios por medio de la b\u00fasqueda sin texto completo."
}
],
"id": "CVE-2008-1486",
"lastModified": "2024-11-21T00:44:39.227",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2008-03-24T23:44:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/29519"
},
{
"source": "cve@mitre.org",
"url": "http://www.phorum.org/phorum5/read.php?64%2C126815%2C126815"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/28540"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41418"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/29519"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phorum.org/phorum5/read.php?64%2C126815%2C126815"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/28540"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41418"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-05-02 04:00
Modified
2024-11-20 23:55
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in Phorum before 5.0.14a allows remote attackers to inject arbitrary web script or HTML via the filename of an attached file.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.14:*:*:*:*:*:*:*",
"matchCriteriaId": "0FF0655C-7C83-4363-A444-993B35D7A7EA",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Phorum before 5.0.14a allows remote attackers to inject arbitrary web script or HTML via the filename of an attached file."
}
],
"id": "CVE-2005-0783",
"lastModified": "2024-11-20T23:55:53.533",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-05-02T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=111083279031544\u0026w=2"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://secunia.com/advisories/14554"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/12800"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=111083279031544\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://secunia.com/advisories/14554"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/12800"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2000-12-31 05:00
Modified
2024-11-20 23:34
Severity ?
Summary
violation.php3 in Phorum 3.0.7 allows remote attackers to send e-mails to arbitrary addresses and possibly use Phorum as a "spam proxy" by setting the Mod and ForumName parameters.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:3.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "740F974F-D679-472C-966A-3E4C334E3C0A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "violation.php3 in Phorum 3.0.7 allows remote attackers to send e-mails to arbitrary addresses and possibly use Phorum as a \"spam proxy\" by setting the Mod and ForumName parameters."
}
],
"id": "CVE-2000-1234",
"lastModified": "2024-11-20T23:34:19.560",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2000-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html"
},
{
"source": "cve@mitre.org",
"url": "http://hispahack.ccc.de/mi020.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "http://www.securityfocus.com/bid/2272"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://hispahack.ccc.de/mi020.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "http://www.securityfocus.com/bid/2272"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-05-02 04:00
Modified
2024-11-20 23:56
Severity ?
Summary
CRLF injection vulnerability in search.php in Phorum 5.0.14a allows remote attackers to perform HTTP Response Splitting attacks via the body parameter, which is included in the resulting Location header.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.14a:*:*:*:*:*:*:*",
"matchCriteriaId": "B3D0F7C4-902D-4186-8EFF-3876D6D6633E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "CRLF injection vulnerability in search.php in Phorum 5.0.14a allows remote attackers to perform HTTP Response Splitting attacks via the body parameter, which is included in the resulting Location header."
}
],
"id": "CVE-2005-0843",
"lastModified": "2024-11-20T23:56:01.293",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-05-02T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=111151651621097\u0026w=2"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/14680"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=111151651621097\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/14680"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-06-27 10:05
Modified
2024-11-21 00:13
Severity ?
Summary
SQL injection vulnerability in search.php in Phorum 5.1.14 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter. NOTE: the vendor has disputed this report, stating "If a non positive integer or non-integer is used for the page parameter for a search URL, the search query will use a negative number for the LIMIT clause. This causes the query to break, showing no results. It IS NOT however a sql injection error." While the original report is from a researcher with mixed accuracy, as of 20060703, CVE does not have any additional information regarding this issue
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2520A79B-FC05-47C4-9D15-46BDE0F6BEB9",
"versionEndIncluding": "5.1.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [
{
"sourceIdentifier": "cve@mitre.org",
"tags": [
"disputed"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in search.php in Phorum 5.1.14 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter. NOTE: the vendor has disputed this report, stating \"If a non positive integer or non-integer is used for the page parameter for a search URL, the search query will use a negative number for the LIMIT clause. This causes the query to break, showing no results. It IS NOT however a sql injection error.\" While the original report is from a researcher with mixed accuracy, as of 20060703, CVE does not have any additional information regarding this issue"
},
{
"lang": "es",
"value": "** DISCUTIDA ** Vulnerabilidad de inyecci\u00f3n SQL en search.php en Phorum v5.1.14 y anteriores permite a atacantes remotos ejecutar comandos SQL de su elecci\u00f3n a trav\u00e9s del par\u00e1metro page. NOTA: el fabricante ha discutido este tema, alegando que \"si un entero no positivo o un no entero es usado en el par\u00e1metro page para una URL de b\u00fasqueda, la solicitud de respuesta usar\u00e1 un numero negativo para la clausula LIMIT. Esto causa que la pregunta rompa, no mostrando resultados. Esto sin embargo, no es un error de inyecci\u00f3n SQL.\" Mientras el informe original procede de un investigador con desigual exactitud, como 20060703, el CVE no tiene otra informaci\u00f3n adicional relacionada con el tema. \r\n"
}
],
"id": "CVE-2006-3249",
"lastModified": "2024-11-21T00:13:10.310",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-06-27T10:05:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://pridels0.blogspot.com/2006/06/phorum-sql-injection-vuln.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/27165"
},
{
"source": "cve@mitre.org",
"url": "http://www.phorum.org/cgi-bin/trac.cgi/ticket/382#preview"
},
{
"source": "cve@mitre.org",
"url": "http://www.phorum.org/phorum5/read.php?14%2C114358"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27369"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://pridels0.blogspot.com/2006/06/phorum-sql-injection-vuln.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/27165"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phorum.org/cgi-bin/trac.cgi/ticket/382#preview"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phorum.org/phorum5/read.php?14%2C114358"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27369"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2004-04-19 04:00
Modified
2024-11-20 23:52
Severity ?
Summary
SQL injection vulnerability in userlogin.php in Phorum 3.4.7 allows remote attackers to execute arbitrary SQL commands via doubly hex-encoded characters such as "%2527", which is translated to "'", as demonstrated using the phorum_uriauth parameter to list.php.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://marc.info/?l=bugtraq&m=108239796512897&w=2 | ||
| cve@mitre.org | http://secunia.com/advisories/11407 | Exploit, Patch, Vendor Advisory | |
| cve@mitre.org | http://www.securityfocus.com/bid/10173 | Exploit, Patch, Vendor Advisory | |
| cve@mitre.org | http://www.waraxe.us/index.php?modname=sa&id=19 | Exploit, Vendor Advisory | |
| cve@mitre.org | https://exchange.xforce.ibmcloud.com/vulnerabilities/15894 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://marc.info/?l=bugtraq&m=108239796512897&w=2 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/11407 | Exploit, Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/10173 | Exploit, Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.waraxe.us/index.php?modname=sa&id=19 | Exploit, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/15894 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "FF13359B-162A-41DF-BB4F-DDD6CA2752F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "7D1AE057-A85C-49D9-981A-3314BD945D08",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in userlogin.php in Phorum 3.4.7 allows remote attackers to execute arbitrary SQL commands via doubly hex-encoded characters such as \"%2527\", which is translated to \"\u0027\", as demonstrated using the phorum_uriauth parameter to list.php."
}
],
"id": "CVE-2004-1938",
"lastModified": "2024-11-20T23:52:06.280",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2004-04-19T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=108239796512897\u0026w=2"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/11407"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/10173"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://www.waraxe.us/index.php?modname=sa\u0026id=19"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15894"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=108239796512897\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/11407"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/10173"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://www.waraxe.us/index.php?modname=sa\u0026id=19"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15894"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-09-08 18:55
Modified
2024-11-21 01:30
Severity ?
Summary
Cross-site request forgery (CSRF) vulnerability in Phorum before 5.2.16 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:*:*:*:*:*:*:*:*",
"matchCriteriaId": "38B3FD6E-D73A-4018-B4D5-158C0B288B1B",
"versionEndIncluding": "5.2.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "740F974F-D679-472C-966A-3E4C334E3C0A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "32D7E47E-10F5-4F50-8940-951B2C0011CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16042FAE-7370-425C-8810-4F9363B7CAA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.1_pre:*:*:*:*:*:*:*",
"matchCriteriaId": "B4A25A6F-62CA-4C76-9D4C-821B1E15FB1B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.1_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "6247DB0C-37B6-44EF-8B92-8CFCDA537039",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.1a:*:*:*:*:*:*:*",
"matchCriteriaId": "4C46298C-2492-4102-A264-E2A1D45AD423",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1A2AD59F-42DF-407A-8FCA-E6E0067A2B3A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "17E1044B-2101-4719-8749-17DD22F46055",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B7E17261-A010-4929-99E5-A2511F205B72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A461E2EB-9964-44DE-9C25-562D239201F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.3a:*:*:*:*:*:*:*",
"matchCriteriaId": "9CB6A4EC-D351-4EF8-8C6A-294A47DDCCC7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.3b:*:*:*:*:*:*:*",
"matchCriteriaId": "2B10230A-7D72-418E-8A29-E9F20762C43A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "368C8142-836A-4FDB-9CD8-385FE06B9A62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1470761E-DA6E-4D2A-B226-1ED782FB3654",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "FEB3ED23-821D-42FA-A24F-F2EDDA43D7B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "88BA8736-5998-42E0-81E4-76E3669F8112",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "DC9811C9-EE92-4115-B81F-7A3030390BD1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "5A196AD2-7E48-40F4-923E-437FA76C97D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.1a:*:*:*:*:*:*:*",
"matchCriteriaId": "91D147F0-FF83-4FF4-AEF1-71366E874876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D87C46-D9EC-418B-9C8C-71E7149C72D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.2a:*:*:*:*:*:*:*",
"matchCriteriaId": "A7F6BE0A-7E2F-457D-B4BA-6BAE1B44E7D3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.2b3:*:*:*:*:*:*:*",
"matchCriteriaId": "C990B390-4768-41B0-BB8B-A56C2524623F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6650BE9D-5F4B-4B22-BD7E-ABCC067D5455",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1B8E0CA9-F6D4-4DD3-A3EA-F3A40965261B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7F67B233-3087-43E6-94F2-5DF39FAA36B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "7725AEF3-1C47-46B4-A35E-97152A84E731",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "F3F6C52C-F602-4C2A-8C8F-4A19DA41186F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "45F290E5-6508-4F62-8572-31B33750D341",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6D941B5F-B704-4596-8739-BFE34225DBA7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "FF13359B-162A-41DF-BB4F-DDD6CA2752F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "7D1AE057-A85C-49D9-981A-3314BD945D08",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.8a:*:*:*:*:*:*:*",
"matchCriteriaId": "EAC1F375-34EF-4FEC-B0F4-6A081B6A3B53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:4.3.7:*:*:*:*:*:*:*",
"matchCriteriaId": "1E532A66-A12D-48DD-B405-2345E5B715C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.0_alpha:*:*:*:*:*:*:*",
"matchCriteriaId": "26E2C5A7-8B52-4BDF-80F1-5D45AEBE6E25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.1_alpha:*:*:*:*:*:*:*",
"matchCriteriaId": "0E8DF602-0A22-45A9-A286-C237180701C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.2_alpha:*:*:*:*:*:*:*",
"matchCriteriaId": "AB109C36-BF0F-41E3-A1F4-0DB264BD4A55",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.3_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "9A31EA2D-2B01-4928-9B3E-9D666FD2758B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.4_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "E87DE16C-7C68-4DA8-9BD9-C61D74E61D6E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.4a_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "5001527E-FE93-4BE7-BF79-7717D64CAF2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.5_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "D15ED599-6B84-4E03-8BA4-36E1D55F1F75",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.6_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "D491A2B9-949A-4A56-A41F-23A222C03BA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.7_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "01CFDB0B-6FBD-49F3-8238-81E92661297E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.7a_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "EC73A23F-2399-41B0-B6BD-289DF63F2C6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.8_rc:*:*:*:*:*:*:*",
"matchCriteriaId": "AD59DD99-1FC7-498B-9EA1-1AA8FE132EEE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "1655572D-7D56-4D9D-9E0F-A67DF23FC934",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "387E0B83-B240-4922-8C57-CE0CDB000888",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "CF5B09FF-92DF-4F8D-9A7B-E5086E2B954D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "D02321D7-2F3E-40F9-9A76-CFF339C93199",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "3B908D49-F64A-488F-95F3-163AB9DAB02D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.13a:*:*:*:*:*:*:*",
"matchCriteriaId": "1A26F8E5-0FFE-473D-BDA1-2D5340B5A4A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.14:*:*:*:*:*:*:*",
"matchCriteriaId": "0FF0655C-7C83-4363-A444-993B35D7A7EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.14a:*:*:*:*:*:*:*",
"matchCriteriaId": "B3D0F7C4-902D-4186-8EFF-3876D6D6633E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.15:*:*:*:*:*:*:*",
"matchCriteriaId": "6F87C476-6A55-4B19-97B0-24204E96A63E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.15a:*:*:*:*:*:*:*",
"matchCriteriaId": "83F8F544-1B09-4B22-B1F3-2CD1E8D7AECD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.16:*:*:*:*:*:*:*",
"matchCriteriaId": "8ACC6DD4-384B-44DE-9BC7-6F1DD374E6B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.17:*:*:*:*:*:*:*",
"matchCriteriaId": "17D0AC3E-97F7-4A13-8E65-7E424D055E38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.17a:*:*:*:*:*:*:*",
"matchCriteriaId": "D184385A-763A-4971-8051-20564D020787",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.18:*:*:*:*:*:*:*",
"matchCriteriaId": "04B508F8-CFCC-4841-BF70-1ABB28EB1ABC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.19:*:*:*:*:*:*:*",
"matchCriteriaId": "C365D62D-ACB1-44D3-935D-F79A79642684",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.20:*:*:*:*:*:*:*",
"matchCriteriaId": "F4B45305-FF8B-42F8-A726-F8604BADC323",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.13:*:*:*:*:*:*:*",
"matchCriteriaId": "70F4AB87-2D63-4208-8982-BBF978392285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.14:*:*:*:*:*:*:*",
"matchCriteriaId": "149A6B5A-84FC-4B6F-B053-0AC881BC03D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.17:*:*:*:*:*:*:*",
"matchCriteriaId": "375346D4-CEA4-4BAE-83DF-639E86C3DECC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.18:*:*:*:*:*:*:*",
"matchCriteriaId": "3C6E0429-3241-47B0-B853-66D3167CE4F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.20:*:*:*:*:*:*:*",
"matchCriteriaId": "121F0F96-F901-479F-A64F-3DAE1AC0AFAF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.21:*:*:*:*:*:*:*",
"matchCriteriaId": "F837829B-28E5-41B3-9A23-C4D4A7FE636A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.25:*:*:*:*:*:*:*",
"matchCriteriaId": "700B9165-B956-4CAB-B980-42885FFA418F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A4C4E79D-EBE6-456C-A74F-B94F32736383",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D3596808-8399-4EA9-B885-5443CA91C3C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.2:beta:*:*:*:*:*:*",
"matchCriteriaId": "B5409C8A-8B57-48FB-B01E-411C00153E9B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "74DB422C-E79C-46B2-BB52-8C457822A0BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.4:rc2:*:*:*:*:*:*",
"matchCriteriaId": "37881B2C-0CD0-4E2A-A11D-9758772640E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "66BE61C7-E1DD-4DA9-B433-0C698C482C57",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "FB5E063A-F59F-4CEB-9950-2FE8D25FF9FF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.9:*:*:*:*:*:*:*",
"matchCriteriaId": "F0A35F3F-6BBF-4B84-AE19-870F03C1E9DC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.10:*:*:*:*:*:*:*",
"matchCriteriaId": "90FC064F-B462-47F8-880F-CB26A340477E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.10:rc1:*:*:*:*:*:*",
"matchCriteriaId": "D083445E-48ED-4666-98A8-932B01A0F9B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.11:*:*:*:*:*:*:*",
"matchCriteriaId": "A79911F1-C1C3-4DD1-BA37-AFC77D7B0D90",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.12:*:*:*:*:*:*:*",
"matchCriteriaId": "2200E549-30F8-4803-A570-FBF08B97B7CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.12a:*:*:*:*:*:*:*",
"matchCriteriaId": "2798D56A-BEBC-4EC0-ACA3-D0B9E8E4D61D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.13:*:*:*:*:*:*:*",
"matchCriteriaId": "D9876C40-4537-4622-90D5-175AB59609D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "51638139-DB4F-4B8C-B125-1FE9AFC86B21",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability in Phorum before 5.2.16 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors."
},
{
"lang": "es",
"value": "Vulnerabilidad de falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF) en Phorum antes de v5.2.16 permite a atacantes remotos secuestrar la autenticaci\u00f3n de victimas no especificadas a trav\u00e9s de vectores desconocidos."
}
],
"id": "CVE-2011-3381",
"lastModified": "2024-11-21T01:30:24.333",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2011-09-08T18:55:01.677",
"references": [
{
"source": "vultures@jpcert.or.jp",
"url": "http://jvn.jp/en/jp/JVN71435255/index.html"
},
{
"source": "vultures@jpcert.or.jp",
"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2011-000068"
},
{
"source": "vultures@jpcert.or.jp",
"url": "http://www.phorum.org/phorum5/read.php?64%2C147504"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://jvn.jp/en/jp/JVN71435255/index.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2011-000068"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phorum.org/phorum5/read.php?64%2C147504"
}
],
"sourceIdentifier": "vultures@jpcert.or.jp",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-352"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2000-12-31 05:00
Modified
2024-11-20 23:34
Severity ?
Summary
SQL injection vulnerability in read.php3 and other scripts in Phorum 3.0.7 allows remote attackers to execute arbitrary SQL queries via the sSQL parameter.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:3.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "740F974F-D679-472C-966A-3E4C334E3C0A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in read.php3 and other scripts in Phorum 3.0.7 allows remote attackers to execute arbitrary SQL queries via the sSQL parameter."
}
],
"id": "CVE-2000-1233",
"lastModified": "2024-11-20T23:34:19.423",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2000-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html"
},
{
"source": "cve@mitre.org",
"url": "http://hispahack.ccc.de/mi020.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://hispahack.ccc.de/mi020.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2000-12-31 05:00
Modified
2024-11-20 23:34
Severity ?
Summary
upgrade.php3 in Phorum 3.0.7 could allow remote attackers to modify certain Phorum database tables via an unknown method.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:3.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "740F974F-D679-472C-966A-3E4C334E3C0A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "upgrade.php3 in Phorum 3.0.7 could allow remote attackers to modify certain Phorum database tables via an unknown method."
}
],
"id": "CVE-2000-1232",
"lastModified": "2024-11-20T23:34:19.280",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2000-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html"
},
{
"source": "cve@mitre.org",
"url": "http://hispahack.ccc.de/mi020.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://hispahack.ccc.de/mi020.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-02-06 02:28
Modified
2024-11-21 00:26
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the core in Phorum before 5.1.18 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:*:*:*:*:*:*:*:*",
"matchCriteriaId": "97833086-60C7-4321-BEA3-1E7D425C5EC9",
"versionEndIncluding": "5.1.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the core in Phorum before 5.1.18 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
},
{
"lang": "es",
"value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en el n\u00facleo de Phorum anterior a 5.1.18 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s de vectores no especificados."
}
],
"id": "CVE-2007-0767",
"lastModified": "2024-11-21T00:26:41.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-02-06T02:28:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/34727"
},
{
"source": "cve@mitre.org",
"url": "http://www.phorum.org/phorum5/read.php?12%2C119757"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/0410"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44201"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/34727"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phorum.org/phorum5/read.php?12%2C119757"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/0410"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44201"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-02-06 02:28
Modified
2024-11-21 00:24
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the group moderation control center page in Phorum before 5.1.19 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E72BCECA-3309-4059-8DE2-CEB8D83B266A",
"versionEndIncluding": "5.1.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the group moderation control center page in Phorum before 5.1.19 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors."
},
{
"lang": "es",
"value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la p\u00e1gina centro de control de moderaci\u00f3n de grupo en Phorum anterior a 5.1.19 podr\u00eda permitir a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s de vectores no especificados."
}
],
"id": "CVE-2006-6968",
"lastModified": "2024-11-21T00:24:04.397",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-02-06T02:28:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/34729"
},
{
"source": "cve@mitre.org",
"url": "http://www.phorum.org/phorum5/read.php?12%2C119757"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/0410"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/34729"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phorum.org/phorum5/read.php?12%2C119757"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/0410"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-07-18 15:46
Modified
2024-11-21 00:14
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in Phorum 5.1.14 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.14:*:*:*:*:*:*:*",
"matchCriteriaId": "149A6B5A-84FC-4B6F-B053-0AC881BC03D0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Phorum 5.1.14 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
},
{
"lang": "es",
"value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Phorum 5.1.14 permite a atacantes remotos inyectar secuencias de comando web o HTML a trav\u00e9s de vectores no especificados."
}
],
"evaluatorSolution": "Successful exploitation requires that register_globals is enabled.\r\nThis vulnerability is addressed in the following product release:\r\nPhorum, Phorum, 5.1.15",
"id": "CVE-2006-3612",
"lastModified": "2024-11-21T00:14:01.657",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-07-18T15:46:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://www.phorum.org/phorum5/read.php?14%2C114358"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phorum.org/phorum5/read.php?14%2C114358"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-06-16 10:02
Modified
2024-11-21 00:12
Severity ?
Summary
PHP remote file inclusion vulnerability in common.php in PHORUM 5.1.13 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the PHORUM[http_path] parameter. NOTE: this issue has been disputed by the vendor, who states "common.php is checked on the very first line of non-comment code that it is not being called directly. It has been this way in all 5.x version of Phorum." CVE analysis concurs with the vendor
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phorum | phorum | * | |
| phorum | phorum | 3.1 | |
| phorum | phorum | 3.1.1 | |
| phorum | phorum | 3.1.1_pre | |
| phorum | phorum | 3.1.1_rc2 | |
| phorum | phorum | 3.1.1a | |
| phorum | phorum | 3.1.2 | |
| phorum | phorum | 3.2 | |
| phorum | phorum | 3.2.2 | |
| phorum | phorum | 3.2.3 | |
| phorum | phorum | 3.2.3a | |
| phorum | phorum | 3.2.3b | |
| phorum | phorum | 3.2.4 | |
| phorum | phorum | 3.2.5 | |
| phorum | phorum | 3.2.6 | |
| phorum | phorum | 3.2.7 | |
| phorum | phorum | 3.2.8 | |
| phorum | phorum | 3.3.1 | |
| phorum | phorum | 3.3.1a | |
| phorum | phorum | 3.3.2 | |
| phorum | phorum | 3.3.2a | |
| phorum | phorum | 3.3.2b3 | |
| phorum | phorum | 3.4 | |
| phorum | phorum | 3.4.1 | |
| phorum | phorum | 3.4.2 | |
| phorum | phorum | 3.4.3 | |
| phorum | phorum | 3.4.4 | |
| phorum | phorum | 3.4.5 | |
| phorum | phorum | 3.4.6 | |
| phorum | phorum | 3.4.7 | |
| phorum | phorum | 3.4.8 | |
| phorum | phorum | 3.4.8a | |
| phorum | phorum | 5.0.3_beta | |
| phorum | phorum | 5.0.7_beta | |
| phorum | phorum | 5.0.9 | |
| phorum | phorum | 5.0.10 | |
| phorum | phorum | 5.0.11 | |
| phorum | phorum | 5.0.12 | |
| phorum | phorum | 5.0.13 | |
| phorum | phorum | 5.0.14 | |
| phorum | phorum | 5.0.15a | |
| phorum | phorum | 5.0.16 | |
| phorum | phorum | 5.0.17a | |
| phorum | phorum | 5.0.18 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:*:*:*:*:*:*:*:*",
"matchCriteriaId": "F19AEEA5-7EF8-4D53-828D-A123F310987E",
"versionEndIncluding": "5.1.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "32D7E47E-10F5-4F50-8940-951B2C0011CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16042FAE-7370-425C-8810-4F9363B7CAA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.1_pre:*:*:*:*:*:*:*",
"matchCriteriaId": "B4A25A6F-62CA-4C76-9D4C-821B1E15FB1B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.1_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "6247DB0C-37B6-44EF-8B92-8CFCDA537039",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.1a:*:*:*:*:*:*:*",
"matchCriteriaId": "4C46298C-2492-4102-A264-E2A1D45AD423",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1A2AD59F-42DF-407A-8FCA-E6E0067A2B3A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "17E1044B-2101-4719-8749-17DD22F46055",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B7E17261-A010-4929-99E5-A2511F205B72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A461E2EB-9964-44DE-9C25-562D239201F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.3a:*:*:*:*:*:*:*",
"matchCriteriaId": "9CB6A4EC-D351-4EF8-8C6A-294A47DDCCC7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.3b:*:*:*:*:*:*:*",
"matchCriteriaId": "2B10230A-7D72-418E-8A29-E9F20762C43A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "368C8142-836A-4FDB-9CD8-385FE06B9A62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1470761E-DA6E-4D2A-B226-1ED782FB3654",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "FEB3ED23-821D-42FA-A24F-F2EDDA43D7B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "88BA8736-5998-42E0-81E4-76E3669F8112",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "DC9811C9-EE92-4115-B81F-7A3030390BD1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "5A196AD2-7E48-40F4-923E-437FA76C97D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.1a:*:*:*:*:*:*:*",
"matchCriteriaId": "91D147F0-FF83-4FF4-AEF1-71366E874876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D87C46-D9EC-418B-9C8C-71E7149C72D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.2a:*:*:*:*:*:*:*",
"matchCriteriaId": "A7F6BE0A-7E2F-457D-B4BA-6BAE1B44E7D3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.2b3:*:*:*:*:*:*:*",
"matchCriteriaId": "C990B390-4768-41B0-BB8B-A56C2524623F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6650BE9D-5F4B-4B22-BD7E-ABCC067D5455",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1B8E0CA9-F6D4-4DD3-A3EA-F3A40965261B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7F67B233-3087-43E6-94F2-5DF39FAA36B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "7725AEF3-1C47-46B4-A35E-97152A84E731",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "F3F6C52C-F602-4C2A-8C8F-4A19DA41186F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "45F290E5-6508-4F62-8572-31B33750D341",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6D941B5F-B704-4596-8739-BFE34225DBA7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "FF13359B-162A-41DF-BB4F-DDD6CA2752F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "7D1AE057-A85C-49D9-981A-3314BD945D08",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.8a:*:*:*:*:*:*:*",
"matchCriteriaId": "EAC1F375-34EF-4FEC-B0F4-6A081B6A3B53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.3_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "9A31EA2D-2B01-4928-9B3E-9D666FD2758B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.7_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "01CFDB0B-6FBD-49F3-8238-81E92661297E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "1655572D-7D56-4D9D-9E0F-A67DF23FC934",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "387E0B83-B240-4922-8C57-CE0CDB000888",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "CF5B09FF-92DF-4F8D-9A7B-E5086E2B954D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "D02321D7-2F3E-40F9-9A76-CFF339C93199",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "3B908D49-F64A-488F-95F3-163AB9DAB02D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.14:*:*:*:*:*:*:*",
"matchCriteriaId": "0FF0655C-7C83-4363-A444-993B35D7A7EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.15a:*:*:*:*:*:*:*",
"matchCriteriaId": "83F8F544-1B09-4B22-B1F3-2CD1E8D7AECD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.16:*:*:*:*:*:*:*",
"matchCriteriaId": "8ACC6DD4-384B-44DE-9BC7-6F1DD374E6B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.17a:*:*:*:*:*:*:*",
"matchCriteriaId": "D184385A-763A-4971-8051-20564D020787",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.18:*:*:*:*:*:*:*",
"matchCriteriaId": "04B508F8-CFCC-4841-BF70-1ABB28EB1ABC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [
{
"sourceIdentifier": "cve@mitre.org",
"tags": [
"disputed"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "PHP remote file inclusion vulnerability in common.php in PHORUM 5.1.13 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the PHORUM[http_path] parameter. NOTE: this issue has been disputed by the vendor, who states \"common.php is checked on the very first line of non-comment code that it is not being called directly. It has been this way in all 5.x version of Phorum.\" CVE analysis concurs with the vendor"
},
{
"lang": "es",
"value": "** EN DISPUTA ** PHP vulnerabilidad de inclusi\u00f3n de archivo remoto en common.php en Phorum v5.1.13 y anteriores permite a atacantes remotos ejecutar c\u00f3digo PHP arbitrario a trav\u00e9s de una URL en el par\u00e1metro Phorum [http_path]. NOTA: este problema ha sido discutido por el vendedor, quien afirma que \"common.php se comprueba en la primera l\u00ednea de c\u00f3digo no comment-que no se est\u00e1 llamando directamente Ha sido as\u00ed en todas las versiones 5.x de Phorum.\" CVE an\u00e1lisis coincide con el vendedor."
}
],
"id": "CVE-2006-3053",
"lastModified": "2024-11-21T00:12:42.723",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-06-16T10:02:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://securityreason.com/securityalert/1103"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/436863/100/0/threaded"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/437988/100/0/threaded"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/16977"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27064"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/1103"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/436863/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/437988/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/16977"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27064"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-04-27 16:19
Modified
2024-11-21 00:30
Severity ?
Summary
Multiple SQL injection vulnerabilities in Phorum before 5.1.22 allow remote attackers to execute arbitrary SQL commands via (1) a modified recipients parameter name in (a) pm.php; (2) the curr parameter to the (b) badwords (aka censorlist) or (c) banlist module in admin.php; or (3) the "Edit groups / Add group" field in the (d) groups module in admin.php.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E6CCA297-E655-4134-BC6D-F190C4C228D6",
"versionEndIncluding": "5.1.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple SQL injection vulnerabilities in Phorum before 5.1.22 allow remote attackers to execute arbitrary SQL commands via (1) a modified recipients parameter name in (a) pm.php; (2) the curr parameter to the (b) badwords (aka censorlist) or (c) banlist module in admin.php; or (3) the \"Edit groups / Add group\" field in the (d) groups module in admin.php."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de inyecci\u00f3n SQL en Phorum anterior a 5.1.22 permite a atacantes remotos ejecutar comandos SQL de su elecci\u00f3n a trav\u00e9s de (1)un nombre modificado del par\u00e1metro de los recipientes en (a) pm.php; (2) el par\u00e1metro curr en (b)badwords (tambi\u00e9n conocido como censorlist) o (c) m\u00f3ldulo banlist en admin.php; o (3) el campo \"editar grupos / A\u00f1adir grupo\" en el m\u00f3dulo (d) groups en admin.php."
}
],
"id": "CVE-2007-2339",
"lastModified": "2024-11-21T00:30:32.703",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-04-27T16:19:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/35062"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/35063"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/35064"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/24932"
},
{
"source": "cve@mitre.org",
"url": "http://securityreason.com/securityalert/2617"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://securitytracker.com/id?1017936"
},
{
"source": "cve@mitre.org",
"url": "http://www.phorum.org/story.php?76"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/466286/100/0/threaded"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "http://www.securityfocus.com/bid/23616"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/1479"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://www.waraxe.us/advisory-49.html"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34081"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/35062"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/35063"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/35064"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/24932"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/2617"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://securitytracker.com/id?1017936"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phorum.org/story.php?76"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/466286/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "http://www.securityfocus.com/bid/23616"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/1479"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://www.waraxe.us/advisory-49.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34081"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-04-27 16:19
Modified
2024-11-21 00:30
Severity ?
Summary
Cross-site request forgery (CSRF) vulnerability in include/admin/banlist.php in Phorum before 5.1.22 allows remote attackers to perform unauthorized banlist deletions as an administrator via the delete parameter.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E6CCA297-E655-4134-BC6D-F190C4C228D6",
"versionEndIncluding": "5.1.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability in include/admin/banlist.php in Phorum before 5.1.22 allows remote attackers to perform unauthorized banlist deletions as an administrator via the delete parameter."
},
{
"lang": "es",
"value": "Vulnerabilidad de falsificaci\u00f3n de petici\u00f3n en sitios cruzados (CSRF) en include/admin/banlist.php en Phorum anterior a 5.1.22 permite a atacantes remotos realizar borrados de la banlist no autorizados como administrador a trav\u00e9s del par\u00e1metro delete.\r\n"
}
],
"id": "CVE-2007-2338",
"lastModified": "2024-11-21T00:30:32.553",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-04-27T16:19:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/35061"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/24932"
},
{
"source": "cve@mitre.org",
"url": "http://securityreason.com/securityalert/2617"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://securitytracker.com/id?1017936"
},
{
"source": "cve@mitre.org",
"url": "http://www.phorum.org/story.php?76"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/466286/100/0/threaded"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "http://www.securityfocus.com/bid/23616"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/1479"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://www.waraxe.us/advisory-49.html"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34078"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/35061"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/24932"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/2617"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://securitytracker.com/id?1017936"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phorum.org/story.php?76"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/466286/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "http://www.securityfocus.com/bid/23616"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/1479"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://www.waraxe.us/advisory-49.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34078"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-09-04 14:55
Modified
2024-11-21 01:42
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the group moderation screen in the control center (control.php) in Phorum before 5.2.19 allows remote attackers to inject arbitrary web script or HTML via the group parameter.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B7658DEE-525F-4A02-9577-4830FFE9CB1F",
"versionEndIncluding": "5.2.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A4C4E79D-EBE6-456C-A74F-B94F32736383",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D3596808-8399-4EA9-B885-5443CA91C3C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.10:*:*:*:*:*:*:*",
"matchCriteriaId": "90FC064F-B462-47F8-880F-CB26A340477E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.10:rc1:*:*:*:*:*:*",
"matchCriteriaId": "D083445E-48ED-4666-98A8-932B01A0F9B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.11:*:*:*:*:*:*:*",
"matchCriteriaId": "A79911F1-C1C3-4DD1-BA37-AFC77D7B0D90",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.12:*:*:*:*:*:*:*",
"matchCriteriaId": "2200E549-30F8-4803-A570-FBF08B97B7CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.12:a:*:*:*:*:*:*",
"matchCriteriaId": "A94B0DAF-C8AC-483F-A280-CCF4B6D17BF0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.13:*:*:*:*:*:*:*",
"matchCriteriaId": "D9876C40-4537-4622-90D5-175AB59609D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "51638139-DB4F-4B8C-B125-1FE9AFC86B21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.15:*:*:*:*:*:*:*",
"matchCriteriaId": "6362BDF1-A90C-40A8-A80C-024788426315",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.15:a:*:*:*:*:*:*",
"matchCriteriaId": "211355E8-5707-4873-AE47-26DFE6061725",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.16:*:*:*:*:*:*:*",
"matchCriteriaId": "61C297BC-DF74-42FD-957B-6130AEAA3A04",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the group moderation screen in the control center (control.php) in Phorum before 5.2.19 allows remote attackers to inject arbitrary web script or HTML via the group parameter."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en la pantalla de la moderaci\u00f3n de grupos en el centro de control (control.php) en Phorum anterior a 5.2.19 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s del par\u00e1metro group."
}
],
"id": "CVE-2012-4234",
"lastModified": "2024-11-21T01:42:29.850",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2014-09-04T14:55:09.600",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2012-08/0189.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://packetstormsecurity.org/files/116057/Phorum-5.2.18-Cross-Site-Scripting.html"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/50445"
},
{
"source": "cve@mitre.org",
"url": "http://www.phorum.org/phorum5/read.php?64%2C151943"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/55275"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78124"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "https://www.htbridge.com/advisory/HTB23109"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2012-08/0189.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://packetstormsecurity.org/files/116057/Phorum-5.2.18-Cross-Site-Scripting.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/50445"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phorum.org/phorum5/read.php?64%2C151943"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/55275"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78124"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "https://www.htbridge.com/advisory/HTB23109"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-11-28 21:55
Modified
2024-11-21 01:32
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in admin.php in Phorum 5.2.18 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to admin/index.php. NOTE: some of these details are obtained from third party information.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.18:*:*:*:*:*:*:*",
"matchCriteriaId": "02F08F6E-DDAB-40BD-9C60-80567C67F92D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in admin.php in Phorum 5.2.18 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to admin/index.php. NOTE: some of these details are obtained from third party information."
},
{
"lang": "es",
"value": "Una vulnerabilidad de ejecuci\u00f3n de comandos en sitios cruzados (XSS) en admin.php en Phorum v5.2.18 permite a atacantes remotos inyectar HTML o secuencias de comandos web a trav\u00e9s de la variable PATH_INFO para admin/index.php. NOTA: algunos de estos detalles han sido obtenidos de informaci\u00f3n de terceros."
}
],
"id": "CVE-2011-4561",
"lastModified": "2024-11-21T01:32:32.880",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2011-11-28T21:55:08.497",
"references": [
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/76026"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/46282"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.rul3z.de/advisories/SSCHADV2011-023.txt"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/519991/100/0/threaded"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/49920"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/76026"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/46282"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.rul3z.de/advisories/SSCHADV2011-023.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/519991/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/49920"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2002-12-31 05:00
Modified
2024-11-20 23:43
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in read.php in Phorum 3.3.2a allows remote attackers to inject arbitrary web script or HTML via (1) the t parameter or (2) the body of an email response.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.2a:*:*:*:*:*:*:*",
"matchCriteriaId": "A7F6BE0A-7E2F-457D-B4BA-6BAE1B44E7D3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in read.php in Phorum 3.3.2a allows remote attackers to inject arbitrary web script or HTML via (1) the t parameter or (2) the body of an email response."
}
],
"id": "CVE-2002-2340",
"lastModified": "2024-11-20T23:43:27.027",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2002-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=vuln-dev\u0026m=102121925428844\u0026w=2"
},
{
"source": "cve@mitre.org",
"url": "http://www.ifrance.com/kitetoua/tuto/5holes5.txt"
},
{
"source": "cve@mitre.org",
"url": "http://www.phorum.org/changelog.txt"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/4739"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=vuln-dev\u0026m=102121925428844\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.ifrance.com/kitetoua/tuto/5holes5.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phorum.org/changelog.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/4739"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2010-05-19 22:30
Modified
2024-11-21 01:14
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in Phorum before 5.2.15 allows remote attackers to inject arbitrary web script or HTML via an invalid email address.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5C90EF87-C07F-453B-880A-36F31CC9B9E4",
"versionEndIncluding": "5.2.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "740F974F-D679-472C-966A-3E4C334E3C0A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "32D7E47E-10F5-4F50-8940-951B2C0011CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16042FAE-7370-425C-8810-4F9363B7CAA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.1_pre:*:*:*:*:*:*:*",
"matchCriteriaId": "B4A25A6F-62CA-4C76-9D4C-821B1E15FB1B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.1_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "6247DB0C-37B6-44EF-8B92-8CFCDA537039",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.1a:*:*:*:*:*:*:*",
"matchCriteriaId": "4C46298C-2492-4102-A264-E2A1D45AD423",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1A2AD59F-42DF-407A-8FCA-E6E0067A2B3A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "17E1044B-2101-4719-8749-17DD22F46055",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B7E17261-A010-4929-99E5-A2511F205B72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A461E2EB-9964-44DE-9C25-562D239201F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.3a:*:*:*:*:*:*:*",
"matchCriteriaId": "9CB6A4EC-D351-4EF8-8C6A-294A47DDCCC7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.3b:*:*:*:*:*:*:*",
"matchCriteriaId": "2B10230A-7D72-418E-8A29-E9F20762C43A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "368C8142-836A-4FDB-9CD8-385FE06B9A62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1470761E-DA6E-4D2A-B226-1ED782FB3654",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "FEB3ED23-821D-42FA-A24F-F2EDDA43D7B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "88BA8736-5998-42E0-81E4-76E3669F8112",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "DC9811C9-EE92-4115-B81F-7A3030390BD1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "5A196AD2-7E48-40F4-923E-437FA76C97D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.1a:*:*:*:*:*:*:*",
"matchCriteriaId": "91D147F0-FF83-4FF4-AEF1-71366E874876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D87C46-D9EC-418B-9C8C-71E7149C72D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.2a:*:*:*:*:*:*:*",
"matchCriteriaId": "A7F6BE0A-7E2F-457D-B4BA-6BAE1B44E7D3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.2b3:*:*:*:*:*:*:*",
"matchCriteriaId": "C990B390-4768-41B0-BB8B-A56C2524623F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6650BE9D-5F4B-4B22-BD7E-ABCC067D5455",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1B8E0CA9-F6D4-4DD3-A3EA-F3A40965261B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7F67B233-3087-43E6-94F2-5DF39FAA36B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "7725AEF3-1C47-46B4-A35E-97152A84E731",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "F3F6C52C-F602-4C2A-8C8F-4A19DA41186F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "45F290E5-6508-4F62-8572-31B33750D341",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6D941B5F-B704-4596-8739-BFE34225DBA7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "FF13359B-162A-41DF-BB4F-DDD6CA2752F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "7D1AE057-A85C-49D9-981A-3314BD945D08",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.8a:*:*:*:*:*:*:*",
"matchCriteriaId": "EAC1F375-34EF-4FEC-B0F4-6A081B6A3B53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:4.3.7:*:*:*:*:*:*:*",
"matchCriteriaId": "1E532A66-A12D-48DD-B405-2345E5B715C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.0_alpha:*:*:*:*:*:*:*",
"matchCriteriaId": "26E2C5A7-8B52-4BDF-80F1-5D45AEBE6E25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.1_alpha:*:*:*:*:*:*:*",
"matchCriteriaId": "0E8DF602-0A22-45A9-A286-C237180701C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.2_alpha:*:*:*:*:*:*:*",
"matchCriteriaId": "AB109C36-BF0F-41E3-A1F4-0DB264BD4A55",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.3_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "9A31EA2D-2B01-4928-9B3E-9D666FD2758B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.4_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "E87DE16C-7C68-4DA8-9BD9-C61D74E61D6E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.4a_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "5001527E-FE93-4BE7-BF79-7717D64CAF2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.5_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "D15ED599-6B84-4E03-8BA4-36E1D55F1F75",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.6_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "D491A2B9-949A-4A56-A41F-23A222C03BA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.7_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "01CFDB0B-6FBD-49F3-8238-81E92661297E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.7a_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "EC73A23F-2399-41B0-B6BD-289DF63F2C6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.8_rc:*:*:*:*:*:*:*",
"matchCriteriaId": "AD59DD99-1FC7-498B-9EA1-1AA8FE132EEE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "1655572D-7D56-4D9D-9E0F-A67DF23FC934",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "387E0B83-B240-4922-8C57-CE0CDB000888",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "CF5B09FF-92DF-4F8D-9A7B-E5086E2B954D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "D02321D7-2F3E-40F9-9A76-CFF339C93199",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "3B908D49-F64A-488F-95F3-163AB9DAB02D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.13a:*:*:*:*:*:*:*",
"matchCriteriaId": "1A26F8E5-0FFE-473D-BDA1-2D5340B5A4A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.14:*:*:*:*:*:*:*",
"matchCriteriaId": "0FF0655C-7C83-4363-A444-993B35D7A7EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.14a:*:*:*:*:*:*:*",
"matchCriteriaId": "B3D0F7C4-902D-4186-8EFF-3876D6D6633E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.15:*:*:*:*:*:*:*",
"matchCriteriaId": "6F87C476-6A55-4B19-97B0-24204E96A63E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.15a:*:*:*:*:*:*:*",
"matchCriteriaId": "83F8F544-1B09-4B22-B1F3-2CD1E8D7AECD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.16:*:*:*:*:*:*:*",
"matchCriteriaId": "8ACC6DD4-384B-44DE-9BC7-6F1DD374E6B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.17:*:*:*:*:*:*:*",
"matchCriteriaId": "17D0AC3E-97F7-4A13-8E65-7E424D055E38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.17a:*:*:*:*:*:*:*",
"matchCriteriaId": "D184385A-763A-4971-8051-20564D020787",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.18:*:*:*:*:*:*:*",
"matchCriteriaId": "04B508F8-CFCC-4841-BF70-1ABB28EB1ABC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.19:*:*:*:*:*:*:*",
"matchCriteriaId": "C365D62D-ACB1-44D3-935D-F79A79642684",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.20:*:*:*:*:*:*:*",
"matchCriteriaId": "F4B45305-FF8B-42F8-A726-F8604BADC323",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.13:*:*:*:*:*:*:*",
"matchCriteriaId": "70F4AB87-2D63-4208-8982-BBF978392285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.14:*:*:*:*:*:*:*",
"matchCriteriaId": "149A6B5A-84FC-4B6F-B053-0AC881BC03D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.17:*:*:*:*:*:*:*",
"matchCriteriaId": "375346D4-CEA4-4BAE-83DF-639E86C3DECC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.18:*:*:*:*:*:*:*",
"matchCriteriaId": "3C6E0429-3241-47B0-B853-66D3167CE4F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.20:*:*:*:*:*:*:*",
"matchCriteriaId": "121F0F96-F901-479F-A64F-3DAE1AC0AFAF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.21:*:*:*:*:*:*:*",
"matchCriteriaId": "F837829B-28E5-41B3-9A23-C4D4A7FE636A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.25:*:*:*:*:*:*:*",
"matchCriteriaId": "700B9165-B956-4CAB-B980-42885FFA418F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A4C4E79D-EBE6-456C-A74F-B94F32736383",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D3596808-8399-4EA9-B885-5443CA91C3C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.2:beta:*:*:*:*:*:*",
"matchCriteriaId": "B5409C8A-8B57-48FB-B01E-411C00153E9B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "74DB422C-E79C-46B2-BB52-8C457822A0BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.4:rc2:*:*:*:*:*:*",
"matchCriteriaId": "37881B2C-0CD0-4E2A-A11D-9758772640E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "66BE61C7-E1DD-4DA9-B433-0C698C482C57",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "FB5E063A-F59F-4CEB-9950-2FE8D25FF9FF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.9:*:*:*:*:*:*:*",
"matchCriteriaId": "F0A35F3F-6BBF-4B84-AE19-870F03C1E9DC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.10:*:*:*:*:*:*:*",
"matchCriteriaId": "90FC064F-B462-47F8-880F-CB26A340477E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.10:rc1:*:*:*:*:*:*",
"matchCriteriaId": "D083445E-48ED-4666-98A8-932B01A0F9B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.11:*:*:*:*:*:*:*",
"matchCriteriaId": "A79911F1-C1C3-4DD1-BA37-AFC77D7B0D90",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.12:*:*:*:*:*:*:*",
"matchCriteriaId": "2200E549-30F8-4803-A570-FBF08B97B7CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.12a:*:*:*:*:*:*:*",
"matchCriteriaId": "2798D56A-BEBC-4EC0-ACA3-D0B9E8E4D61D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.13:*:*:*:*:*:*:*",
"matchCriteriaId": "D9876C40-4537-4622-90D5-175AB59609D4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Phorum before 5.2.15 allows remote attackers to inject arbitrary web script or HTML via an invalid email address."
},
{
"lang": "es",
"value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en versiones de Phorum anteriores a la v5.2.15, permite a atacantes remotos inyectar c\u00f3digo web o HTML de su elecci\u00f3n a trav\u00e9s de una direcci\u00f3n de correo inv\u00e1lida."
}
],
"id": "CVE-2010-1629",
"lastModified": "2024-11-21T01:14:50.707",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2010-05-19T22:30:01.020",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://osvdb.org/64759"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch"
],
"url": "http://www.facebook.com/note.php?note_id=371190874581"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2010/05/16/2"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2010/05/18/11"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/64759"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.facebook.com/note.php?note_id=371190874581"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2010/05/16/2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2010/05/18/11"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2003-12-31 05:00
Modified
2024-11-20 23:47
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in (1) login.php, (2) register.php, (3) post.php, and (4) common.php in Phorum before 3.4.3 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "155AD4FB-E527-4103-BCEF-801B653DEA37",
"vulnerable": false
},
{
"criteria": "cpe:2.3:o:microsoft:all_windows:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3AB4B29F-4C60-48A0-8F58-BCBDC58B697E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:o:unix:unix:any_version:*:*:*:*:*:*:*",
"matchCriteriaId": "CF8C2159-A91B-4599-BDDA-AEC890150B00",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:*:*:*:*:*:*:*:*",
"matchCriteriaId": "EF010968-6E3B-430A-BF06-9F63EEA3EC03",
"versionEndIncluding": "3.4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6650BE9D-5F4B-4B22-BD7E-ABCC067D5455",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1B8E0CA9-F6D4-4DD3-A3EA-F3A40965261B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in (1) login.php, (2) register.php, (3) post.php, and (4) common.php in Phorum before 3.4.3 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors."
}
],
"id": "CVE-2003-1467",
"lastModified": "2024-11-20T23:47:13.717",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2003-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://securityreason.com/securityalert/3288"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/321310"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/7572"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/7573"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/7576"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/7577"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/7584"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/12487"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/12502"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/3288"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/321310"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/7572"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/7573"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/7576"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/7577"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/7584"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/12487"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/12502"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-01-22 20:15
Modified
2024-11-21 01:30
Severity ?
Summary
A Cross-Site Scripting (XSS) vulnerability exists in the admin login screen in Phorum before 5.2.18.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4777669E-4561-4BF5-858D-26417715EB8B",
"versionEndExcluding": "5.2.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A Cross-Site Scripting (XSS) vulnerability exists in the admin login screen in Phorum before 5.2.18."
},
{
"lang": "es",
"value": "Se presenta una vulnerabilidad de Cross-Site Scripting (XSS) en la pantalla de inicio de sesi\u00f3n del administrador en Phorum versiones anteriores a 5.2.18."
}
],
"id": "CVE-2011-3622",
"lastModified": "2024-11-21T01:30:52.113",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-01-22T20:15:11.033",
"references": [
{
"source": "secalert@redhat.com",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://www.openwall.com/lists/oss-security/2011/10/18/9"
},
{
"source": "secalert@redhat.com",
"url": "https://www.phorum.org/phorum5/read.php?64%2C149588"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "https://www.openwall.com/lists/oss-security/2011/10/18/9"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.phorum.org/phorum5/read.php?64%2C149588"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2004-01-20 05:00
Modified
2024-11-20 23:47
Severity ?
Summary
SQL injection vulnerability in register.php for Phorum 3.4.5 and earlier allows remote attackers to execute arbitrary SQL commands via the hide_email parameter.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1628D391-59B4-4D58-8409-5D099D45E8B4",
"versionEndIncluding": "3.4.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in register.php for Phorum 3.4.5 and earlier allows remote attackers to execute arbitrary SQL commands via the hide_email parameter."
},
{
"lang": "es",
"value": "Vulnerabilidad de inyecci\u00f3n de SQL en register.php de Phorum 3.4.5 y anteriores permite a atacantes remotos ejecutar comandos SLQ arbitrarios mediante el par\u00e1metro hide_email."
}
],
"id": "CVE-2004-0035",
"lastModified": "2024-11-20T23:47:36.777",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2004-01-20T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=107340481804110\u0026w=2"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/10567"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/3508"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/9363"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/14146"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=107340481804110\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/10567"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/3508"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/9363"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/14146"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-09-08 18:55
Modified
2024-11-21 01:30
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in Phorum before 5.2.16 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:*:*:*:*:*:*:*:*",
"matchCriteriaId": "38B3FD6E-D73A-4018-B4D5-158C0B288B1B",
"versionEndIncluding": "5.2.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "740F974F-D679-472C-966A-3E4C334E3C0A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "32D7E47E-10F5-4F50-8940-951B2C0011CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16042FAE-7370-425C-8810-4F9363B7CAA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.1_pre:*:*:*:*:*:*:*",
"matchCriteriaId": "B4A25A6F-62CA-4C76-9D4C-821B1E15FB1B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.1_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "6247DB0C-37B6-44EF-8B92-8CFCDA537039",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.1a:*:*:*:*:*:*:*",
"matchCriteriaId": "4C46298C-2492-4102-A264-E2A1D45AD423",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1A2AD59F-42DF-407A-8FCA-E6E0067A2B3A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "17E1044B-2101-4719-8749-17DD22F46055",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B7E17261-A010-4929-99E5-A2511F205B72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A461E2EB-9964-44DE-9C25-562D239201F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.3a:*:*:*:*:*:*:*",
"matchCriteriaId": "9CB6A4EC-D351-4EF8-8C6A-294A47DDCCC7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.3b:*:*:*:*:*:*:*",
"matchCriteriaId": "2B10230A-7D72-418E-8A29-E9F20762C43A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "368C8142-836A-4FDB-9CD8-385FE06B9A62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1470761E-DA6E-4D2A-B226-1ED782FB3654",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "FEB3ED23-821D-42FA-A24F-F2EDDA43D7B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "88BA8736-5998-42E0-81E4-76E3669F8112",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "DC9811C9-EE92-4115-B81F-7A3030390BD1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "5A196AD2-7E48-40F4-923E-437FA76C97D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.1a:*:*:*:*:*:*:*",
"matchCriteriaId": "91D147F0-FF83-4FF4-AEF1-71366E874876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D87C46-D9EC-418B-9C8C-71E7149C72D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.2a:*:*:*:*:*:*:*",
"matchCriteriaId": "A7F6BE0A-7E2F-457D-B4BA-6BAE1B44E7D3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.2b3:*:*:*:*:*:*:*",
"matchCriteriaId": "C990B390-4768-41B0-BB8B-A56C2524623F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6650BE9D-5F4B-4B22-BD7E-ABCC067D5455",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1B8E0CA9-F6D4-4DD3-A3EA-F3A40965261B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7F67B233-3087-43E6-94F2-5DF39FAA36B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "7725AEF3-1C47-46B4-A35E-97152A84E731",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "F3F6C52C-F602-4C2A-8C8F-4A19DA41186F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "45F290E5-6508-4F62-8572-31B33750D341",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6D941B5F-B704-4596-8739-BFE34225DBA7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "FF13359B-162A-41DF-BB4F-DDD6CA2752F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "7D1AE057-A85C-49D9-981A-3314BD945D08",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.8a:*:*:*:*:*:*:*",
"matchCriteriaId": "EAC1F375-34EF-4FEC-B0F4-6A081B6A3B53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:4.3.7:*:*:*:*:*:*:*",
"matchCriteriaId": "1E532A66-A12D-48DD-B405-2345E5B715C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.0_alpha:*:*:*:*:*:*:*",
"matchCriteriaId": "26E2C5A7-8B52-4BDF-80F1-5D45AEBE6E25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.1_alpha:*:*:*:*:*:*:*",
"matchCriteriaId": "0E8DF602-0A22-45A9-A286-C237180701C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.2_alpha:*:*:*:*:*:*:*",
"matchCriteriaId": "AB109C36-BF0F-41E3-A1F4-0DB264BD4A55",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.3_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "9A31EA2D-2B01-4928-9B3E-9D666FD2758B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.4_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "E87DE16C-7C68-4DA8-9BD9-C61D74E61D6E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.4a_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "5001527E-FE93-4BE7-BF79-7717D64CAF2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.5_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "D15ED599-6B84-4E03-8BA4-36E1D55F1F75",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.6_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "D491A2B9-949A-4A56-A41F-23A222C03BA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.7_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "01CFDB0B-6FBD-49F3-8238-81E92661297E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.7a_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "EC73A23F-2399-41B0-B6BD-289DF63F2C6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.8_rc:*:*:*:*:*:*:*",
"matchCriteriaId": "AD59DD99-1FC7-498B-9EA1-1AA8FE132EEE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "1655572D-7D56-4D9D-9E0F-A67DF23FC934",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "387E0B83-B240-4922-8C57-CE0CDB000888",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "CF5B09FF-92DF-4F8D-9A7B-E5086E2B954D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "D02321D7-2F3E-40F9-9A76-CFF339C93199",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "3B908D49-F64A-488F-95F3-163AB9DAB02D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.13a:*:*:*:*:*:*:*",
"matchCriteriaId": "1A26F8E5-0FFE-473D-BDA1-2D5340B5A4A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.14:*:*:*:*:*:*:*",
"matchCriteriaId": "0FF0655C-7C83-4363-A444-993B35D7A7EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.14a:*:*:*:*:*:*:*",
"matchCriteriaId": "B3D0F7C4-902D-4186-8EFF-3876D6D6633E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.15:*:*:*:*:*:*:*",
"matchCriteriaId": "6F87C476-6A55-4B19-97B0-24204E96A63E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.15a:*:*:*:*:*:*:*",
"matchCriteriaId": "83F8F544-1B09-4B22-B1F3-2CD1E8D7AECD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.16:*:*:*:*:*:*:*",
"matchCriteriaId": "8ACC6DD4-384B-44DE-9BC7-6F1DD374E6B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.17:*:*:*:*:*:*:*",
"matchCriteriaId": "17D0AC3E-97F7-4A13-8E65-7E424D055E38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.17a:*:*:*:*:*:*:*",
"matchCriteriaId": "D184385A-763A-4971-8051-20564D020787",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.18:*:*:*:*:*:*:*",
"matchCriteriaId": "04B508F8-CFCC-4841-BF70-1ABB28EB1ABC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.19:*:*:*:*:*:*:*",
"matchCriteriaId": "C365D62D-ACB1-44D3-935D-F79A79642684",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.20:*:*:*:*:*:*:*",
"matchCriteriaId": "F4B45305-FF8B-42F8-A726-F8604BADC323",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.13:*:*:*:*:*:*:*",
"matchCriteriaId": "70F4AB87-2D63-4208-8982-BBF978392285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.14:*:*:*:*:*:*:*",
"matchCriteriaId": "149A6B5A-84FC-4B6F-B053-0AC881BC03D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.17:*:*:*:*:*:*:*",
"matchCriteriaId": "375346D4-CEA4-4BAE-83DF-639E86C3DECC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.18:*:*:*:*:*:*:*",
"matchCriteriaId": "3C6E0429-3241-47B0-B853-66D3167CE4F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.20:*:*:*:*:*:*:*",
"matchCriteriaId": "121F0F96-F901-479F-A64F-3DAE1AC0AFAF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.21:*:*:*:*:*:*:*",
"matchCriteriaId": "F837829B-28E5-41B3-9A23-C4D4A7FE636A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.25:*:*:*:*:*:*:*",
"matchCriteriaId": "700B9165-B956-4CAB-B980-42885FFA418F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A4C4E79D-EBE6-456C-A74F-B94F32736383",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D3596808-8399-4EA9-B885-5443CA91C3C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.2:beta:*:*:*:*:*:*",
"matchCriteriaId": "B5409C8A-8B57-48FB-B01E-411C00153E9B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "74DB422C-E79C-46B2-BB52-8C457822A0BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.4:rc2:*:*:*:*:*:*",
"matchCriteriaId": "37881B2C-0CD0-4E2A-A11D-9758772640E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "66BE61C7-E1DD-4DA9-B433-0C698C482C57",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "FB5E063A-F59F-4CEB-9950-2FE8D25FF9FF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.9:*:*:*:*:*:*:*",
"matchCriteriaId": "F0A35F3F-6BBF-4B84-AE19-870F03C1E9DC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.10:*:*:*:*:*:*:*",
"matchCriteriaId": "90FC064F-B462-47F8-880F-CB26A340477E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.10:rc1:*:*:*:*:*:*",
"matchCriteriaId": "D083445E-48ED-4666-98A8-932B01A0F9B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.11:*:*:*:*:*:*:*",
"matchCriteriaId": "A79911F1-C1C3-4DD1-BA37-AFC77D7B0D90",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.12:*:*:*:*:*:*:*",
"matchCriteriaId": "2200E549-30F8-4803-A570-FBF08B97B7CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.12a:*:*:*:*:*:*:*",
"matchCriteriaId": "2798D56A-BEBC-4EC0-ACA3-D0B9E8E4D61D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.13:*:*:*:*:*:*:*",
"matchCriteriaId": "D9876C40-4537-4622-90D5-175AB59609D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "51638139-DB4F-4B8C-B125-1FE9AFC86B21",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Phorum before 5.2.16 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
},
{
"lang": "es",
"value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en Phorum antes de v5.2.16, permite a atacantes remotos inyectar secuencias de comandos web o HTML a trav\u00e9s de vectores no especificados."
}
],
"id": "CVE-2011-3382",
"lastModified": "2024-11-21T01:30:24.463",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2011-09-08T18:55:01.723",
"references": [
{
"source": "vultures@jpcert.or.jp",
"url": "http://jvn.jp/en/jp/JVN71435255/index.html"
},
{
"source": "vultures@jpcert.or.jp",
"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2011-000068"
},
{
"source": "vultures@jpcert.or.jp",
"url": "http://www.phorum.org/phorum5/read.php?64%2C147504"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://jvn.jp/en/jp/JVN71435255/index.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2011-000068"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phorum.org/phorum5/read.php?64%2C147504"
}
],
"sourceIdentifier": "vultures@jpcert.or.jp",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-04-25 16:19
Modified
2024-11-21 00:30
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in admin.php in Phorum before 5.1.22 allow remote attackers to inject arbitrary web script or HTML via the (1) group_id parameter in the groups module or (2) the smiley_id parameter in the smileys modsettings module.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:*:*:*:*:*:*:*:*",
"matchCriteriaId": "195CE92F-6EC7-4E93-8C05-24AFC740253F",
"versionEndIncluding": "5.1.21",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in admin.php in Phorum before 5.1.22 allow remote attackers to inject arbitrary web script or HTML via the (1) group_id parameter in the groups module or (2) the smiley_id parameter in the smileys modsettings module."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en admin.php de Phorum anterior a 5.1.22 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n mediante el (1) par\u00e1metro group_id en el m\u00f3dulo groups o el (2) par\u00e1metro smiley_id en el m\u00f3dulo smileys modsettings."
}
],
"evaluatorSolution": "This vulnerability is addressed in the following product release:\r\nPhorum, Phorum, 5.1.22",
"id": "CVE-2007-2248",
"lastModified": "2024-11-21T00:30:17.930",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2007-04-25T16:19:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/35057"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/35058"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/24932"
},
{
"source": "cve@mitre.org",
"url": "http://securityreason.com/securityalert/2617"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.phorum.org/story.php?76"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/466286/100/0/threaded"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "http://www.securityfocus.com/bid/23616"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://www.securitytracker.com/id?1017936"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://www.waraxe.us/advisory-49.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/35057"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/35058"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/24932"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/2617"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.phorum.org/story.php?76"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/466286/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "http://www.securityfocus.com/bid/23616"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://www.securitytracker.com/id?1017936"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://www.waraxe.us/advisory-49.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2003-12-31 05:00
Modified
2024-11-20 23:47
Severity ?
Summary
Directory traversal vulnerability in download.php in Phorum 3.4 through 3.4.2 allows remote attackers to read arbitrary files.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6650BE9D-5F4B-4B22-BD7E-ABCC067D5455",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1B8E0CA9-F6D4-4DD3-A3EA-F3A40965261B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7F67B233-3087-43E6-94F2-5DF39FAA36B7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in download.php in Phorum 3.4 through 3.4.2 allows remote attackers to read arbitrary files."
}
],
"id": "CVE-2003-1465",
"lastModified": "2024-11-20T23:47:13.450",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2003-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://securityreason.com/securityalert/3288"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/archive/1/321310"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "http://www.securityfocus.com/bid/7569"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/12482"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/3288"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/archive/1/321310"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "http://www.securityfocus.com/bid/7569"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/12482"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2004-12-31 05:00
Modified
2024-11-20 23:52
Severity ?
Summary
Phorum allows remote attackers to hijack sessions of other users by stealing and replaying the session hash in the phorum_uriauth parameter, as demonstrated using profile.php. NOTE: the affected version was reported to be 4.3.7, but this may be erroneous.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:4.3.7:*:*:*:*:*:*:*",
"matchCriteriaId": "1E532A66-A12D-48DD-B405-2345E5B715C9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Phorum allows remote attackers to hijack sessions of other users by stealing and replaying the session hash in the phorum_uriauth parameter, as demonstrated using profile.php. NOTE: the affected version was reported to be 4.3.7, but this may be erroneous."
}
],
"id": "CVE-2004-2243",
"lastModified": "2024-11-20T23:52:51.497",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2004-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2004-05/0999.html"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1010219"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16215"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2004-05/0999.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1010219"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16215"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2002-08-12 04:00
Modified
2024-11-20 23:39
Severity ?
Summary
Phorum 3.3.2a allows remote attackers to execute arbitrary commands via an HTTP request to (1) plugin.php, (2) admin.php, or (3) del.php that modifies the PHORUM[settings_dir] variable to point to a directory that contains a PHP file with the commands.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://archives.neohapsis.com/archives/bugtraq/2002-05/0147.html | ||
| cve@mitre.org | http://archives.neohapsis.com/archives/bugtraq/2002-05/0153.html | Vendor Advisory | |
| cve@mitre.org | http://www.iss.net/security_center/static/9107.php | Patch, Vendor Advisory | |
| cve@mitre.org | http://www.phorum.org/ | Vendor Advisory | |
| cve@mitre.org | http://www.securityfocus.com/bid/4763 | Exploit, Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://archives.neohapsis.com/archives/bugtraq/2002-05/0147.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://archives.neohapsis.com/archives/bugtraq/2002-05/0153.html | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.iss.net/security_center/static/9107.php | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.phorum.org/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/4763 | Exploit, Patch, Vendor Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.2a:*:*:*:*:*:*:*",
"matchCriteriaId": "A7F6BE0A-7E2F-457D-B4BA-6BAE1B44E7D3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Phorum 3.3.2a allows remote attackers to execute arbitrary commands via an HTTP request to (1) plugin.php, (2) admin.php, or (3) del.php that modifies the PHORUM[settings_dir] variable to point to a directory that contains a PHP file with the commands."
}
],
"id": "CVE-2002-0764",
"lastModified": "2024-11-20T23:39:48.980",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2002-08-12T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://archives.neohapsis.com/archives/bugtraq/2002-05/0147.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2002-05/0153.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.iss.net/security_center/static/9107.php"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phorum.org/"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/4763"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://archives.neohapsis.com/archives/bugtraq/2002-05/0147.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2002-05/0153.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.iss.net/security_center/static/9107.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.phorum.org/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/4763"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2008-10-09 18:00
Modified
2024-11-21 00:51
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in BBcode API module in Phorum 5.2.8 allows remote attackers to inject arbitrary web script or HTML via nested BBcode image tags.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "FB5E063A-F59F-4CEB-9950-2FE8D25FF9FF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in BBcode API module in Phorum 5.2.8 allows remote attackers to inject arbitrary web script or HTML via nested BBcode image tags."
},
{
"lang": "es",
"value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en el m\u00f3dulo BBcode API en Phorum v5.2.8 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n mediante una etiqueta \"image\" (imagen) en BBcode."
}
],
"id": "CVE-2008-4513",
"lastModified": "2024-11-21T00:51:51.730",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2008-10-09T18:00:02.143",
"references": [
{
"source": "cve@mitre.org",
"url": "http://nulledcore.com/?p=126"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/32225"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://trac.phorum.org/changeset/3528"
},
{
"source": "cve@mitre.org",
"url": "http://www.phorum.org/phorum5/read.php?64%2C133699"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/31589"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45686"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://nulledcore.com/?p=126"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/32225"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://trac.phorum.org/changeset/3528"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phorum.org/phorum5/read.php?64%2C133699"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/31589"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45686"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2004-12-31 05:00
Modified
2024-11-20 23:52
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in Phorum 5.0.11 and earlier allows remote attackers to inject arbitrary HTML or web script via search.php. NOTE: some sources have reported that the affected file is read.php, but this is inconsistent with the vendor's patch.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "CF5B09FF-92DF-4F8D-9A7B-E5086E2B954D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Phorum 5.0.11 and earlier allows remote attackers to inject arbitrary HTML or web script via search.php. NOTE: some sources have reported that the affected file is read.php, but this is inconsistent with the vendor\u0027s patch."
}
],
"id": "CVE-2004-2241",
"lastModified": "2024-11-20T23:52:51.193",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2004-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://phorum.org/cvs-changelog-5.txt"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/12980"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://securitytracker.com/id?1011921"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/11538"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17846"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phorum.org/cvs-changelog-5.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/12980"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://securitytracker.com/id?1011921"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/11538"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17846"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2000-12-31 05:00
Modified
2024-11-20 23:34
Severity ?
Summary
Directory traversal vulnerability in Phorum 3.0.7 allows remote Phorum administrators to read arbitrary files via ".." (dot dot) sequences in the default .langfile name field in the Master Settings administrative function, which causes the file to be displayed in admin.php3.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:3.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "740F974F-D679-472C-966A-3E4C334E3C0A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in Phorum 3.0.7 allows remote Phorum administrators to read arbitrary files via \"..\" (dot dot) sequences in the default .langfile name field in the Master Settings administrative function, which causes the file to be displayed in admin.php3."
}
],
"id": "CVE-2000-1229",
"lastModified": "2024-11-20T23:34:18.850",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2000-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html"
},
{
"source": "cve@mitre.org",
"url": "http://hispahack.ccc.de/mi020.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://hispahack.ccc.de/mi020.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2000-12-31 05:00
Modified
2024-11-20 23:34
Severity ?
Summary
Backdoor in auth.php3 in Phorum 3.0.7 allows remote attackers to access restricted web pages via an HTTP request with the PHP_AUTH_USER parameter set to "boogieman".
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:3.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "740F974F-D679-472C-966A-3E4C334E3C0A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Backdoor in auth.php3 in Phorum 3.0.7 allows remote attackers to access restricted web pages via an HTTP request with the PHP_AUTH_USER parameter set to \"boogieman\"."
}
],
"id": "CVE-2000-1230",
"lastModified": "2024-11-20T23:34:18.990",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2000-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html"
},
{
"source": "cve@mitre.org",
"url": "http://hispahack.ccc.de/mi020.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/2274"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://hispahack.ccc.de/mi020.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/2274"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2004-01-20 05:00
Modified
2024-11-20 23:47
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Phorum 3.4.5 and earlier allow remote attackers to inject arbitrary HTML or web script via (1) the phorum_check_xss function in common.php, (2) the EditError variable in profile.php, and (3) the Error variable in login.php.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1628D391-59B4-4D58-8409-5D099D45E8B4",
"versionEndIncluding": "3.4.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Phorum 3.4.5 and earlier allow remote attackers to inject arbitrary HTML or web script via (1) the phorum_check_xss function in common.php, (2) the EditError variable in profile.php, and (3) the Error variable in login.php."
},
{
"lang": "es",
"value": "M\u00faltiples vulneravilidades de secuencias de comandos en sitios cruzados (XSS) en Phorum 3.4.5 y anteriores pemite a atacantes inyectar c\u00f3digo HTML o script web arbitrario mediante la funci\u00f3n phorum_check_xss en common.php, la variable EditError en profile.php, y la variable Error en login.php."
}
],
"id": "CVE-2004-0034",
"lastModified": "2024-11-20T23:47:36.630",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2004-01-20T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=107340481804110\u0026w=2"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://phorum.org/"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/10567"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/3434"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/3506"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/3510"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/9361"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id?1008633"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/14145"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=107340481804110\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://phorum.org/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/10567"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/3434"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/3506"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/3510"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://www.securityfocus.com/bid/9361"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id?1008633"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/14145"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2003-12-31 05:00
Modified
2024-11-20 23:47
Severity ?
Summary
Multiple "command injection" vulnerabilities in Phorum 3.4 through 3.4.2 allow remote attackers to execute arbitrary commands and modify the Phorum configuration files via the (1) UserAdmin program, (2) Edit user profile, or (3) stats program.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6650BE9D-5F4B-4B22-BD7E-ABCC067D5455",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1B8E0CA9-F6D4-4DD3-A3EA-F3A40965261B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7F67B233-3087-43E6-94F2-5DF39FAA36B7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple \"command injection\" vulnerabilities in Phorum 3.4 through 3.4.2 allow remote attackers to execute arbitrary commands and modify the Phorum configuration files via the (1) UserAdmin program, (2) Edit user profile, or (3) stats program."
}
],
"id": "CVE-2003-1487",
"lastModified": "2024-11-20T23:47:16.447",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": true,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2003-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://securityreason.com/securityalert/3288"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/321310"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/7574"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/7578"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/7579"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/12500"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/3288"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/321310"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/7574"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/7578"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/7579"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/12500"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2000-12-31 05:00
Modified
2024-11-20 23:34
Severity ?
Summary
Phorum 3.0.7 allows remote attackers to change the administrator password without authentication via an HTTP request for admin.php3 that sets step, option, confirm and newPssword variables.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:3.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "740F974F-D679-472C-966A-3E4C334E3C0A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Phorum 3.0.7 allows remote attackers to change the administrator password without authentication via an HTTP request for admin.php3 that sets step, option, confirm and newPssword variables."
}
],
"id": "CVE-2000-1228",
"lastModified": "2024-11-20T23:34:18.670",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2000-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html"
},
{
"source": "cve@mitre.org",
"url": "http://hispahack.ccc.de/mi020.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "http://www.securityfocus.com/bid/2271"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://hispahack.ccc.de/mi020.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "http://www.securityfocus.com/bid/2271"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2002-06-25 04:00
Modified
2024-11-20 23:38
Severity ?
Summary
Phorum 3.3.2 allows remote attackers to determine the email addresses of the 10 most active users via a direct HTTP request to the stats.php program, which does not require authentication.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D87C46-D9EC-418B-9C8C-71E7149C72D4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Phorum 3.3.2 allows remote attackers to determine the email addresses of the 10 most active users via a direct HTTP request to the stats.php program, which does not require authentication."
}
],
"id": "CVE-2002-0352",
"lastModified": "2024-11-20T23:38:52.920",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2002-06-25T04:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=101508207206900\u0026w=2"
},
{
"source": "cve@mitre.org",
"url": "http://www.iss.net/security_center/static/8344.php"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/4226"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=101508207206900\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.iss.net/security_center/static/8344.php"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/4226"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-09-07 20:03
Modified
2024-11-21 00:00
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Phorum 5.0.17a and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the username parameter to register.php or (2) a signature of a logged-in user in "My Control Center," which is not properly handled by control.php.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://archives.neohapsis.com/archives/fulldisclosure/2005-09/0018.html | Exploit, Patch, Vendor Advisory | |
| cve@mitre.org | http://archives.neohapsis.com/archives/fulldisclosure/2005-09/0048.html | Vendor Advisory | |
| cve@mitre.org | http://secunia.com/advisories/16667 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://archives.neohapsis.com/archives/fulldisclosure/2005-09/0018.html | Exploit, Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://archives.neohapsis.com/archives/fulldisclosure/2005-09/0048.html | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/16667 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phorum | phorum | 3.1 | |
| phorum | phorum | 3.1.1 | |
| phorum | phorum | 3.1.1_pre | |
| phorum | phorum | 3.1.1_rc2 | |
| phorum | phorum | 3.1.1a | |
| phorum | phorum | 3.1.2 | |
| phorum | phorum | 3.2 | |
| phorum | phorum | 3.2.2 | |
| phorum | phorum | 3.2.3 | |
| phorum | phorum | 3.2.3a | |
| phorum | phorum | 3.2.3b | |
| phorum | phorum | 3.2.4 | |
| phorum | phorum | 3.2.5 | |
| phorum | phorum | 3.2.6 | |
| phorum | phorum | 3.2.7 | |
| phorum | phorum | 3.2.8 | |
| phorum | phorum | 3.3.1 | |
| phorum | phorum | 3.3.1a | |
| phorum | phorum | 3.3.2 | |
| phorum | phorum | 3.3.2a | |
| phorum | phorum | 3.3.2b3 | |
| phorum | phorum | 3.4 | |
| phorum | phorum | 3.4.1 | |
| phorum | phorum | 3.4.2 | |
| phorum | phorum | 3.4.3 | |
| phorum | phorum | 3.4.4 | |
| phorum | phorum | 3.4.5 | |
| phorum | phorum | 3.4.6 | |
| phorum | phorum | 3.4.7 | |
| phorum | phorum | 3.4.8 | |
| phorum | phorum | 4.3.7 | |
| phorum | phorum | 5.0.3_beta | |
| phorum | phorum | 5.0.7_beta | |
| phorum | phorum | 5.0.9 | |
| phorum | phorum | 5.0.10 | |
| phorum | phorum | 5.0.11 | |
| phorum | phorum | 5.0.12 | |
| phorum | phorum | 5.0.14 | |
| phorum | phorum | 5.0.14a | |
| phorum | phorum | 5.0.15 | |
| phorum | phorum | 5.0.16 | |
| phorum | phorum | 5.0.17 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "32D7E47E-10F5-4F50-8940-951B2C0011CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16042FAE-7370-425C-8810-4F9363B7CAA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.1_pre:*:*:*:*:*:*:*",
"matchCriteriaId": "B4A25A6F-62CA-4C76-9D4C-821B1E15FB1B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.1_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "6247DB0C-37B6-44EF-8B92-8CFCDA537039",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.1a:*:*:*:*:*:*:*",
"matchCriteriaId": "4C46298C-2492-4102-A264-E2A1D45AD423",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1A2AD59F-42DF-407A-8FCA-E6E0067A2B3A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "17E1044B-2101-4719-8749-17DD22F46055",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B7E17261-A010-4929-99E5-A2511F205B72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A461E2EB-9964-44DE-9C25-562D239201F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.3a:*:*:*:*:*:*:*",
"matchCriteriaId": "9CB6A4EC-D351-4EF8-8C6A-294A47DDCCC7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.3b:*:*:*:*:*:*:*",
"matchCriteriaId": "2B10230A-7D72-418E-8A29-E9F20762C43A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "368C8142-836A-4FDB-9CD8-385FE06B9A62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1470761E-DA6E-4D2A-B226-1ED782FB3654",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "FEB3ED23-821D-42FA-A24F-F2EDDA43D7B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "88BA8736-5998-42E0-81E4-76E3669F8112",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "DC9811C9-EE92-4115-B81F-7A3030390BD1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "5A196AD2-7E48-40F4-923E-437FA76C97D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.1a:*:*:*:*:*:*:*",
"matchCriteriaId": "91D147F0-FF83-4FF4-AEF1-71366E874876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D87C46-D9EC-418B-9C8C-71E7149C72D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.2a:*:*:*:*:*:*:*",
"matchCriteriaId": "A7F6BE0A-7E2F-457D-B4BA-6BAE1B44E7D3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.2b3:*:*:*:*:*:*:*",
"matchCriteriaId": "C990B390-4768-41B0-BB8B-A56C2524623F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6650BE9D-5F4B-4B22-BD7E-ABCC067D5455",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1B8E0CA9-F6D4-4DD3-A3EA-F3A40965261B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7F67B233-3087-43E6-94F2-5DF39FAA36B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "7725AEF3-1C47-46B4-A35E-97152A84E731",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "F3F6C52C-F602-4C2A-8C8F-4A19DA41186F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "45F290E5-6508-4F62-8572-31B33750D341",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6D941B5F-B704-4596-8739-BFE34225DBA7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "FF13359B-162A-41DF-BB4F-DDD6CA2752F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "7D1AE057-A85C-49D9-981A-3314BD945D08",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:4.3.7:*:*:*:*:*:*:*",
"matchCriteriaId": "1E532A66-A12D-48DD-B405-2345E5B715C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.3_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "9A31EA2D-2B01-4928-9B3E-9D666FD2758B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.7_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "01CFDB0B-6FBD-49F3-8238-81E92661297E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "1655572D-7D56-4D9D-9E0F-A67DF23FC934",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "387E0B83-B240-4922-8C57-CE0CDB000888",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "CF5B09FF-92DF-4F8D-9A7B-E5086E2B954D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "D02321D7-2F3E-40F9-9A76-CFF339C93199",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.14:*:*:*:*:*:*:*",
"matchCriteriaId": "0FF0655C-7C83-4363-A444-993B35D7A7EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.14a:*:*:*:*:*:*:*",
"matchCriteriaId": "B3D0F7C4-902D-4186-8EFF-3876D6D6633E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.15:*:*:*:*:*:*:*",
"matchCriteriaId": "6F87C476-6A55-4B19-97B0-24204E96A63E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.16:*:*:*:*:*:*:*",
"matchCriteriaId": "8ACC6DD4-384B-44DE-9BC7-6F1DD374E6B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.17:*:*:*:*:*:*:*",
"matchCriteriaId": "17D0AC3E-97F7-4A13-8E65-7E424D055E38",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Phorum 5.0.17a and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the username parameter to register.php or (2) a signature of a logged-in user in \"My Control Center,\" which is not properly handled by control.php."
}
],
"id": "CVE-2005-2836",
"lastModified": "2024-11-21T00:00:31.477",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-09-07T20:03:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2005-09/0018.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2005-09/0048.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/16667"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2005-09/0018.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2005-09/0048.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/16667"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-07-18 15:46
Modified
2024-11-21 00:14
Severity ?
Summary
Multiple PHP remote file inclusion vulnerabilities in Phorum 5.1.14, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via unspecified vectors related to an uninitialized variable.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.14:*:*:*:*:*:*:*",
"matchCriteriaId": "149A6B5A-84FC-4B6F-B053-0AC881BC03D0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple PHP remote file inclusion vulnerabilities in Phorum 5.1.14, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via unspecified vectors related to an uninitialized variable."
},
{
"lang": "es",
"value": "M\u00faltiples vulnerabilidades de inclusi\u00f3n remota de archivo en PHP en Phorum 5.1.14, cuando register_globals est\u00e1 activado, permite a atacantes remotos ejecutar c\u00f3digo PHP de su elecci\u00f3n a trav\u00e9s de vectores no especificados relacionados con una variables no inicializada."
}
],
"id": "CVE-2006-3615",
"lastModified": "2024-11-21T00:14:02.060",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 4.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-07-18T15:46:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://archives.neohapsis.com/archives/bugtraq/2006-07/0191.html"
},
{
"source": "cve@mitre.org",
"url": "http://archives.neohapsis.com/archives/bugtraq/2006-07/0200.html"
},
{
"source": "cve@mitre.org",
"url": "http://retrogod.altervista.org/phorum5_local_incl_xpl.html"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/21043"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/27164"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/27167"
},
{
"source": "cve@mitre.org",
"url": "http://www.phorum.org/phorum5/read.php?14%2C114358"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2006/2794"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://archives.neohapsis.com/archives/bugtraq/2006-07/0191.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://archives.neohapsis.com/archives/bugtraq/2006-07/0200.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://retrogod.altervista.org/phorum5_local_incl_xpl.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/21043"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/27164"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/27167"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phorum.org/phorum5/read.php?14%2C114358"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2006/2794"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-02-06 02:28
Modified
2024-11-21 00:26
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in register.php in Phorum 5.1.18 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: the vendor disputes this vulnerability, stating that "The characters are escaped properly.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.18:*:*:*:*:*:*:*",
"matchCriteriaId": "3C6E0429-3241-47B0-B853-66D3167CE4F6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [
{
"sourceIdentifier": "cve@mitre.org",
"tags": [
"disputed"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in register.php in Phorum 5.1.18 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: the vendor disputes this vulnerability, stating that \"The characters are escaped properly."
},
{
"lang": "es",
"value": "** IMPUGNADA ** Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en register.php de Phorum 5.1.18 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s de vectores no especificados. NOTA: el fabricante niega esta vulnerabilidad, afirmando que \"Los caracteres son escapados adecuadamente.\""
}
],
"id": "CVE-2007-0769",
"lastModified": "2024-11-21T00:26:42.133",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-02-06T02:28:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://www.phorum.org/phorum5/read.php?12%2C119757"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/458461/100/0/threaded"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/458467/100/0/threaded"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/22297"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/0410"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phorum.org/phorum5/read.php?12%2C119757"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/458461/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/458467/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/22297"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/0410"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-04-25 16:19
Modified
2024-11-21 00:30
Severity ?
Summary
include/controlcenter/users.php in Phorum before 5.1.22 allows remote authenticated moderators to gain privileges via a modified (1) user_ids POST parameter or (2) userdata array.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E6CCA297-E655-4134-BC6D-F190C4C228D6",
"versionEndIncluding": "5.1.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "include/controlcenter/users.php in Phorum before 5.1.22 allows remote authenticated moderators to gain privileges via a modified (1) user_ids POST parameter or (2) userdata array."
},
{
"lang": "es",
"value": "include/controlcenter/users.php de Phorum anterior a 5.1.22 permite a moderadores autenticados remotamente obtener privilegios mediante (1) un par\u00e1metro user_ids o (1) un array userdata modificados."
}
],
"id": "CVE-2007-2249",
"lastModified": "2024-11-21T00:30:18.090",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-04-25T16:19:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/35059"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/24932"
},
{
"source": "cve@mitre.org",
"url": "http://securityreason.com/securityalert/2617"
},
{
"source": "cve@mitre.org",
"url": "http://www.phorum.org/story.php?76"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/466286/100/0/threaded"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "http://www.securityfocus.com/bid/23616"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id?1017936"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/1479"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://www.waraxe.us/advisory-49.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/35059"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/24932"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/2617"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phorum.org/story.php?76"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/466286/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "http://www.securityfocus.com/bid/23616"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id?1017936"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/1479"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://www.waraxe.us/advisory-49.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2005-11-16 07:42
Modified
2024-11-21 00:02
Severity ?
Summary
SQL injection vulnerability in search.php in Phorum 5.0.0alpha through 5.0.20, when register_globals is enabled, allows remote attackers to execute arbitrary SQL commands via the forum_ids parameter.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| phorum | phorum | 5.0.0_alpha | |
| phorum | phorum | 5.0.1_alpha | |
| phorum | phorum | 5.0.2_alpha | |
| phorum | phorum | 5.0.3_beta | |
| phorum | phorum | 5.0.4_beta | |
| phorum | phorum | 5.0.4a_beta | |
| phorum | phorum | 5.0.5_beta | |
| phorum | phorum | 5.0.6_beta | |
| phorum | phorum | 5.0.7_beta | |
| phorum | phorum | 5.0.7a_beta | |
| phorum | phorum | 5.0.8_rc | |
| phorum | phorum | 5.0.9 | |
| phorum | phorum | 5.0.10 | |
| phorum | phorum | 5.0.11 | |
| phorum | phorum | 5.0.12 | |
| phorum | phorum | 5.0.13 | |
| phorum | phorum | 5.0.13a | |
| phorum | phorum | 5.0.14 | |
| phorum | phorum | 5.0.14a | |
| phorum | phorum | 5.0.15 | |
| phorum | phorum | 5.0.16 | |
| phorum | phorum | 5.0.17 | |
| phorum | phorum | 5.0.18 | |
| phorum | phorum | 5.0.19 | |
| phorum | phorum | 5.0.20 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.0_alpha:*:*:*:*:*:*:*",
"matchCriteriaId": "26E2C5A7-8B52-4BDF-80F1-5D45AEBE6E25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.1_alpha:*:*:*:*:*:*:*",
"matchCriteriaId": "0E8DF602-0A22-45A9-A286-C237180701C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.2_alpha:*:*:*:*:*:*:*",
"matchCriteriaId": "AB109C36-BF0F-41E3-A1F4-0DB264BD4A55",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.3_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "9A31EA2D-2B01-4928-9B3E-9D666FD2758B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.4_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "E87DE16C-7C68-4DA8-9BD9-C61D74E61D6E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.4a_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "5001527E-FE93-4BE7-BF79-7717D64CAF2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.5_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "D15ED599-6B84-4E03-8BA4-36E1D55F1F75",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.6_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "D491A2B9-949A-4A56-A41F-23A222C03BA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.7_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "01CFDB0B-6FBD-49F3-8238-81E92661297E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.7a_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "EC73A23F-2399-41B0-B6BD-289DF63F2C6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.8_rc:*:*:*:*:*:*:*",
"matchCriteriaId": "AD59DD99-1FC7-498B-9EA1-1AA8FE132EEE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "1655572D-7D56-4D9D-9E0F-A67DF23FC934",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "387E0B83-B240-4922-8C57-CE0CDB000888",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "CF5B09FF-92DF-4F8D-9A7B-E5086E2B954D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "D02321D7-2F3E-40F9-9A76-CFF339C93199",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "3B908D49-F64A-488F-95F3-163AB9DAB02D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.13a:*:*:*:*:*:*:*",
"matchCriteriaId": "1A26F8E5-0FFE-473D-BDA1-2D5340B5A4A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.14:*:*:*:*:*:*:*",
"matchCriteriaId": "0FF0655C-7C83-4363-A444-993B35D7A7EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.14a:*:*:*:*:*:*:*",
"matchCriteriaId": "B3D0F7C4-902D-4186-8EFF-3876D6D6633E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.15:*:*:*:*:*:*:*",
"matchCriteriaId": "6F87C476-6A55-4B19-97B0-24204E96A63E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.16:*:*:*:*:*:*:*",
"matchCriteriaId": "8ACC6DD4-384B-44DE-9BC7-6F1DD374E6B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.17:*:*:*:*:*:*:*",
"matchCriteriaId": "17D0AC3E-97F7-4A13-8E65-7E424D055E38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.18:*:*:*:*:*:*:*",
"matchCriteriaId": "04B508F8-CFCC-4841-BF70-1ABB28EB1ABC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.19:*:*:*:*:*:*:*",
"matchCriteriaId": "C365D62D-ACB1-44D3-935D-F79A79642684",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.20:*:*:*:*:*:*:*",
"matchCriteriaId": "F4B45305-FF8B-42F8-A726-F8604BADC323",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in search.php in Phorum 5.0.0alpha through 5.0.20, when register_globals is enabled, allows remote attackers to execute arbitrary SQL commands via the forum_ids parameter."
},
{
"lang": "es",
"value": "Vulnerabilidad de inyecci\u00f3n de SQL en Phorum 5.0.0alpha a 5.0.20, cuando \"register_globals\" est\u00e1 habilitado, permite a atacantes ejecutar \u00f3rdenes SQL de su elecci\u00f3n mediante el par\u00e1metro forum_id si register_globals est\u00e1 activado en PHP.\r\n"
}
],
"id": "CVE-2005-3543",
"lastModified": "2024-11-21T00:02:08.593",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2005-11-16T07:42:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=113122911424216\u0026w=2"
},
{
"source": "cve@mitre.org",
"url": "http://phorum.org/story.php?57"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/17456"
},
{
"source": "cve@mitre.org",
"url": "http://securityreason.com/securityalert/153"
},
{
"source": "cve@mitre.org",
"url": "http://www.osvdb.org/20524"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2005/2332"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://www.waraxe.us/advisory-43.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=113122911424216\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phorum.org/story.php?57"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/17456"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/153"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/20524"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2005/2332"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://www.waraxe.us/advisory-43.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2003-12-31 05:00
Modified
2024-11-20 23:47
Severity ?
Summary
Phorum 3.4 through 3.4.2 allows remote attackers to obtain the full path of the web server via an incorrect HTTP request to (1) smileys.php, (2) quick_listrss.php, (3) purge.php, (4) news.php, (5) memberlist.php, (6) forum_listrss.php, (7) forum_list_rdf.php, (8) forum_list.php, or (9) move.php, which leaks the information in an error message.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6650BE9D-5F4B-4B22-BD7E-ABCC067D5455",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1B8E0CA9-F6D4-4DD3-A3EA-F3A40965261B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7F67B233-3087-43E6-94F2-5DF39FAA36B7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Phorum 3.4 through 3.4.2 allows remote attackers to obtain the full path of the web server via an incorrect HTTP request to (1) smileys.php, (2) quick_listrss.php, (3) purge.php, (4) news.php, (5) memberlist.php, (6) forum_listrss.php, (7) forum_list_rdf.php, (8) forum_list.php, or (9) move.php, which leaks the information in an error message."
}
],
"id": "CVE-2003-1486",
"lastModified": "2024-11-20T23:47:16.307",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2003-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://securityreason.com/securityalert/3288"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/321310"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/7571"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/12499"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/3288"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/321310"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.securityfocus.com/bid/7571"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/12499"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2007-04-25 16:19
Modified
2024-11-21 00:30
Severity ?
Summary
admin.php in Phorum before 5.1.22 allows remote attackers to obtain the full path via the module[] parameter.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E6CCA297-E655-4134-BC6D-F190C4C228D6",
"versionEndIncluding": "5.1.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "admin.php in Phorum before 5.1.22 allows remote attackers to obtain the full path via the module[] parameter."
},
{
"lang": "es",
"value": "admin.php de Phorum versiones anteriores a 5.1.22 permite a atacantes remotos obtener la ruta completa mediante el par\u00e1metro module[].\r\n"
}
],
"id": "CVE-2007-2250",
"lastModified": "2024-11-21T00:30:18.263",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2007-04-25T16:19:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/35060"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/24932"
},
{
"source": "cve@mitre.org",
"url": "http://securityreason.com/securityalert/2617"
},
{
"source": "cve@mitre.org",
"url": "http://www.phorum.org/story.php?76"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/466286/100/0/threaded"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "http://www.securityfocus.com/bid/23616"
},
{
"source": "cve@mitre.org",
"url": "http://www.securitytracker.com/id?1017936"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2007/1479"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://www.waraxe.us/advisory-49.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/35060"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/24932"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securityreason.com/securityalert/2617"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phorum.org/story.php?76"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/466286/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "http://www.securityfocus.com/bid/23616"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securitytracker.com/id?1017936"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2007/1479"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://www.waraxe.us/advisory-49.html"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-12-14 18:28
Modified
2024-11-21 00:22
Severity ?
Summary
PHP remote file inclusion vulnerability in common.php in Phorum 3.2.11 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the db_file parameter. NOTE: CVE disputes this vulnerability because db_file is defined before use
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.11:*:*:*:*:*:*:*",
"matchCriteriaId": "24866943-26D7-4783-AA49-C2C5AA1A42BC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [
{
"sourceIdentifier": "cve@mitre.org",
"tags": [
"disputed"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "PHP remote file inclusion vulnerability in common.php in Phorum 3.2.11 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the db_file parameter. NOTE: CVE disputes this vulnerability because db_file is defined before use"
},
{
"lang": "es",
"value": "** IMPUGNADO ** Vulnerabilidad de inclusi\u00f3n remota de archivo en PHP en common.php de Phorum 3.2.11 y versiones anteriores, permite a atacantes remotos ejecutar c\u00f3digo PHP de su elecci\u00f3n mediante una URL en el par\u00e1metro db_file.\r\nNOTA: CVE impugan esta vulnerabilidad porque db_file se define antes de ser usada."
}
],
"id": "CVE-2006-6550",
"lastModified": "2024-11-21T00:22:57.500",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-12-14T18:28:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30741"
},
{
"source": "cve@mitre.org",
"url": "https://www.exploit-db.com/exploits/2894"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30741"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://www.exploit-db.com/exploits/2894"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2006-07-18 15:46
Modified
2024-11-21 00:14
Severity ?
Summary
Directory traversal vulnerability in pm.php in Phorum 5 allows remote authenticated users to include and execute arbitrary local files via directory traversal sequences in the GLOBALS[template] parameter, as demonstrated by injecting PHP sequences into a log file, which is then included by pm.php.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2520A79B-FC05-47C4-9D15-46BDE0F6BEB9",
"versionEndIncluding": "5.1.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "740F974F-D679-472C-966A-3E4C334E3C0A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "32D7E47E-10F5-4F50-8940-951B2C0011CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16042FAE-7370-425C-8810-4F9363B7CAA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.1_pre:*:*:*:*:*:*:*",
"matchCriteriaId": "B4A25A6F-62CA-4C76-9D4C-821B1E15FB1B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.1_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "6247DB0C-37B6-44EF-8B92-8CFCDA537039",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.1a:*:*:*:*:*:*:*",
"matchCriteriaId": "4C46298C-2492-4102-A264-E2A1D45AD423",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1A2AD59F-42DF-407A-8FCA-E6E0067A2B3A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "17E1044B-2101-4719-8749-17DD22F46055",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B7E17261-A010-4929-99E5-A2511F205B72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A461E2EB-9964-44DE-9C25-562D239201F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.3a:*:*:*:*:*:*:*",
"matchCriteriaId": "9CB6A4EC-D351-4EF8-8C6A-294A47DDCCC7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.3b:*:*:*:*:*:*:*",
"matchCriteriaId": "2B10230A-7D72-418E-8A29-E9F20762C43A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "368C8142-836A-4FDB-9CD8-385FE06B9A62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1470761E-DA6E-4D2A-B226-1ED782FB3654",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "FEB3ED23-821D-42FA-A24F-F2EDDA43D7B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "88BA8736-5998-42E0-81E4-76E3669F8112",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "DC9811C9-EE92-4115-B81F-7A3030390BD1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "5A196AD2-7E48-40F4-923E-437FA76C97D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.1a:*:*:*:*:*:*:*",
"matchCriteriaId": "91D147F0-FF83-4FF4-AEF1-71366E874876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D87C46-D9EC-418B-9C8C-71E7149C72D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.2a:*:*:*:*:*:*:*",
"matchCriteriaId": "A7F6BE0A-7E2F-457D-B4BA-6BAE1B44E7D3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.2b3:*:*:*:*:*:*:*",
"matchCriteriaId": "C990B390-4768-41B0-BB8B-A56C2524623F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6650BE9D-5F4B-4B22-BD7E-ABCC067D5455",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1B8E0CA9-F6D4-4DD3-A3EA-F3A40965261B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7F67B233-3087-43E6-94F2-5DF39FAA36B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "7725AEF3-1C47-46B4-A35E-97152A84E731",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "F3F6C52C-F602-4C2A-8C8F-4A19DA41186F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "45F290E5-6508-4F62-8572-31B33750D341",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6D941B5F-B704-4596-8739-BFE34225DBA7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "FF13359B-162A-41DF-BB4F-DDD6CA2752F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "7D1AE057-A85C-49D9-981A-3314BD945D08",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.8a:*:*:*:*:*:*:*",
"matchCriteriaId": "EAC1F375-34EF-4FEC-B0F4-6A081B6A3B53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:4.3.7:*:*:*:*:*:*:*",
"matchCriteriaId": "1E532A66-A12D-48DD-B405-2345E5B715C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.0_alpha:*:*:*:*:*:*:*",
"matchCriteriaId": "26E2C5A7-8B52-4BDF-80F1-5D45AEBE6E25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.1_alpha:*:*:*:*:*:*:*",
"matchCriteriaId": "0E8DF602-0A22-45A9-A286-C237180701C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.2_alpha:*:*:*:*:*:*:*",
"matchCriteriaId": "AB109C36-BF0F-41E3-A1F4-0DB264BD4A55",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.3_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "9A31EA2D-2B01-4928-9B3E-9D666FD2758B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.4_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "E87DE16C-7C68-4DA8-9BD9-C61D74E61D6E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.4a_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "5001527E-FE93-4BE7-BF79-7717D64CAF2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.5_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "D15ED599-6B84-4E03-8BA4-36E1D55F1F75",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.6_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "D491A2B9-949A-4A56-A41F-23A222C03BA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.7_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "01CFDB0B-6FBD-49F3-8238-81E92661297E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.7a_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "EC73A23F-2399-41B0-B6BD-289DF63F2C6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.8_rc:*:*:*:*:*:*:*",
"matchCriteriaId": "AD59DD99-1FC7-498B-9EA1-1AA8FE132EEE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "1655572D-7D56-4D9D-9E0F-A67DF23FC934",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "387E0B83-B240-4922-8C57-CE0CDB000888",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "CF5B09FF-92DF-4F8D-9A7B-E5086E2B954D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "D02321D7-2F3E-40F9-9A76-CFF339C93199",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "3B908D49-F64A-488F-95F3-163AB9DAB02D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.13a:*:*:*:*:*:*:*",
"matchCriteriaId": "1A26F8E5-0FFE-473D-BDA1-2D5340B5A4A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.14:*:*:*:*:*:*:*",
"matchCriteriaId": "0FF0655C-7C83-4363-A444-993B35D7A7EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.14a:*:*:*:*:*:*:*",
"matchCriteriaId": "B3D0F7C4-902D-4186-8EFF-3876D6D6633E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.15:*:*:*:*:*:*:*",
"matchCriteriaId": "6F87C476-6A55-4B19-97B0-24204E96A63E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.15a:*:*:*:*:*:*:*",
"matchCriteriaId": "83F8F544-1B09-4B22-B1F3-2CD1E8D7AECD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.16:*:*:*:*:*:*:*",
"matchCriteriaId": "8ACC6DD4-384B-44DE-9BC7-6F1DD374E6B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.17:*:*:*:*:*:*:*",
"matchCriteriaId": "17D0AC3E-97F7-4A13-8E65-7E424D055E38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.17a:*:*:*:*:*:*:*",
"matchCriteriaId": "D184385A-763A-4971-8051-20564D020787",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.18:*:*:*:*:*:*:*",
"matchCriteriaId": "04B508F8-CFCC-4841-BF70-1ABB28EB1ABC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.19:*:*:*:*:*:*:*",
"matchCriteriaId": "C365D62D-ACB1-44D3-935D-F79A79642684",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.20:*:*:*:*:*:*:*",
"matchCriteriaId": "F4B45305-FF8B-42F8-A726-F8604BADC323",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.13:*:*:*:*:*:*:*",
"matchCriteriaId": "70F4AB87-2D63-4208-8982-BBF978392285",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in pm.php in Phorum 5 allows remote authenticated users to include and execute arbitrary local files via directory traversal sequences in the GLOBALS[template] parameter, as demonstrated by injecting PHP sequences into a log file, which is then included by pm.php."
},
{
"lang": "es",
"value": "Vulnerabilidad de salto de directorio en pm.php de Phorum 5 permite a atacantes remotos autenticados incluir y ejecutar ficheros locales mediante secuencias de salto de directorio en el par\u00e1metro GLOBALS[template], como ha sido demostrado inyectando secuencias PHP en un fichero de log, el cual cual es incluido por pm.php."
}
],
"evaluatorSolution": "Successful exploitation requires that register_globals is enabled.\r\nThis vulnerability is addresses in the following product release:\r\nPhorum, Phorum, 5.1.15",
"id": "CVE-2006-3611",
"lastModified": "2024-11-21T00:14:01.507",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2006-07-18T15:46:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://retrogod.altervista.org/phorum5_local_incl_xpl.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.phorum.org/phorum5/read.php?14%2C114358"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/archive/1/439976/100/0/threaded"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2006/2794"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://retrogod.altervista.org/phorum5_local_incl_xpl.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phorum.org/phorum5/read.php?14%2C114358"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/archive/1/439976/100/0/threaded"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2006/2794"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2004-12-31 05:00
Modified
2024-11-20 23:52
Severity ?
Summary
Multiple SQL injection vulnerabilities in Phorum 5.0.11 and earlier allow remote attackers to modify SQL statements via (1) the query string in read.php or (2) unknown vectors in file.php.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "CF5B09FF-92DF-4F8D-9A7B-E5086E2B954D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Multiple SQL injection vulnerabilities in Phorum 5.0.11 and earlier allow remote attackers to modify SQL statements via (1) the query string in read.php or (2) unknown vectors in file.php."
}
],
"id": "CVE-2004-2240",
"lastModified": "2024-11-20T23:52:51.040",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2004-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://phorum.org/cvs-changelog-5.txt"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/12980"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://securitytracker.com/id?1011921"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://www.maxpatrol.com/advdetails.asp?id=15"
},
{
"source": "cve@mitre.org",
"url": "http://www.maxpatrol.com/mp_advisory.asp"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "http://www.osvdb.org/11129"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/11538"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17847"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phorum.org/cvs-changelog-5.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/12980"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://securitytracker.com/id?1011921"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "http://www.maxpatrol.com/advdetails.asp?id=15"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.maxpatrol.com/mp_advisory.asp"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "http://www.osvdb.org/11129"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/11538"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17847"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2011-09-08 18:55
Modified
2024-11-21 01:30
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in control.php in the controlcenter in Phorum before 5.2.17 allows remote attackers to inject arbitrary web script or HTML via the real_name parameter.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:*:*:*:*:*:*:*:*",
"matchCriteriaId": "58668B6C-0B5A-416B-9CCB-27BA3885A32D",
"versionEndIncluding": "5.2.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "740F974F-D679-472C-966A-3E4C334E3C0A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "32D7E47E-10F5-4F50-8940-951B2C0011CA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "16042FAE-7370-425C-8810-4F9363B7CAA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.1_pre:*:*:*:*:*:*:*",
"matchCriteriaId": "B4A25A6F-62CA-4C76-9D4C-821B1E15FB1B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.1_rc2:*:*:*:*:*:*:*",
"matchCriteriaId": "6247DB0C-37B6-44EF-8B92-8CFCDA537039",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.1a:*:*:*:*:*:*:*",
"matchCriteriaId": "4C46298C-2492-4102-A264-E2A1D45AD423",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "1A2AD59F-42DF-407A-8FCA-E6E0067A2B3A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "17E1044B-2101-4719-8749-17DD22F46055",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B7E17261-A010-4929-99E5-A2511F205B72",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "A461E2EB-9964-44DE-9C25-562D239201F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.3a:*:*:*:*:*:*:*",
"matchCriteriaId": "9CB6A4EC-D351-4EF8-8C6A-294A47DDCCC7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.3b:*:*:*:*:*:*:*",
"matchCriteriaId": "2B10230A-7D72-418E-8A29-E9F20762C43A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "368C8142-836A-4FDB-9CD8-385FE06B9A62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "1470761E-DA6E-4D2A-B226-1ED782FB3654",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "FEB3ED23-821D-42FA-A24F-F2EDDA43D7B6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "88BA8736-5998-42E0-81E4-76E3669F8112",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "DC9811C9-EE92-4115-B81F-7A3030390BD1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.1:*:*:*:*:*:*:*",
"matchCriteriaId": "5A196AD2-7E48-40F4-923E-437FA76C97D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.1a:*:*:*:*:*:*:*",
"matchCriteriaId": "91D147F0-FF83-4FF4-AEF1-71366E874876",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.2:*:*:*:*:*:*:*",
"matchCriteriaId": "C6D87C46-D9EC-418B-9C8C-71E7149C72D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.2a:*:*:*:*:*:*:*",
"matchCriteriaId": "A7F6BE0A-7E2F-457D-B4BA-6BAE1B44E7D3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.3.2b3:*:*:*:*:*:*:*",
"matchCriteriaId": "C990B390-4768-41B0-BB8B-A56C2524623F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4:*:*:*:*:*:*:*",
"matchCriteriaId": "6650BE9D-5F4B-4B22-BD7E-ABCC067D5455",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "1B8E0CA9-F6D4-4DD3-A3EA-F3A40965261B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "7F67B233-3087-43E6-94F2-5DF39FAA36B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "7725AEF3-1C47-46B4-A35E-97152A84E731",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "F3F6C52C-F602-4C2A-8C8F-4A19DA41186F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "45F290E5-6508-4F62-8572-31B33750D341",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6D941B5F-B704-4596-8739-BFE34225DBA7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "FF13359B-162A-41DF-BB4F-DDD6CA2752F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "7D1AE057-A85C-49D9-981A-3314BD945D08",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:3.4.8a:*:*:*:*:*:*:*",
"matchCriteriaId": "EAC1F375-34EF-4FEC-B0F4-6A081B6A3B53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:4.3.7:*:*:*:*:*:*:*",
"matchCriteriaId": "1E532A66-A12D-48DD-B405-2345E5B715C9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.0_alpha:*:*:*:*:*:*:*",
"matchCriteriaId": "26E2C5A7-8B52-4BDF-80F1-5D45AEBE6E25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.1_alpha:*:*:*:*:*:*:*",
"matchCriteriaId": "0E8DF602-0A22-45A9-A286-C237180701C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.2_alpha:*:*:*:*:*:*:*",
"matchCriteriaId": "AB109C36-BF0F-41E3-A1F4-0DB264BD4A55",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.3_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "9A31EA2D-2B01-4928-9B3E-9D666FD2758B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.4_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "E87DE16C-7C68-4DA8-9BD9-C61D74E61D6E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.4a_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "5001527E-FE93-4BE7-BF79-7717D64CAF2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.5_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "D15ED599-6B84-4E03-8BA4-36E1D55F1F75",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.6_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "D491A2B9-949A-4A56-A41F-23A222C03BA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.7_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "01CFDB0B-6FBD-49F3-8238-81E92661297E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.7a_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "EC73A23F-2399-41B0-B6BD-289DF63F2C6A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.8_rc:*:*:*:*:*:*:*",
"matchCriteriaId": "AD59DD99-1FC7-498B-9EA1-1AA8FE132EEE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "1655572D-7D56-4D9D-9E0F-A67DF23FC934",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "387E0B83-B240-4922-8C57-CE0CDB000888",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "CF5B09FF-92DF-4F8D-9A7B-E5086E2B954D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "D02321D7-2F3E-40F9-9A76-CFF339C93199",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "3B908D49-F64A-488F-95F3-163AB9DAB02D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.13a:*:*:*:*:*:*:*",
"matchCriteriaId": "1A26F8E5-0FFE-473D-BDA1-2D5340B5A4A5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.14:*:*:*:*:*:*:*",
"matchCriteriaId": "0FF0655C-7C83-4363-A444-993B35D7A7EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.14a:*:*:*:*:*:*:*",
"matchCriteriaId": "B3D0F7C4-902D-4186-8EFF-3876D6D6633E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.15:*:*:*:*:*:*:*",
"matchCriteriaId": "6F87C476-6A55-4B19-97B0-24204E96A63E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.15a:*:*:*:*:*:*:*",
"matchCriteriaId": "83F8F544-1B09-4B22-B1F3-2CD1E8D7AECD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.16:*:*:*:*:*:*:*",
"matchCriteriaId": "8ACC6DD4-384B-44DE-9BC7-6F1DD374E6B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.17:*:*:*:*:*:*:*",
"matchCriteriaId": "17D0AC3E-97F7-4A13-8E65-7E424D055E38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.17a:*:*:*:*:*:*:*",
"matchCriteriaId": "D184385A-763A-4971-8051-20564D020787",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.18:*:*:*:*:*:*:*",
"matchCriteriaId": "04B508F8-CFCC-4841-BF70-1ABB28EB1ABC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.19:*:*:*:*:*:*:*",
"matchCriteriaId": "C365D62D-ACB1-44D3-935D-F79A79642684",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.20:*:*:*:*:*:*:*",
"matchCriteriaId": "F4B45305-FF8B-42F8-A726-F8604BADC323",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.13:*:*:*:*:*:*:*",
"matchCriteriaId": "70F4AB87-2D63-4208-8982-BBF978392285",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.14:*:*:*:*:*:*:*",
"matchCriteriaId": "149A6B5A-84FC-4B6F-B053-0AC881BC03D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.17:*:*:*:*:*:*:*",
"matchCriteriaId": "375346D4-CEA4-4BAE-83DF-639E86C3DECC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.18:*:*:*:*:*:*:*",
"matchCriteriaId": "3C6E0429-3241-47B0-B853-66D3167CE4F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.20:*:*:*:*:*:*:*",
"matchCriteriaId": "121F0F96-F901-479F-A64F-3DAE1AC0AFAF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.21:*:*:*:*:*:*:*",
"matchCriteriaId": "F837829B-28E5-41B3-9A23-C4D4A7FE636A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.1.25:*:*:*:*:*:*:*",
"matchCriteriaId": "700B9165-B956-4CAB-B980-42885FFA418F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "A4C4E79D-EBE6-456C-A74F-B94F32736383",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D3596808-8399-4EA9-B885-5443CA91C3C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.2:beta:*:*:*:*:*:*",
"matchCriteriaId": "B5409C8A-8B57-48FB-B01E-411C00153E9B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "74DB422C-E79C-46B2-BB52-8C457822A0BD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.4:rc2:*:*:*:*:*:*",
"matchCriteriaId": "37881B2C-0CD0-4E2A-A11D-9758772640E9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "66BE61C7-E1DD-4DA9-B433-0C698C482C57",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "FB5E063A-F59F-4CEB-9950-2FE8D25FF9FF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.9:*:*:*:*:*:*:*",
"matchCriteriaId": "F0A35F3F-6BBF-4B84-AE19-870F03C1E9DC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.10:*:*:*:*:*:*:*",
"matchCriteriaId": "90FC064F-B462-47F8-880F-CB26A340477E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.10:rc1:*:*:*:*:*:*",
"matchCriteriaId": "D083445E-48ED-4666-98A8-932B01A0F9B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.11:*:*:*:*:*:*:*",
"matchCriteriaId": "A79911F1-C1C3-4DD1-BA37-AFC77D7B0D90",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.12:*:*:*:*:*:*:*",
"matchCriteriaId": "2200E549-30F8-4803-A570-FBF08B97B7CD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.12a:*:*:*:*:*:*:*",
"matchCriteriaId": "2798D56A-BEBC-4EC0-ACA3-D0B9E8E4D61D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.13:*:*:*:*:*:*:*",
"matchCriteriaId": "D9876C40-4537-4622-90D5-175AB59609D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "51638139-DB4F-4B8C-B125-1FE9AFC86B21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.2.15:*:*:*:*:*:*:*",
"matchCriteriaId": "6362BDF1-A90C-40A8-A80C-024788426315",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in control.php in the controlcenter in Phorum before 5.2.17 allows remote attackers to inject arbitrary web script or HTML via the real_name parameter."
},
{
"lang": "es",
"value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en control.php en controlcenter en Phorum antes de v5.2.17, permite a atacantes remotos ejecutar secuencias de comandos web o HTML a trav\u00e9s del par\u00e1metro real_name."
}
],
"id": "CVE-2011-3392",
"lastModified": "2024-11-21T01:30:26.000",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2011-09-08T18:55:06.737",
"references": [
{
"source": "cve@mitre.org",
"url": "http://holisticinfosec.org/content/view/184/45/"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/45787"
},
{
"source": "cve@mitre.org",
"url": "http://www.phorum.org/phorum5/read.php?64%2C149490%2C149490#msg-149490"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/49347"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/69456"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://holisticinfosec.org/content/view/184/45/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/45787"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.phorum.org/phorum5/read.php?64%2C149490%2C149490#msg-149490"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/49347"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/69456"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2004-12-31 05:00
Modified
2024-11-20 23:51
Severity ?
Summary
SQL injection vulnerability in follow.php in Phorum 5.0.12 and earlier allows remote authenticated users to execute arbitrary SQL command via the forum_id parameter.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.3_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "9A31EA2D-2B01-4928-9B3E-9D666FD2758B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.7_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "01CFDB0B-6FBD-49F3-8238-81E92661297E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "1655572D-7D56-4D9D-9E0F-A67DF23FC934",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "387E0B83-B240-4922-8C57-CE0CDB000888",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "CF5B09FF-92DF-4F8D-9A7B-E5086E2B954D",
"vulnerable": false
},
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "D02321D7-2F3E-40F9-9A76-CFF339C93199",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in follow.php in Phorum 5.0.12 and earlier allows remote authenticated users to execute arbitrary SQL command via the forum_id parameter."
}
],
"id": "CVE-2004-1518",
"lastModified": "2024-11-20T23:51:05.267",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2004-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2004-November/028609.html"
},
{
"source": "cve@mitre.org",
"url": "http://marc.info/?l=bugtraq\u0026m=110021385926870\u0026w=2"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/13174"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "http://www.securityfocus.com/bid/11660"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/18045"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Vendor Advisory"
],
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2004-November/028609.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://marc.info/?l=bugtraq\u0026m=110021385926870\u0026w=2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/13174"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "http://www.securityfocus.com/bid/11660"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/18045"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2004-12-31 05:00
Modified
2024-11-20 23:52
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in search.php in Phorum, possibly 5.0.7 beta and earlier, allows remote attackers to inject arbitrary HTML or web script via the subject parameter.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:phorum:phorum:5.0.7_beta:*:*:*:*:*:*:*",
"matchCriteriaId": "01CFDB0B-6FBD-49F3-8238-81E92661297E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in search.php in Phorum, possibly 5.0.7 beta and earlier, allows remote attackers to inject arbitrary HTML or web script via the subject parameter."
}
],
"id": "CVE-2004-2242",
"lastModified": "2024-11-20T23:52:51.347",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2004-12-31T05:00:00.000",
"references": [
{
"source": "cve@mitre.org",
"url": "http://phorum.org/cvs-changelog-5.txt"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://securitytracker.com/id?1010787"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/10822"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16831"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://phorum.org/cvs-changelog-5.txt"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://securitytracker.com/id?1010787"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "http://www.securityfocus.com/bid/10822"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16831"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
cve-2006-3611
Vulnerability from cvelistv5
Published
2006-07-14 21:00
Modified
2024-08-07 18:39
Severity ?
EPSS score ?
Summary
Directory traversal vulnerability in pm.php in Phorum 5 allows remote authenticated users to include and execute arbitrary local files via directory traversal sequences in the GLOBALS[template] parameter, as demonstrated by injecting PHP sequences into a log file, which is then included by pm.php.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.phorum.org/phorum5/read.php?14%2C114358 | x_refsource_MISC | |
| http://www.vupen.com/english/advisories/2006/2794 | vdb-entry, x_refsource_VUPEN | |
| http://www.securityfocus.com/archive/1/439976/100/0/threaded | mailing-list, x_refsource_BUGTRAQ | |
| http://retrogod.altervista.org/phorum5_local_incl_xpl.html | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T18:39:53.428Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.phorum.org/phorum5/read.php?14%2C114358"
},
{
"name": "ADV-2006-2794",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/2794"
},
{
"name": "20060713 PHORUM 5 arbitrary local inclusion",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/439976/100/0/threaded"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://retrogod.altervista.org/phorum5_local_incl_xpl.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-07-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in pm.php in Phorum 5 allows remote authenticated users to include and execute arbitrary local files via directory traversal sequences in the GLOBALS[template] parameter, as demonstrated by injecting PHP sequences into a log file, which is then included by pm.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-18T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.phorum.org/phorum5/read.php?14%2C114358"
},
{
"name": "ADV-2006-2794",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/2794"
},
{
"name": "20060713 PHORUM 5 arbitrary local inclusion",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/439976/100/0/threaded"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://retrogod.altervista.org/phorum5_local_incl_xpl.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-3611",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Directory traversal vulnerability in pm.php in Phorum 5 allows remote authenticated users to include and execute arbitrary local files via directory traversal sequences in the GLOBALS[template] parameter, as demonstrated by injecting PHP sequences into a log file, which is then included by pm.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.phorum.org/phorum5/read.php?14,114358",
"refsource": "MISC",
"url": "http://www.phorum.org/phorum5/read.php?14,114358"
},
{
"name": "ADV-2006-2794",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/2794"
},
{
"name": "20060713 PHORUM 5 arbitrary local inclusion",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/439976/100/0/threaded"
},
{
"name": "http://retrogod.altervista.org/phorum5_local_incl_xpl.html",
"refsource": "MISC",
"url": "http://retrogod.altervista.org/phorum5_local_incl_xpl.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-3611",
"datePublished": "2006-07-14T21:00:00",
"dateReserved": "2006-07-14T00:00:00",
"dateUpdated": "2024-08-07T18:39:53.428Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2011-3392
Vulnerability from cvelistv5
Published
2011-09-08 18:00
Modified
2024-08-06 23:29
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in control.php in the controlcenter in Phorum before 5.2.17 allows remote attackers to inject arbitrary web script or HTML via the real_name parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://holisticinfosec.org/content/view/184/45/ | x_refsource_MISC | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/69456 | vdb-entry, x_refsource_XF | |
| http://www.securityfocus.com/bid/49347 | vdb-entry, x_refsource_BID | |
| http://secunia.com/advisories/45787 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.phorum.org/phorum5/read.php?64%2C149490%2C149490#msg-149490 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T23:29:56.896Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://holisticinfosec.org/content/view/184/45/"
},
{
"name": "phorum-control-xss(69456)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/69456"
},
{
"name": "49347",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/49347"
},
{
"name": "45787",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/45787"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phorum.org/phorum5/read.php?64%2C149490%2C149490#msg-149490"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-08-29T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in control.php in the controlcenter in Phorum before 5.2.17 allows remote attackers to inject arbitrary web script or HTML via the real_name parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://holisticinfosec.org/content/view/184/45/"
},
{
"name": "phorum-control-xss(69456)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/69456"
},
{
"name": "49347",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/49347"
},
{
"name": "45787",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/45787"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phorum.org/phorum5/read.php?64%2C149490%2C149490#msg-149490"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-3392",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in control.php in the controlcenter in Phorum before 5.2.17 allows remote attackers to inject arbitrary web script or HTML via the real_name parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://holisticinfosec.org/content/view/184/45/",
"refsource": "MISC",
"url": "http://holisticinfosec.org/content/view/184/45/"
},
{
"name": "phorum-control-xss(69456)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/69456"
},
{
"name": "49347",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/49347"
},
{
"name": "45787",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/45787"
},
{
"name": "http://www.phorum.org/phorum5/read.php?64,149490,149490#msg-149490",
"refsource": "CONFIRM",
"url": "http://www.phorum.org/phorum5/read.php?64,149490,149490#msg-149490"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-3392",
"datePublished": "2011-09-08T18:00:00",
"dateReserved": "2011-09-08T00:00:00",
"dateUpdated": "2024-08-06T23:29:56.896Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2004-1938
Vulnerability from cvelistv5
Published
2005-05-10 04:00
Modified
2024-08-08 01:07
Severity ?
EPSS score ?
Summary
SQL injection vulnerability in userlogin.php in Phorum 3.4.7 allows remote attackers to execute arbitrary SQL commands via doubly hex-encoded characters such as "%2527", which is translated to "'", as demonstrated using the phorum_uriauth parameter to list.php.
References
| ▼ | URL | Tags |
|---|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/15894 | vdb-entry, x_refsource_XF | |
| http://secunia.com/advisories/11407 | third-party-advisory, x_refsource_SECUNIA | |
| http://marc.info/?l=bugtraq&m=108239796512897&w=2 | mailing-list, x_refsource_BUGTRAQ | |
| http://www.waraxe.us/index.php?modname=sa&id=19 | x_refsource_MISC | |
| http://www.securityfocus.com/bid/10173 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T01:07:49.121Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "phorum-userlogin-sql-injection(15894)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15894"
},
{
"name": "11407",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/11407"
},
{
"name": "20040419 [waraxe-2004-SA#019 - Critical sql injection bug in Phorum 3.4.7]",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=108239796512897\u0026w=2"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.waraxe.us/index.php?modname=sa\u0026id=19"
},
{
"name": "10173",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/10173"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2004-04-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in userlogin.php in Phorum 3.4.7 allows remote attackers to execute arbitrary SQL commands via doubly hex-encoded characters such as \"%2527\", which is translated to \"\u0027\", as demonstrated using the phorum_uriauth parameter to list.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "phorum-userlogin-sql-injection(15894)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15894"
},
{
"name": "11407",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/11407"
},
{
"name": "20040419 [waraxe-2004-SA#019 - Critical sql injection bug in Phorum 3.4.7]",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=108239796512897\u0026w=2"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.waraxe.us/index.php?modname=sa\u0026id=19"
},
{
"name": "10173",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/10173"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2004-1938",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "SQL injection vulnerability in userlogin.php in Phorum 3.4.7 allows remote attackers to execute arbitrary SQL commands via doubly hex-encoded characters such as \"%2527\", which is translated to \"\u0027\", as demonstrated using the phorum_uriauth parameter to list.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "phorum-userlogin-sql-injection(15894)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15894"
},
{
"name": "11407",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/11407"
},
{
"name": "20040419 [waraxe-2004-SA#019 - Critical sql injection bug in Phorum 3.4.7]",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=108239796512897\u0026w=2"
},
{
"name": "http://www.waraxe.us/index.php?modname=sa\u0026id=19",
"refsource": "MISC",
"url": "http://www.waraxe.us/index.php?modname=sa\u0026id=19"
},
{
"name": "10173",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/10173"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2004-1938",
"datePublished": "2005-05-10T04:00:00",
"dateReserved": "2005-05-04T00:00:00",
"dateUpdated": "2024-08-08T01:07:49.121Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2002-0764
Vulnerability from cvelistv5
Published
2002-07-26 04:00
Modified
2024-08-08 03:03
Severity ?
EPSS score ?
Summary
Phorum 3.3.2a allows remote attackers to execute arbitrary commands via an HTTP request to (1) plugin.php, (2) admin.php, or (3) del.php that modifies the PHORUM[settings_dir] variable to point to a directory that contains a PHP file with the commands.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/4763 | vdb-entry, x_refsource_BID | |
| http://www.phorum.org/ | x_refsource_CONFIRM | |
| http://archives.neohapsis.com/archives/bugtraq/2002-05/0153.html | mailing-list, x_refsource_BUGTRAQ | |
| http://www.iss.net/security_center/static/9107.php | vdb-entry, x_refsource_XF | |
| http://archives.neohapsis.com/archives/bugtraq/2002-05/0147.html | mailing-list, x_refsource_BUGTRAQ |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T03:03:48.602Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "4763",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/4763"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phorum.org/"
},
{
"name": "20020518 Phorum 3.3.2a has another bug for remote command execution",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2002-05/0153.html"
},
{
"name": "phorum-php-command-execution(9107)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "http://www.iss.net/security_center/static/9107.php"
},
{
"name": "20020517 Phorum 3.3.2a remote command execution",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2002-05/0147.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2002-05-17T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Phorum 3.3.2a allows remote attackers to execute arbitrary commands via an HTTP request to (1) plugin.php, (2) admin.php, or (3) del.php that modifies the PHORUM[settings_dir] variable to point to a directory that contains a PHP file with the commands."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2002-07-31T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "4763",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/4763"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phorum.org/"
},
{
"name": "20020518 Phorum 3.3.2a has another bug for remote command execution",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2002-05/0153.html"
},
{
"name": "phorum-php-command-execution(9107)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "http://www.iss.net/security_center/static/9107.php"
},
{
"name": "20020517 Phorum 3.3.2a remote command execution",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2002-05/0147.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2002-0764",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Phorum 3.3.2a allows remote attackers to execute arbitrary commands via an HTTP request to (1) plugin.php, (2) admin.php, or (3) del.php that modifies the PHORUM[settings_dir] variable to point to a directory that contains a PHP file with the commands."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "4763",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/4763"
},
{
"name": "http://www.phorum.org/",
"refsource": "CONFIRM",
"url": "http://www.phorum.org/"
},
{
"name": "20020518 Phorum 3.3.2a has another bug for remote command execution",
"refsource": "BUGTRAQ",
"url": "http://archives.neohapsis.com/archives/bugtraq/2002-05/0153.html"
},
{
"name": "phorum-php-command-execution(9107)",
"refsource": "XF",
"url": "http://www.iss.net/security_center/static/9107.php"
},
{
"name": "20020517 Phorum 3.3.2a remote command execution",
"refsource": "BUGTRAQ",
"url": "http://archives.neohapsis.com/archives/bugtraq/2002-05/0147.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2002-0764",
"datePublished": "2002-07-26T04:00:00",
"dateReserved": "2002-07-25T00:00:00",
"dateUpdated": "2024-08-08T03:03:48.602Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2003-1467
Vulnerability from cvelistv5
Published
2007-10-24 23:00
Modified
2024-08-08 02:28
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in (1) login.php, (2) register.php, (3) post.php, and (4) common.php in Phorum before 3.4.3 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/7572 | vdb-entry, x_refsource_BID | |
| http://www.securityfocus.com/bid/7576 | vdb-entry, x_refsource_BID | |
| http://www.securityfocus.com/bid/7573 | vdb-entry, x_refsource_BID | |
| http://securityreason.com/securityalert/3288 | third-party-advisory, x_refsource_SREASON | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/12502 | vdb-entry, x_refsource_XF | |
| http://www.securityfocus.com/bid/7577 | vdb-entry, x_refsource_BID | |
| http://www.securityfocus.com/bid/7584 | vdb-entry, x_refsource_BID | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/12487 | vdb-entry, x_refsource_XF | |
| http://www.securityfocus.com/archive/1/321310 | mailing-list, x_refsource_BUGTRAQ |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T02:28:03.488Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "7572",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/7572"
},
{
"name": "7576",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/7576"
},
{
"name": "7573",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/7573"
},
{
"name": "3288",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/3288"
},
{
"name": "phorum-register-html-injection(12502)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/12502"
},
{
"name": "7577",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/7577"
},
{
"name": "7584",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/7584"
},
{
"name": "phorum-multiple-xss(12487)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/12487"
},
{
"name": "20030513 Phorum Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/321310"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2003-05-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in (1) login.php, (2) register.php, (3) post.php, and (4) common.php in Phorum before 3.4.3 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "7572",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/7572"
},
{
"name": "7576",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/7576"
},
{
"name": "7573",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/7573"
},
{
"name": "3288",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/3288"
},
{
"name": "phorum-register-html-injection(12502)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/12502"
},
{
"name": "7577",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/7577"
},
{
"name": "7584",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/7584"
},
{
"name": "phorum-multiple-xss(12487)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/12487"
},
{
"name": "20030513 Phorum Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/321310"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2003-1467",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in (1) login.php, (2) register.php, (3) post.php, and (4) common.php in Phorum before 3.4.3 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "7572",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/7572"
},
{
"name": "7576",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/7576"
},
{
"name": "7573",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/7573"
},
{
"name": "3288",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/3288"
},
{
"name": "phorum-register-html-injection(12502)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/12502"
},
{
"name": "7577",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/7577"
},
{
"name": "7584",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/7584"
},
{
"name": "phorum-multiple-xss(12487)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/12487"
},
{
"name": "20030513 Phorum Vulnerabilities",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/321310"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2003-1467",
"datePublished": "2007-10-24T23:00:00",
"dateReserved": "2007-10-24T00:00:00",
"dateUpdated": "2024-08-08T02:28:03.488Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2002-2340
Vulnerability from cvelistv5
Published
2007-10-29 19:00
Modified
2024-08-08 03:59
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in read.php in Phorum 3.3.2a allows remote attackers to inject arbitrary web script or HTML via (1) the t parameter or (2) the body of an email response.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.ifrance.com/kitetoua/tuto/5holes5.txt | x_refsource_MISC | |
| http://marc.info/?l=vuln-dev&m=102121925428844&w=2 | mailing-list, x_refsource_VULN-DEV | |
| http://www.phorum.org/changelog.txt | x_refsource_MISC | |
| http://www.securityfocus.com/bid/4739 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T03:59:11.795Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.ifrance.com/kitetoua/tuto/5holes5.txt"
},
{
"name": "20020512 Security holes : Pseudo-Frame, PG, KvPoll, Phorum, BanMat",
"tags": [
"mailing-list",
"x_refsource_VULN-DEV",
"x_transferred"
],
"url": "http://marc.info/?l=vuln-dev\u0026m=102121925428844\u0026w=2"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.phorum.org/changelog.txt"
},
{
"name": "4739",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/4739"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2002-05-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in read.php in Phorum 3.3.2a allows remote attackers to inject arbitrary web script or HTML via (1) the t parameter or (2) the body of an email response."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-10-17T13:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.ifrance.com/kitetoua/tuto/5holes5.txt"
},
{
"name": "20020512 Security holes : Pseudo-Frame, PG, KvPoll, Phorum, BanMat",
"tags": [
"mailing-list",
"x_refsource_VULN-DEV"
],
"url": "http://marc.info/?l=vuln-dev\u0026m=102121925428844\u0026w=2"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.phorum.org/changelog.txt"
},
{
"name": "4739",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/4739"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2002-2340",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in read.php in Phorum 3.3.2a allows remote attackers to inject arbitrary web script or HTML via (1) the t parameter or (2) the body of an email response."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.ifrance.com/kitetoua/tuto/5holes5.txt",
"refsource": "MISC",
"url": "http://www.ifrance.com/kitetoua/tuto/5holes5.txt"
},
{
"name": "20020512 Security holes : Pseudo-Frame, PG, KvPoll, Phorum, BanMat",
"refsource": "VULN-DEV",
"url": "http://marc.info/?l=vuln-dev\u0026m=102121925428844\u0026w=2"
},
{
"name": "http://www.phorum.org/changelog.txt",
"refsource": "MISC",
"url": "http://www.phorum.org/changelog.txt"
},
{
"name": "4739",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/4739"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2002-2340",
"datePublished": "2007-10-29T19:00:00",
"dateReserved": "2007-10-29T00:00:00",
"dateUpdated": "2024-08-08T03:59:11.795Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2004-1822
Vulnerability from cvelistv5
Published
2005-05-10 04:00
Modified
2024-08-08 01:07
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Phorum 3.1 through 5.0.3 beta allow remote attackers to inject arbitrary web script or HTML via the (1) HTTP_REFERER parameter to login.php, (2) HTTP_REFERER parameter to register.php, or (3) target parameter to profile.php.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/9882 | vdb-entry, x_refsource_BID | |
| http://marc.info/?l=bugtraq&m=107939479713136&w=2 | mailing-list, x_refsource_BUGTRAQ | |
| http://www.osvdb.org/4334 | vdb-entry, x_refsource_OSVDB | |
| http://phorum.org/changelog.txt | x_refsource_CONFIRM | |
| http://www.osvdb.org/4335 | vdb-entry, x_refsource_OSVDB | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/15494 | vdb-entry, x_refsource_XF | |
| http://secunia.com/advisories/11157 | third-party-advisory, x_refsource_SECUNIA | |
| http://securitytracker.com/id?1009433 | vdb-entry, x_refsource_SECTRACK | |
| http://www.osvdb.org/4333 | vdb-entry, x_refsource_OSVDB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T01:07:48.297Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "9882",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/9882"
},
{
"name": "20040315 Phorum 5.0.3 Beta \u0026\u0026 Earlier XSS Issues",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=107939479713136\u0026w=2"
},
{
"name": "4334",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/4334"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phorum.org/changelog.txt"
},
{
"name": "4335",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/4335"
},
{
"name": "phorum-register-xss(15494)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15494"
},
{
"name": "11157",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/11157"
},
{
"name": "1009433",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1009433"
},
{
"name": "4333",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/4333"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2004-03-15T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Phorum 3.1 through 5.0.3 beta allow remote attackers to inject arbitrary web script or HTML via the (1) HTTP_REFERER parameter to login.php, (2) HTTP_REFERER parameter to register.php, or (3) target parameter to profile.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "9882",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/9882"
},
{
"name": "20040315 Phorum 5.0.3 Beta \u0026\u0026 Earlier XSS Issues",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=107939479713136\u0026w=2"
},
{
"name": "4334",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/4334"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phorum.org/changelog.txt"
},
{
"name": "4335",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/4335"
},
{
"name": "phorum-register-xss(15494)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15494"
},
{
"name": "11157",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/11157"
},
{
"name": "1009433",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1009433"
},
{
"name": "4333",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/4333"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2004-1822",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Phorum 3.1 through 5.0.3 beta allow remote attackers to inject arbitrary web script or HTML via the (1) HTTP_REFERER parameter to login.php, (2) HTTP_REFERER parameter to register.php, or (3) target parameter to profile.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "9882",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/9882"
},
{
"name": "20040315 Phorum 5.0.3 Beta \u0026\u0026 Earlier XSS Issues",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=107939479713136\u0026w=2"
},
{
"name": "4334",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/4334"
},
{
"name": "http://phorum.org/changelog.txt",
"refsource": "CONFIRM",
"url": "http://phorum.org/changelog.txt"
},
{
"name": "4335",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/4335"
},
{
"name": "phorum-register-xss(15494)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/15494"
},
{
"name": "11157",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/11157"
},
{
"name": "1009433",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1009433"
},
{
"name": "4333",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/4333"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2004-1822",
"datePublished": "2005-05-10T04:00:00",
"dateReserved": "2005-05-04T00:00:00",
"dateUpdated": "2024-08-08T01:07:48.297Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2008-1486
Vulnerability from cvelistv5
Published
2008-03-24 23:00
Modified
2024-08-07 08:24
Severity ?
EPSS score ?
Summary
SQL injection vulnerability in Phorum before 5.2.6, when mysql_use_ft is disabled, allows remote attackers to execute arbitrary SQL commands via the non-fulltext search.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.phorum.org/phorum5/read.php?64%2C126815%2C126815 | x_refsource_CONFIRM | |
| http://secunia.com/advisories/29519 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/28540 | vdb-entry, x_refsource_BID | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/41418 | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T08:24:42.217Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phorum.org/phorum5/read.php?64%2C126815%2C126815"
},
{
"name": "29519",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/29519"
},
{
"name": "28540",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/28540"
},
{
"name": "phorum-nonfulltext-sql-injection(41418)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41418"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-03-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in Phorum before 5.2.6, when mysql_use_ft is disabled, allows remote attackers to execute arbitrary SQL commands via the non-fulltext search."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-07T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phorum.org/phorum5/read.php?64%2C126815%2C126815"
},
{
"name": "29519",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/29519"
},
{
"name": "28540",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/28540"
},
{
"name": "phorum-nonfulltext-sql-injection(41418)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41418"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-1486",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "SQL injection vulnerability in Phorum before 5.2.6, when mysql_use_ft is disabled, allows remote attackers to execute arbitrary SQL commands via the non-fulltext search."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.phorum.org/phorum5/read.php?64,126815,126815",
"refsource": "CONFIRM",
"url": "http://www.phorum.org/phorum5/read.php?64,126815,126815"
},
{
"name": "29519",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/29519"
},
{
"name": "28540",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/28540"
},
{
"name": "phorum-nonfulltext-sql-injection(41418)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41418"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-1486",
"datePublished": "2008-03-24T23:00:00",
"dateReserved": "2008-03-24T00:00:00",
"dateUpdated": "2024-08-07T08:24:42.217Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2004-2242
Vulnerability from cvelistv5
Published
2005-07-17 04:00
Modified
2024-08-08 01:22
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in search.php in Phorum, possibly 5.0.7 beta and earlier, allows remote attackers to inject arbitrary HTML or web script via the subject parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://securitytracker.com/id?1010787 | vdb-entry, x_refsource_SECTRACK | |
| http://www.securityfocus.com/bid/10822 | vdb-entry, x_refsource_BID | |
| http://phorum.org/cvs-changelog-5.txt | x_refsource_MISC | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/16831 | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T01:22:13.687Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1010787",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1010787"
},
{
"name": "10822",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/10822"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://phorum.org/cvs-changelog-5.txt"
},
{
"name": "phorum-searchphp-xss(16831)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16831"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2004-07-27T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in search.php in Phorum, possibly 5.0.7 beta and earlier, allows remote attackers to inject arbitrary HTML or web script via the subject parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1010787",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1010787"
},
{
"name": "10822",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/10822"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://phorum.org/cvs-changelog-5.txt"
},
{
"name": "phorum-searchphp-xss(16831)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16831"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2004-2242",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in search.php in Phorum, possibly 5.0.7 beta and earlier, allows remote attackers to inject arbitrary HTML or web script via the subject parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1010787",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1010787"
},
{
"name": "10822",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/10822"
},
{
"name": "http://phorum.org/cvs-changelog-5.txt",
"refsource": "MISC",
"url": "http://phorum.org/cvs-changelog-5.txt"
},
{
"name": "phorum-searchphp-xss(16831)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16831"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2004-2242",
"datePublished": "2005-07-17T04:00:00",
"dateReserved": "2005-07-17T00:00:00",
"dateUpdated": "2024-08-08T01:22:13.687Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2004-2240
Vulnerability from cvelistv5
Published
2005-07-17 04:00
Modified
2024-08-08 01:22
Severity ?
EPSS score ?
Summary
Multiple SQL injection vulnerabilities in Phorum 5.0.11 and earlier allow remote attackers to modify SQL statements via (1) the query string in read.php or (2) unknown vectors in file.php.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.maxpatrol.com/mp_advisory.asp | x_refsource_MISC | |
| http://phorum.org/cvs-changelog-5.txt | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/11538 | vdb-entry, x_refsource_BID | |
| http://www.maxpatrol.com/advdetails.asp?id=15 | x_refsource_MISC | |
| http://securitytracker.com/id?1011921 | vdb-entry, x_refsource_SECTRACK | |
| http://www.osvdb.org/11129 | vdb-entry, x_refsource_OSVDB | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/17847 | vdb-entry, x_refsource_XF | |
| http://secunia.com/advisories/12980 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T01:22:13.213Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.maxpatrol.com/mp_advisory.asp"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phorum.org/cvs-changelog-5.txt"
},
{
"name": "11538",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/11538"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.maxpatrol.com/advdetails.asp?id=15"
},
{
"name": "1011921",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1011921"
},
{
"name": "11129",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/11129"
},
{
"name": "phorum-sql-injection(17847)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17847"
},
{
"name": "12980",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/12980"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2004-10-26T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple SQL injection vulnerabilities in Phorum 5.0.11 and earlier allow remote attackers to modify SQL statements via (1) the query string in read.php or (2) unknown vectors in file.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.maxpatrol.com/mp_advisory.asp"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phorum.org/cvs-changelog-5.txt"
},
{
"name": "11538",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/11538"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.maxpatrol.com/advdetails.asp?id=15"
},
{
"name": "1011921",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1011921"
},
{
"name": "11129",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/11129"
},
{
"name": "phorum-sql-injection(17847)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17847"
},
{
"name": "12980",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/12980"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2004-2240",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple SQL injection vulnerabilities in Phorum 5.0.11 and earlier allow remote attackers to modify SQL statements via (1) the query string in read.php or (2) unknown vectors in file.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.maxpatrol.com/mp_advisory.asp",
"refsource": "MISC",
"url": "http://www.maxpatrol.com/mp_advisory.asp"
},
{
"name": "http://phorum.org/cvs-changelog-5.txt",
"refsource": "CONFIRM",
"url": "http://phorum.org/cvs-changelog-5.txt"
},
{
"name": "11538",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/11538"
},
{
"name": "http://www.maxpatrol.com/advdetails.asp?id=15",
"refsource": "MISC",
"url": "http://www.maxpatrol.com/advdetails.asp?id=15"
},
{
"name": "1011921",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1011921"
},
{
"name": "11129",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/11129"
},
{
"name": "phorum-sql-injection(17847)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17847"
},
{
"name": "12980",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/12980"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2004-2240",
"datePublished": "2005-07-17T04:00:00",
"dateReserved": "2005-07-17T00:00:00",
"dateUpdated": "2024-08-08T01:22:13.213Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-2250
Vulnerability from cvelistv5
Published
2007-04-25 16:00
Modified
2024-08-07 13:33
Severity ?
EPSS score ?
Summary
admin.php in Phorum before 5.1.22 allows remote attackers to obtain the full path via the module[] parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.waraxe.us/advisory-49.html | x_refsource_MISC | |
| http://www.phorum.org/story.php?76 | x_refsource_CONFIRM | |
| http://www.securitytracker.com/id?1017936 | vdb-entry, x_refsource_SECTRACK | |
| http://www.vupen.com/english/advisories/2007/1479 | vdb-entry, x_refsource_VUPEN | |
| http://secunia.com/advisories/24932 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/archive/1/466286/100/0/threaded | mailing-list, x_refsource_BUGTRAQ | |
| http://securityreason.com/securityalert/2617 | third-party-advisory, x_refsource_SREASON | |
| http://www.securityfocus.com/bid/23616 | vdb-entry, x_refsource_BID | |
| http://osvdb.org/35060 | vdb-entry, x_refsource_OSVDB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T13:33:28.182Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.waraxe.us/advisory-49.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phorum.org/story.php?76"
},
{
"name": "1017936",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1017936"
},
{
"name": "ADV-2007-1479",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/1479"
},
{
"name": "24932",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/24932"
},
{
"name": "20070419 [waraxe-2007-SA#049] - Multiple vulnerabilities in Phorum 5.1.20",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/466286/100/0/threaded"
},
{
"name": "2617",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/2617"
},
{
"name": "23616",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/23616"
},
{
"name": "35060",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/35060"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-04-17T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "admin.php in Phorum before 5.1.22 allows remote attackers to obtain the full path via the module[] parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-16T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.waraxe.us/advisory-49.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phorum.org/story.php?76"
},
{
"name": "1017936",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1017936"
},
{
"name": "ADV-2007-1479",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/1479"
},
{
"name": "24932",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/24932"
},
{
"name": "20070419 [waraxe-2007-SA#049] - Multiple vulnerabilities in Phorum 5.1.20",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/466286/100/0/threaded"
},
{
"name": "2617",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/2617"
},
{
"name": "23616",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/23616"
},
{
"name": "35060",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/35060"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-2250",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "admin.php in Phorum before 5.1.22 allows remote attackers to obtain the full path via the module[] parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.waraxe.us/advisory-49.html",
"refsource": "MISC",
"url": "http://www.waraxe.us/advisory-49.html"
},
{
"name": "http://www.phorum.org/story.php?76",
"refsource": "CONFIRM",
"url": "http://www.phorum.org/story.php?76"
},
{
"name": "1017936",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1017936"
},
{
"name": "ADV-2007-1479",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/1479"
},
{
"name": "24932",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/24932"
},
{
"name": "20070419 [waraxe-2007-SA#049] - Multiple vulnerabilities in Phorum 5.1.20",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/466286/100/0/threaded"
},
{
"name": "2617",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/2617"
},
{
"name": "23616",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/23616"
},
{
"name": "35060",
"refsource": "OSVDB",
"url": "http://osvdb.org/35060"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-2250",
"datePublished": "2007-04-25T16:00:00",
"dateReserved": "2007-04-25T00:00:00",
"dateUpdated": "2024-08-07T13:33:28.182Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-2836
Vulnerability from cvelistv5
Published
2005-09-07 04:00
Modified
2024-09-16 19:24
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Phorum 5.0.17a and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the username parameter to register.php or (2) a signature of a logged-in user in "My Control Center," which is not properly handled by control.php.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/16667 | third-party-advisory, x_refsource_SECUNIA | |
| http://archives.neohapsis.com/archives/fulldisclosure/2005-09/0018.html | mailing-list, x_refsource_FULLDISC | |
| http://archives.neohapsis.com/archives/fulldisclosure/2005-09/0048.html | mailing-list, x_refsource_FULLDISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T22:45:02.355Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "16667",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/16667"
},
{
"name": "20050901 Multiple Phorum XSS and Session Hijacking vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2005-09/0018.html"
},
{
"name": "20050902 Re: Multiple Phorum XSS and Session Hijacking vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2005-09/0048.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Phorum 5.0.17a and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the username parameter to register.php or (2) a signature of a logged-in user in \"My Control Center,\" which is not properly handled by control.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2005-09-07T04:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "16667",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/16667"
},
{
"name": "20050901 Multiple Phorum XSS and Session Hijacking vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2005-09/0018.html"
},
{
"name": "20050902 Re: Multiple Phorum XSS and Session Hijacking vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2005-09/0048.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-2836",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Phorum 5.0.17a and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the username parameter to register.php or (2) a signature of a logged-in user in \"My Control Center,\" which is not properly handled by control.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "16667",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/16667"
},
{
"name": "20050901 Multiple Phorum XSS and Session Hijacking vulnerabilities",
"refsource": "FULLDISC",
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2005-09/0018.html"
},
{
"name": "20050902 Re: Multiple Phorum XSS and Session Hijacking vulnerabilities",
"refsource": "FULLDISC",
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2005-09/0048.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-2836",
"datePublished": "2005-09-07T04:00:00Z",
"dateReserved": "2005-09-07T00:00:00Z",
"dateUpdated": "2024-09-16T19:24:51.015Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-2338
Vulnerability from cvelistv5
Published
2007-04-27 16:00
Modified
2024-08-07 13:33
Severity ?
EPSS score ?
Summary
Cross-site request forgery (CSRF) vulnerability in include/admin/banlist.php in Phorum before 5.1.22 allows remote attackers to perform unauthorized banlist deletions as an administrator via the delete parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.waraxe.us/advisory-49.html | x_refsource_MISC | |
| http://www.phorum.org/story.php?76 | x_refsource_CONFIRM | |
| http://securitytracker.com/id?1017936 | vdb-entry, x_refsource_SECTRACK | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/34078 | vdb-entry, x_refsource_XF | |
| http://www.vupen.com/english/advisories/2007/1479 | vdb-entry, x_refsource_VUPEN | |
| http://secunia.com/advisories/24932 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/archive/1/466286/100/0/threaded | mailing-list, x_refsource_BUGTRAQ | |
| http://securityreason.com/securityalert/2617 | third-party-advisory, x_refsource_SREASON | |
| http://www.securityfocus.com/bid/23616 | vdb-entry, x_refsource_BID | |
| http://osvdb.org/35061 | vdb-entry, x_refsource_OSVDB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T13:33:28.631Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.waraxe.us/advisory-49.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phorum.org/story.php?76"
},
{
"name": "1017936",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1017936"
},
{
"name": "phorum-banlist-csrf(34078)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34078"
},
{
"name": "ADV-2007-1479",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/1479"
},
{
"name": "24932",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/24932"
},
{
"name": "20070419 [waraxe-2007-SA#049] - Multiple vulnerabilities in Phorum 5.1.20",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/466286/100/0/threaded"
},
{
"name": "2617",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/2617"
},
{
"name": "23616",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/23616"
},
{
"name": "35061",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/35061"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-04-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability in include/admin/banlist.php in Phorum before 5.1.22 allows remote attackers to perform unauthorized banlist deletions as an administrator via the delete parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-16T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.waraxe.us/advisory-49.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phorum.org/story.php?76"
},
{
"name": "1017936",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1017936"
},
{
"name": "phorum-banlist-csrf(34078)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34078"
},
{
"name": "ADV-2007-1479",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/1479"
},
{
"name": "24932",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/24932"
},
{
"name": "20070419 [waraxe-2007-SA#049] - Multiple vulnerabilities in Phorum 5.1.20",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/466286/100/0/threaded"
},
{
"name": "2617",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/2617"
},
{
"name": "23616",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/23616"
},
{
"name": "35061",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/35061"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-2338",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site request forgery (CSRF) vulnerability in include/admin/banlist.php in Phorum before 5.1.22 allows remote attackers to perform unauthorized banlist deletions as an administrator via the delete parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.waraxe.us/advisory-49.html",
"refsource": "MISC",
"url": "http://www.waraxe.us/advisory-49.html"
},
{
"name": "http://www.phorum.org/story.php?76",
"refsource": "CONFIRM",
"url": "http://www.phorum.org/story.php?76"
},
{
"name": "1017936",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1017936"
},
{
"name": "phorum-banlist-csrf(34078)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34078"
},
{
"name": "ADV-2007-1479",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/1479"
},
{
"name": "24932",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/24932"
},
{
"name": "20070419 [waraxe-2007-SA#049] - Multiple vulnerabilities in Phorum 5.1.20",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/466286/100/0/threaded"
},
{
"name": "2617",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/2617"
},
{
"name": "23616",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/23616"
},
{
"name": "35061",
"refsource": "OSVDB",
"url": "http://osvdb.org/35061"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-2338",
"datePublished": "2007-04-27T16:00:00",
"dateReserved": "2007-04-27T00:00:00",
"dateUpdated": "2024-08-07T13:33:28.631Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2012-6659
Vulnerability from cvelistv5
Published
2014-09-19 14:00
Modified
2024-09-17 04:19
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the admin interface in Phorum before 5.2.19 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/50445 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.phorum.org/phorum5/read.php?64%2C151943 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T21:36:02.048Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "50445",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/50445"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phorum.org/phorum5/read.php?64%2C151943"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the admin interface in Phorum before 5.2.19 allows remote attackers to inject arbitrary web script or HTML via a crafted URL."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-09-19T14:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "50445",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/50445"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phorum.org/phorum5/read.php?64%2C151943"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-6659",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the admin interface in Phorum before 5.2.19 allows remote attackers to inject arbitrary web script or HTML via a crafted URL."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "50445",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/50445"
},
{
"name": "http://www.phorum.org/phorum5/read.php?64,151943",
"refsource": "CONFIRM",
"url": "http://www.phorum.org/phorum5/read.php?64,151943"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-6659",
"datePublished": "2014-09-19T14:00:00Z",
"dateReserved": "2014-09-19T00:00:00Z",
"dateUpdated": "2024-09-17T04:19:39.204Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-3543
Vulnerability from cvelistv5
Published
2005-11-16 07:37
Modified
2024-08-07 23:17
Severity ?
EPSS score ?
Summary
SQL injection vulnerability in search.php in Phorum 5.0.0alpha through 5.0.20, when register_globals is enabled, allows remote attackers to execute arbitrary SQL commands via the forum_ids parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.waraxe.us/advisory-43.html | x_refsource_MISC | |
| http://secunia.com/advisories/17456 | third-party-advisory, x_refsource_SECUNIA | |
| http://marc.info/?l=bugtraq&m=113122911424216&w=2 | mailing-list, x_refsource_BUGTRAQ | |
| http://securityreason.com/securityalert/153 | third-party-advisory, x_refsource_SREASON | |
| http://www.vupen.com/english/advisories/2005/2332 | vdb-entry, x_refsource_VUPEN | |
| http://www.osvdb.org/20524 | vdb-entry, x_refsource_OSVDB | |
| http://phorum.org/story.php?57 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T23:17:23.370Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.waraxe.us/advisory-43.html"
},
{
"name": "17456",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/17456"
},
{
"name": "20051104 [waraxe-2005-SA#043] - Sql injection in Phorum 5.0.20 and earlier",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=113122911424216\u0026w=2"
},
{
"name": "153",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/153"
},
{
"name": "ADV-2005-2332",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2005/2332"
},
{
"name": "20524",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/20524"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phorum.org/story.php?57"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-11-07T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in search.php in Phorum 5.0.0alpha through 5.0.20, when register_globals is enabled, allows remote attackers to execute arbitrary SQL commands via the forum_ids parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-10-17T13:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.waraxe.us/advisory-43.html"
},
{
"name": "17456",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/17456"
},
{
"name": "20051104 [waraxe-2005-SA#043] - Sql injection in Phorum 5.0.20 and earlier",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=113122911424216\u0026w=2"
},
{
"name": "153",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/153"
},
{
"name": "ADV-2005-2332",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2005/2332"
},
{
"name": "20524",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/20524"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phorum.org/story.php?57"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-3543",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "SQL injection vulnerability in search.php in Phorum 5.0.0alpha through 5.0.20, when register_globals is enabled, allows remote attackers to execute arbitrary SQL commands via the forum_ids parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.waraxe.us/advisory-43.html",
"refsource": "MISC",
"url": "http://www.waraxe.us/advisory-43.html"
},
{
"name": "17456",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/17456"
},
{
"name": "20051104 [waraxe-2005-SA#043] - Sql injection in Phorum 5.0.20 and earlier",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=113122911424216\u0026w=2"
},
{
"name": "153",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/153"
},
{
"name": "ADV-2005-2332",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2005/2332"
},
{
"name": "20524",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/20524"
},
{
"name": "http://phorum.org/story.php?57",
"refsource": "CONFIRM",
"url": "http://phorum.org/story.php?57"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-3543",
"datePublished": "2005-11-16T07:37:00",
"dateReserved": "2005-11-16T00:00:00",
"dateUpdated": "2024-08-07T23:17:23.370Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2000-1229
Vulnerability from cvelistv5
Published
2005-07-14 04:00
Modified
2024-09-16 17:08
Severity ?
EPSS score ?
Summary
Directory traversal vulnerability in Phorum 3.0.7 allows remote Phorum administrators to read arbitrary files via ".." (dot dot) sequences in the default .langfile name field in the Master Settings administrative function, which causes the file to be displayed in admin.php3.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm | x_refsource_MISC | |
| http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html | mailing-list, x_refsource_BUGTRAQ | |
| http://hispahack.ccc.de/mi020.html | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T05:45:37.416Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm"
},
{
"name": "20000106 Phorum 3.0.7 exploits and IDS signatures",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://hispahack.ccc.de/mi020.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in Phorum 3.0.7 allows remote Phorum administrators to read arbitrary files via \"..\" (dot dot) sequences in the default .langfile name field in the Master Settings administrative function, which causes the file to be displayed in admin.php3."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2005-07-14T04:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm"
},
{
"name": "20000106 Phorum 3.0.7 exploits and IDS signatures",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://hispahack.ccc.de/mi020.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2000-1229",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Directory traversal vulnerability in Phorum 3.0.7 allows remote Phorum administrators to read arbitrary files via \"..\" (dot dot) sequences in the default .langfile name field in the Master Settings administrative function, which causes the file to be displayed in admin.php3."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm",
"refsource": "MISC",
"url": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm"
},
{
"name": "20000106 Phorum 3.0.7 exploits and IDS signatures",
"refsource": "BUGTRAQ",
"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html"
},
{
"name": "http://hispahack.ccc.de/mi020.html",
"refsource": "MISC",
"url": "http://hispahack.ccc.de/mi020.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2000-1229",
"datePublished": "2005-07-14T04:00:00Z",
"dateReserved": "2005-07-14T00:00:00Z",
"dateUpdated": "2024-09-16T17:08:11.598Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2011-3381
Vulnerability from cvelistv5
Published
2011-09-08 18:00
Modified
2024-09-16 22:25
Severity ?
EPSS score ?
Summary
Cross-site request forgery (CSRF) vulnerability in Phorum before 5.2.16 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
References
| ▼ | URL | Tags |
|---|---|---|
| http://jvn.jp/en/jp/JVN71435255/index.html | third-party-advisory, x_refsource_JVN | |
| http://www.phorum.org/phorum5/read.php?64%2C147504 | x_refsource_MISC | |
| http://jvndb.jvn.jp/jvndb/JVNDB-2011-000068 | third-party-advisory, x_refsource_JVNDB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T23:29:56.874Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "JVN#71435255",
"tags": [
"third-party-advisory",
"x_refsource_JVN",
"x_transferred"
],
"url": "http://jvn.jp/en/jp/JVN71435255/index.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.phorum.org/phorum5/read.php?64%2C147504"
},
{
"name": "JVNDB-2011-000068",
"tags": [
"third-party-advisory",
"x_refsource_JVNDB",
"x_transferred"
],
"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2011-000068"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability in Phorum before 5.2.16 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2011-09-08T18:00:00Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"name": "JVN#71435255",
"tags": [
"third-party-advisory",
"x_refsource_JVN"
],
"url": "http://jvn.jp/en/jp/JVN71435255/index.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.phorum.org/phorum5/read.php?64%2C147504"
},
{
"name": "JVNDB-2011-000068",
"tags": [
"third-party-advisory",
"x_refsource_JVNDB"
],
"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2011-000068"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vultures@jpcert.or.jp",
"ID": "CVE-2011-3381",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site request forgery (CSRF) vulnerability in Phorum before 5.2.16 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "JVN#71435255",
"refsource": "JVN",
"url": "http://jvn.jp/en/jp/JVN71435255/index.html"
},
{
"name": "http://www.phorum.org/phorum5/read.php?64,147504",
"refsource": "MISC",
"url": "http://www.phorum.org/phorum5/read.php?64,147504"
},
{
"name": "JVNDB-2011-000068",
"refsource": "JVNDB",
"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2011-000068"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2011-3381",
"datePublished": "2011-09-08T18:00:00Z",
"dateReserved": "2011-09-01T00:00:00Z",
"dateUpdated": "2024-09-16T22:25:05.584Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2000-1230
Vulnerability from cvelistv5
Published
2005-07-14 04:00
Modified
2024-09-16 17:42
Severity ?
EPSS score ?
Summary
Backdoor in auth.php3 in Phorum 3.0.7 allows remote attackers to access restricted web pages via an HTTP request with the PHP_AUTH_USER parameter set to "boogieman".
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm | x_refsource_MISC | |
| http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html | mailing-list, x_refsource_BUGTRAQ | |
| http://www.securityfocus.com/bid/2274 | vdb-entry, x_refsource_BID | |
| http://hispahack.ccc.de/mi020.html | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T05:45:37.383Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm"
},
{
"name": "20000106 Phorum 3.0.7 exploits and IDS signatures",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html"
},
{
"name": "2274",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/2274"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://hispahack.ccc.de/mi020.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Backdoor in auth.php3 in Phorum 3.0.7 allows remote attackers to access restricted web pages via an HTTP request with the PHP_AUTH_USER parameter set to \"boogieman\"."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2005-07-14T04:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm"
},
{
"name": "20000106 Phorum 3.0.7 exploits and IDS signatures",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html"
},
{
"name": "2274",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/2274"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://hispahack.ccc.de/mi020.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2000-1230",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Backdoor in auth.php3 in Phorum 3.0.7 allows remote attackers to access restricted web pages via an HTTP request with the PHP_AUTH_USER parameter set to \"boogieman\"."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm",
"refsource": "MISC",
"url": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm"
},
{
"name": "20000106 Phorum 3.0.7 exploits and IDS signatures",
"refsource": "BUGTRAQ",
"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html"
},
{
"name": "2274",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/2274"
},
{
"name": "http://hispahack.ccc.de/mi020.html",
"refsource": "MISC",
"url": "http://hispahack.ccc.de/mi020.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2000-1230",
"datePublished": "2005-07-14T04:00:00Z",
"dateReserved": "2005-07-14T00:00:00Z",
"dateUpdated": "2024-09-16T17:42:49.390Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-0783
Vulnerability from cvelistv5
Published
2005-03-20 05:00
Modified
2024-08-07 21:28
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in Phorum before 5.0.14a allows remote attackers to inject arbitrary web script or HTML via the filename of an attached file.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/12800 | vdb-entry, x_refsource_BID | |
| http://secunia.com/advisories/14554 | third-party-advisory, x_refsource_SECUNIA | |
| http://marc.info/?l=bugtraq&m=111083279031544&w=2 | mailing-list, x_refsource_BUGTRAQ |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T21:28:27.141Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "12800",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/12800"
},
{
"name": "14554",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/14554"
},
{
"name": "20050313 3 XSS Vulnerabilities in Phorum \u003c= 5.0.14",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=111083279031544\u0026w=2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-03-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Phorum before 5.0.14a allows remote attackers to inject arbitrary web script or HTML via the filename of an attached file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-10-17T13:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "12800",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/12800"
},
{
"name": "14554",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/14554"
},
{
"name": "20050313 3 XSS Vulnerabilities in Phorum \u003c= 5.0.14",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=111083279031544\u0026w=2"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-0783",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Phorum before 5.0.14a allows remote attackers to inject arbitrary web script or HTML via the filename of an attached file."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "12800",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/12800"
},
{
"name": "14554",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/14554"
},
{
"name": "20050313 3 XSS Vulnerabilities in Phorum \u003c= 5.0.14",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=111083279031544\u0026w=2"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-0783",
"datePublished": "2005-03-20T05:00:00",
"dateReserved": "2005-03-20T00:00:00",
"dateUpdated": "2024-08-07T21:28:27.141Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2009-0488
Vulnerability from cvelistv5
Published
2009-02-09 20:00
Modified
2024-08-07 04:40
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in Phorum before 5.2.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/33657 | vdb-entry, x_refsource_BID | |
| http://www.phorum.org/phorum5/read.php?64%2C136129 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T04:40:03.488Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "33657",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/33657"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phorum.org/phorum5/read.php?64%2C136129"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2009-01-25T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Phorum before 5.2.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2009-02-17T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "33657",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/33657"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phorum.org/phorum5/read.php?64%2C136129"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2009-0488",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Phorum before 5.2.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "33657",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/33657"
},
{
"name": "http://www.phorum.org/phorum5/read.php?64,136129",
"refsource": "CONFIRM",
"url": "http://www.phorum.org/phorum5/read.php?64,136129"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2009-0488",
"datePublished": "2009-02-09T20:00:00",
"dateReserved": "2009-02-09T00:00:00",
"dateUpdated": "2024-08-07T04:40:03.488Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2000-1234
Vulnerability from cvelistv5
Published
2005-07-14 04:00
Modified
2024-09-16 19:50
Severity ?
EPSS score ?
Summary
violation.php3 in Phorum 3.0.7 allows remote attackers to send e-mails to arbitrary addresses and possibly use Phorum as a "spam proxy" by setting the Mod and ForumName parameters.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/2272 | vdb-entry, x_refsource_BID | |
| http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm | x_refsource_MISC | |
| http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html | mailing-list, x_refsource_BUGTRAQ | |
| http://hispahack.ccc.de/mi020.html | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T05:45:37.397Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "2272",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/2272"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm"
},
{
"name": "20000106 Phorum 3.0.7 exploits and IDS signatures",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://hispahack.ccc.de/mi020.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "violation.php3 in Phorum 3.0.7 allows remote attackers to send e-mails to arbitrary addresses and possibly use Phorum as a \"spam proxy\" by setting the Mod and ForumName parameters."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2005-07-14T04:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "2272",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/2272"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm"
},
{
"name": "20000106 Phorum 3.0.7 exploits and IDS signatures",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://hispahack.ccc.de/mi020.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2000-1234",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "violation.php3 in Phorum 3.0.7 allows remote attackers to send e-mails to arbitrary addresses and possibly use Phorum as a \"spam proxy\" by setting the Mod and ForumName parameters."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "2272",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/2272"
},
{
"name": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm",
"refsource": "MISC",
"url": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm"
},
{
"name": "20000106 Phorum 3.0.7 exploits and IDS signatures",
"refsource": "BUGTRAQ",
"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html"
},
{
"name": "http://hispahack.ccc.de/mi020.html",
"refsource": "MISC",
"url": "http://hispahack.ccc.de/mi020.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2000-1234",
"datePublished": "2005-07-14T04:00:00Z",
"dateReserved": "2005-07-14T00:00:00Z",
"dateUpdated": "2024-09-16T19:50:41.164Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2011-3382
Vulnerability from cvelistv5
Published
2011-09-08 18:00
Modified
2024-09-16 22:20
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in Phorum before 5.2.16 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
| ▼ | URL | Tags |
|---|---|---|
| http://jvn.jp/en/jp/JVN71435255/index.html | third-party-advisory, x_refsource_JVN | |
| http://www.phorum.org/phorum5/read.php?64%2C147504 | x_refsource_MISC | |
| http://jvndb.jvn.jp/jvndb/JVNDB-2011-000068 | third-party-advisory, x_refsource_JVNDB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T23:29:56.880Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "JVN#71435255",
"tags": [
"third-party-advisory",
"x_refsource_JVN",
"x_transferred"
],
"url": "http://jvn.jp/en/jp/JVN71435255/index.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.phorum.org/phorum5/read.php?64%2C147504"
},
{
"name": "JVNDB-2011-000068",
"tags": [
"third-party-advisory",
"x_refsource_JVNDB",
"x_transferred"
],
"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2011-000068"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Phorum before 5.2.16 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2011-09-08T18:00:00Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"name": "JVN#71435255",
"tags": [
"third-party-advisory",
"x_refsource_JVN"
],
"url": "http://jvn.jp/en/jp/JVN71435255/index.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.phorum.org/phorum5/read.php?64%2C147504"
},
{
"name": "JVNDB-2011-000068",
"tags": [
"third-party-advisory",
"x_refsource_JVNDB"
],
"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2011-000068"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vultures@jpcert.or.jp",
"ID": "CVE-2011-3382",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Phorum before 5.2.16 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "JVN#71435255",
"refsource": "JVN",
"url": "http://jvn.jp/en/jp/JVN71435255/index.html"
},
{
"name": "http://www.phorum.org/phorum5/read.php?64,147504",
"refsource": "MISC",
"url": "http://www.phorum.org/phorum5/read.php?64,147504"
},
{
"name": "JVNDB-2011-000068",
"refsource": "JVNDB",
"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2011-000068"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2011-3382",
"datePublished": "2011-09-08T18:00:00Z",
"dateReserved": "2011-09-01T00:00:00Z",
"dateUpdated": "2024-09-16T22:20:49.793Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2000-1228
Vulnerability from cvelistv5
Published
2005-07-14 04:00
Modified
2024-08-08 05:45
Severity ?
EPSS score ?
Summary
Phorum 3.0.7 allows remote attackers to change the administrator password without authentication via an HTTP request for admin.php3 that sets step, option, confirm and newPssword variables.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/2271 | vdb-entry, x_refsource_BID | |
| http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html | mailing-list, x_refsource_BUGTRAQ | |
| http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm | x_refsource_MISC | |
| http://hispahack.ccc.de/mi020.html | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T05:45:37.432Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "2271",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/2271"
},
{
"name": "20000106 Phorum 3.0.7 exploits and IDS signatures",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://hispahack.ccc.de/mi020.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2000-01-06T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Phorum 3.0.7 allows remote attackers to change the administrator password without authentication via an HTTP request for admin.php3 that sets step, option, confirm and newPssword variables."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-15T16:40:36",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "2271",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/2271"
},
{
"name": "20000106 Phorum 3.0.7 exploits and IDS signatures",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://hispahack.ccc.de/mi020.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2000-1228",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Phorum 3.0.7 allows remote attackers to change the administrator password without authentication via an HTTP request for admin.php3 that sets step, option, confirm and newPssword variables."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "2271",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/2271"
},
{
"name": "20000106 Phorum 3.0.7 exploits and IDS signatures",
"refsource": "BUGTRAQ",
"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html"
},
{
"name": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm",
"refsource": "MISC",
"url": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm"
},
{
"name": "http://hispahack.ccc.de/mi020.html",
"refsource": "MISC",
"url": "http://hispahack.ccc.de/mi020.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2000-1228",
"datePublished": "2005-07-14T04:00:00",
"dateReserved": "2005-07-14T00:00:00",
"dateUpdated": "2024-08-08T05:45:37.432Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2004-2243
Vulnerability from cvelistv5
Published
2005-07-17 04:00
Modified
2024-08-08 01:22
Severity ?
EPSS score ?
Summary
Phorum allows remote attackers to hijack sessions of other users by stealing and replaying the session hash in the phorum_uriauth parameter, as demonstrated using profile.php. NOTE: the affected version was reported to be 4.3.7, but this may be erroneous.
References
| ▼ | URL | Tags |
|---|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/16215 | vdb-entry, x_refsource_XF | |
| http://archives.neohapsis.com/archives/fulldisclosure/2004-05/0999.html | mailing-list, x_refsource_FULLDISC | |
| http://securitytracker.com/id?1010219 | vdb-entry, x_refsource_SECTRACK |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T01:22:12.431Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "phorum-session-hijack(16215)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16215"
},
{
"name": "20040519 Ph0rum phorum_uriauth replay attack",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2004-05/0999.html"
},
{
"name": "1010219",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1010219"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2004-05-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Phorum allows remote attackers to hijack sessions of other users by stealing and replaying the session hash in the phorum_uriauth parameter, as demonstrated using profile.php. NOTE: the affected version was reported to be 4.3.7, but this may be erroneous."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "phorum-session-hijack(16215)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16215"
},
{
"name": "20040519 Ph0rum phorum_uriauth replay attack",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2004-05/0999.html"
},
{
"name": "1010219",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1010219"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2004-2243",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Phorum allows remote attackers to hijack sessions of other users by stealing and replaying the session hash in the phorum_uriauth parameter, as demonstrated using profile.php. NOTE: the affected version was reported to be 4.3.7, but this may be erroneous."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "phorum-session-hijack(16215)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16215"
},
{
"name": "20040519 Ph0rum phorum_uriauth replay attack",
"refsource": "FULLDISC",
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2004-05/0999.html"
},
{
"name": "1010219",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1010219"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2004-2243",
"datePublished": "2005-07-17T04:00:00",
"dateReserved": "2005-07-17T00:00:00",
"dateUpdated": "2024-08-08T01:22:12.431Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2012-4234
Vulnerability from cvelistv5
Published
2014-09-04 14:00
Modified
2024-08-06 20:28
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the group moderation screen in the control center (control.php) in Phorum before 5.2.19 allows remote attackers to inject arbitrary web script or HTML via the group parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://archives.neohapsis.com/archives/bugtraq/2012-08/0189.html | mailing-list, x_refsource_BUGTRAQ | |
| https://www.htbridge.com/advisory/HTB23109 | x_refsource_MISC | |
| http://secunia.com/advisories/50445 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/bid/55275 | vdb-entry, x_refsource_BID | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/78124 | vdb-entry, x_refsource_XF | |
| http://packetstormsecurity.org/files/116057/Phorum-5.2.18-Cross-Site-Scripting.html | x_refsource_MISC | |
| http://www.phorum.org/phorum5/read.php?64%2C151943 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T20:28:07.741Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20120829 Cross-Site Scripting (XSS) in Phorum",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2012-08/0189.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.htbridge.com/advisory/HTB23109"
},
{
"name": "50445",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/50445"
},
{
"name": "55275",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/55275"
},
{
"name": "phorum-group-xss(78124)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78124"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.org/files/116057/Phorum-5.2.18-Cross-Site-Scripting.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phorum.org/phorum5/read.php?64%2C151943"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-08-08T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the group moderation screen in the control center (control.php) in Phorum before 5.2.19 allows remote attackers to inject arbitrary web script or HTML via the group parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20120829 Cross-Site Scripting (XSS) in Phorum",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2012-08/0189.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.htbridge.com/advisory/HTB23109"
},
{
"name": "50445",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/50445"
},
{
"name": "55275",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/55275"
},
{
"name": "phorum-group-xss(78124)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78124"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.org/files/116057/Phorum-5.2.18-Cross-Site-Scripting.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phorum.org/phorum5/read.php?64%2C151943"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-4234",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the group moderation screen in the control center (control.php) in Phorum before 5.2.19 allows remote attackers to inject arbitrary web script or HTML via the group parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20120829 Cross-Site Scripting (XSS) in Phorum",
"refsource": "BUGTRAQ",
"url": "http://archives.neohapsis.com/archives/bugtraq/2012-08/0189.html"
},
{
"name": "https://www.htbridge.com/advisory/HTB23109",
"refsource": "MISC",
"url": "https://www.htbridge.com/advisory/HTB23109"
},
{
"name": "50445",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/50445"
},
{
"name": "55275",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/55275"
},
{
"name": "phorum-group-xss(78124)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78124"
},
{
"name": "http://packetstormsecurity.org/files/116057/Phorum-5.2.18-Cross-Site-Scripting.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.org/files/116057/Phorum-5.2.18-Cross-Site-Scripting.html"
},
{
"name": "http://www.phorum.org/phorum5/read.php?64,151943",
"refsource": "CONFIRM",
"url": "http://www.phorum.org/phorum5/read.php?64,151943"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-4234",
"datePublished": "2014-09-04T14:00:00",
"dateReserved": "2012-08-09T00:00:00",
"dateUpdated": "2024-08-06T20:28:07.741Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-3249
Vulnerability from cvelistv5
Published
2006-06-27 10:00
Modified
2024-08-07 18:23
Severity ?
EPSS score ?
Summary
SQL injection vulnerability in search.php in Phorum 5.1.14 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter. NOTE: the vendor has disputed this report, stating "If a non positive integer or non-integer is used for the page parameter for a search URL, the search query will use a negative number for the LIMIT clause. This causes the query to break, showing no results. It IS NOT however a sql injection error." While the original report is from a researcher with mixed accuracy, as of 20060703, CVE does not have any additional information regarding this issue
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.phorum.org/phorum5/read.php?14%2C114358 | x_refsource_MISC | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/27369 | vdb-entry, x_refsource_XF | |
| http://www.phorum.org/cgi-bin/trac.cgi/ticket/382#preview | x_refsource_MISC | |
| http://www.osvdb.org/27165 | vdb-entry, x_refsource_OSVDB | |
| http://pridels0.blogspot.com/2006/06/phorum-sql-injection-vuln.html | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T18:23:20.665Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.phorum.org/phorum5/read.php?14%2C114358"
},
{
"name": "phorum-search-page-sql-injection(27369)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27369"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.phorum.org/cgi-bin/trac.cgi/ticket/382#preview"
},
{
"name": "27165",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/27165"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://pridels0.blogspot.com/2006/06/phorum-sql-injection-vuln.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-06-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in search.php in Phorum 5.1.14 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter. NOTE: the vendor has disputed this report, stating \"If a non positive integer or non-integer is used for the page parameter for a search URL, the search query will use a negative number for the LIMIT clause. This causes the query to break, showing no results. It IS NOT however a sql injection error.\" While the original report is from a researcher with mixed accuracy, as of 20060703, CVE does not have any additional information regarding this issue"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-19T15:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.phorum.org/phorum5/read.php?14%2C114358"
},
{
"name": "phorum-search-page-sql-injection(27369)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27369"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.phorum.org/cgi-bin/trac.cgi/ticket/382#preview"
},
{
"name": "27165",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/27165"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://pridels0.blogspot.com/2006/06/phorum-sql-injection-vuln.html"
}
],
"tags": [
"disputed"
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-3249",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** DISPUTED ** SQL injection vulnerability in search.php in Phorum 5.1.14 and earlier allows remote attackers to execute arbitrary SQL commands via the page parameter. NOTE: the vendor has disputed this report, stating \"If a non positive integer or non-integer is used for the page parameter for a search URL, the search query will use a negative number for the LIMIT clause. This causes the query to break, showing no results. It IS NOT however a sql injection error.\" While the original report is from a researcher with mixed accuracy, as of 20060703, CVE does not have any additional information regarding this issue."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.phorum.org/phorum5/read.php?14,114358",
"refsource": "MISC",
"url": "http://www.phorum.org/phorum5/read.php?14,114358"
},
{
"name": "phorum-search-page-sql-injection(27369)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27369"
},
{
"name": "http://www.phorum.org/cgi-bin/trac.cgi/ticket/382#preview",
"refsource": "MISC",
"url": "http://www.phorum.org/cgi-bin/trac.cgi/ticket/382#preview"
},
{
"name": "27165",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/27165"
},
{
"name": "http://pridels0.blogspot.com/2006/06/phorum-sql-injection-vuln.html",
"refsource": "MISC",
"url": "http://pridels0.blogspot.com/2006/06/phorum-sql-injection-vuln.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-3249",
"datePublished": "2006-06-27T10:00:00",
"dateReserved": "2006-06-26T00:00:00",
"dateUpdated": "2024-08-07T18:23:20.665Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-3612
Vulnerability from cvelistv5
Published
2006-07-14 21:00
Modified
2024-09-16 21:04
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in Phorum 5.1.14 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.phorum.org/phorum5/read.php?14%2C114358 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T18:39:52.539Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phorum.org/phorum5/read.php?14%2C114358"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Phorum 5.1.14 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2006-07-14T21:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phorum.org/phorum5/read.php?14%2C114358"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-3612",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Phorum 5.1.14 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.phorum.org/phorum5/read.php?14,114358",
"refsource": "CONFIRM",
"url": "http://www.phorum.org/phorum5/read.php?14,114358"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-3612",
"datePublished": "2006-07-14T21:00:00Z",
"dateReserved": "2006-07-14T00:00:00Z",
"dateUpdated": "2024-09-16T21:04:30.905Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-0767
Vulnerability from cvelistv5
Published
2007-02-06 02:00
Modified
2024-08-07 12:34
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the core in Phorum before 5.1.18 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.vupen.com/english/advisories/2007/0410 | vdb-entry, x_refsource_VUPEN | |
| http://osvdb.org/34727 | vdb-entry, x_refsource_OSVDB | |
| http://www.phorum.org/phorum5/read.php?12%2C119757 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/44201 | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T12:34:19.790Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ADV-2007-0410",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/0410"
},
{
"name": "34727",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/34727"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phorum.org/phorum5/read.php?12%2C119757"
},
{
"name": "phorum-core-xss(44201)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44201"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-01-26T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the core in Phorum before 5.1.18 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "ADV-2007-0410",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/0410"
},
{
"name": "34727",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/34727"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phorum.org/phorum5/read.php?12%2C119757"
},
{
"name": "phorum-core-xss(44201)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44201"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-0767",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the core in Phorum before 5.1.18 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "ADV-2007-0410",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/0410"
},
{
"name": "34727",
"refsource": "OSVDB",
"url": "http://osvdb.org/34727"
},
{
"name": "http://www.phorum.org/phorum5/read.php?12,119757",
"refsource": "CONFIRM",
"url": "http://www.phorum.org/phorum5/read.php?12,119757"
},
{
"name": "phorum-core-xss(44201)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44201"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-0767",
"datePublished": "2007-02-06T02:00:00",
"dateReserved": "2007-02-05T00:00:00",
"dateUpdated": "2024-08-07T12:34:19.790Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2004-1518
Vulnerability from cvelistv5
Published
2005-02-19 05:00
Modified
2024-08-08 00:53
Severity ?
EPSS score ?
Summary
SQL injection vulnerability in follow.php in Phorum 5.0.12 and earlier allows remote authenticated users to execute arbitrary SQL command via the forum_id parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://secunia.com/advisories/13174 | third-party-advisory, x_refsource_SECUNIA | |
| http://lists.grok.org.uk/pipermail/full-disclosure/2004-November/028609.html | mailing-list, x_refsource_FULLDISC | |
| http://marc.info/?l=bugtraq&m=110021385926870&w=2 | mailing-list, x_refsource_BUGTRAQ | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/18045 | vdb-entry, x_refsource_XF | |
| http://www.securityfocus.com/bid/11660 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T00:53:24.112Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "13174",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/13174"
},
{
"name": "20041111 [waraxe-2004-SA#037 - Sql injection bug in Phorum 5.0.12 and older versions]",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2004-November/028609.html"
},
{
"name": "20041111 [waraxe-2004-SA#037 - Sql injection bug in Phorum 5.0.12 and older versions]",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=110021385926870\u0026w=2"
},
{
"name": "phorum-followphp-sql-injection(18045)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/18045"
},
{
"name": "11660",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/11660"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2004-11-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in follow.php in Phorum 5.0.12 and earlier allows remote authenticated users to execute arbitrary SQL command via the forum_id parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "13174",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/13174"
},
{
"name": "20041111 [waraxe-2004-SA#037 - Sql injection bug in Phorum 5.0.12 and older versions]",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2004-November/028609.html"
},
{
"name": "20041111 [waraxe-2004-SA#037 - Sql injection bug in Phorum 5.0.12 and older versions]",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=110021385926870\u0026w=2"
},
{
"name": "phorum-followphp-sql-injection(18045)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/18045"
},
{
"name": "11660",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/11660"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2004-1518",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "SQL injection vulnerability in follow.php in Phorum 5.0.12 and earlier allows remote authenticated users to execute arbitrary SQL command via the forum_id parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "13174",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/13174"
},
{
"name": "20041111 [waraxe-2004-SA#037 - Sql injection bug in Phorum 5.0.12 and older versions]",
"refsource": "FULLDISC",
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2004-November/028609.html"
},
{
"name": "20041111 [waraxe-2004-SA#037 - Sql injection bug in Phorum 5.0.12 and older versions]",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=110021385926870\u0026w=2"
},
{
"name": "phorum-followphp-sql-injection(18045)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/18045"
},
{
"name": "11660",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/11660"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2004-1518",
"datePublished": "2005-02-19T05:00:00",
"dateReserved": "2005-02-18T00:00:00",
"dateUpdated": "2024-08-08T00:53:24.112Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2011-4561
Vulnerability from cvelistv5
Published
2011-11-28 21:00
Modified
2024-08-07 00:09
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in admin.php in Phorum 5.2.18 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to admin/index.php. NOTE: some of these details are obtained from third party information.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/49920 | vdb-entry, x_refsource_BID | |
| http://osvdb.org/76026 | vdb-entry, x_refsource_OSVDB | |
| http://www.rul3z.de/advisories/SSCHADV2011-023.txt | x_refsource_MISC | |
| http://www.securityfocus.com/archive/1/519991/100/0/threaded | mailing-list, x_refsource_BUGTRAQ | |
| http://secunia.com/advisories/46282 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T00:09:18.944Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "49920",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/49920"
},
{
"name": "76026",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/76026"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.rul3z.de/advisories/SSCHADV2011-023.txt"
},
{
"name": "20111003 Phorum 5.2.18 Cross-site scripting vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/519991/100/0/threaded"
},
{
"name": "46282",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/46282"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-10-03T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in admin.php in Phorum 5.2.18 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to admin/index.php. NOTE: some of these details are obtained from third party information."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-09T18:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "49920",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/49920"
},
{
"name": "76026",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/76026"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.rul3z.de/advisories/SSCHADV2011-023.txt"
},
{
"name": "20111003 Phorum 5.2.18 Cross-site scripting vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/519991/100/0/threaded"
},
{
"name": "46282",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/46282"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-4561",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in admin.php in Phorum 5.2.18 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to admin/index.php. NOTE: some of these details are obtained from third party information."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "49920",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/49920"
},
{
"name": "76026",
"refsource": "OSVDB",
"url": "http://osvdb.org/76026"
},
{
"name": "http://www.rul3z.de/advisories/SSCHADV2011-023.txt",
"refsource": "MISC",
"url": "http://www.rul3z.de/advisories/SSCHADV2011-023.txt"
},
{
"name": "20111003 Phorum 5.2.18 Cross-site scripting vulnerability",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/519991/100/0/threaded"
},
{
"name": "46282",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/46282"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-4561",
"datePublished": "2011-11-28T21:00:00",
"dateReserved": "2011-11-28T00:00:00",
"dateUpdated": "2024-08-07T00:09:18.944Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-0784
Vulnerability from cvelistv5
Published
2005-03-20 05:00
Modified
2024-08-07 21:28
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Phorum before 5.0.15 allow remote attackers to inject arbitrary web script or HTML via (1) the subject line to follow.php or (2) the subject line in the user's personal control panel.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/12800 | vdb-entry, x_refsource_BID | |
| http://secunia.com/advisories/14554 | third-party-advisory, x_refsource_SECUNIA | |
| http://marc.info/?l=bugtraq&m=111083279031544&w=2 | mailing-list, x_refsource_BUGTRAQ |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T21:28:28.219Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "12800",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/12800"
},
{
"name": "14554",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/14554"
},
{
"name": "20050313 3 XSS Vulnerabilities in Phorum \u003c= 5.0.14",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=111083279031544\u0026w=2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-03-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Phorum before 5.0.15 allow remote attackers to inject arbitrary web script or HTML via (1) the subject line to follow.php or (2) the subject line in the user\u0027s personal control panel."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-10-17T13:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "12800",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/12800"
},
{
"name": "14554",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/14554"
},
{
"name": "20050313 3 XSS Vulnerabilities in Phorum \u003c= 5.0.14",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=111083279031544\u0026w=2"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-0784",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Phorum before 5.0.15 allow remote attackers to inject arbitrary web script or HTML via (1) the subject line to follow.php or (2) the subject line in the user\u0027s personal control panel."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "12800",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/12800"
},
{
"name": "14554",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/14554"
},
{
"name": "20050313 3 XSS Vulnerabilities in Phorum \u003c= 5.0.14",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=111083279031544\u0026w=2"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-0784",
"datePublished": "2005-03-20T05:00:00",
"dateReserved": "2005-03-20T00:00:00",
"dateUpdated": "2024-08-07T21:28:28.219Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-6968
Vulnerability from cvelistv5
Published
2007-02-06 02:00
Modified
2024-08-07 20:50
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in the group moderation control center page in Phorum before 5.1.19 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.vupen.com/english/advisories/2007/0410 | vdb-entry, x_refsource_VUPEN | |
| http://osvdb.org/34729 | vdb-entry, x_refsource_OSVDB | |
| http://www.phorum.org/phorum5/read.php?12%2C119757 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T20:50:06.197Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ADV-2007-0410",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/0410"
},
{
"name": "34729",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/34729"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phorum.org/phorum5/read.php?12%2C119757"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-01-26T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the group moderation control center page in Phorum before 5.1.19 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2008-11-13T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "ADV-2007-0410",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/0410"
},
{
"name": "34729",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/34729"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phorum.org/phorum5/read.php?12%2C119757"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-6968",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in the group moderation control center page in Phorum before 5.1.19 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "ADV-2007-0410",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/0410"
},
{
"name": "34729",
"refsource": "OSVDB",
"url": "http://osvdb.org/34729"
},
{
"name": "http://www.phorum.org/phorum5/read.php?12,119757",
"refsource": "CONFIRM",
"url": "http://www.phorum.org/phorum5/read.php?12,119757"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-6968",
"datePublished": "2007-02-06T02:00:00",
"dateReserved": "2007-02-05T00:00:00",
"dateUpdated": "2024-08-07T20:50:06.197Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2003-0283
Vulnerability from cvelistv5
Published
2003-05-14 04:00
Modified
2024-08-08 01:50
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in Phorum before 3.4.3 allows remote attackers to inject arbitrary web script and HTML tags via a message with a "<<" before a tag name in the (1) subject, (2) author's name, or (3) author's e-mail.
References
| ▼ | URL | Tags |
|---|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/11974 | vdb-entry, x_refsource_XF | |
| http://marc.info/?l=bugtraq&m=105251421925394&w=2 | mailing-list, x_refsource_BUGTRAQ | |
| http://www.securityfocus.com/bid/7545 | vdb-entry, x_refsource_BID | |
| http://marc.info/?l=bugtraq&m=105251043821533&w=2 | mailing-list, x_refsource_BUGTRAQ |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T01:50:47.626Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "phorum-message-html-injection(11974)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11974"
},
{
"name": "20030509 Re: A Phorum\u0027s bug...",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=105251421925394\u0026w=2"
},
{
"name": "7545",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/7545"
},
{
"name": "20030509 A Phorum\u0027s bug...",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=105251043821533\u0026w=2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2003-05-09T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Phorum before 3.4.3 allows remote attackers to inject arbitrary web script and HTML tags via a message with a \"\u003c\u003c\" before a tag name in the (1) subject, (2) author\u0027s name, or (3) author\u0027s e-mail."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "phorum-message-html-injection(11974)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11974"
},
{
"name": "20030509 Re: A Phorum\u0027s bug...",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=105251421925394\u0026w=2"
},
{
"name": "7545",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/7545"
},
{
"name": "20030509 A Phorum\u0027s bug...",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=105251043821533\u0026w=2"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2003-0283",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Phorum before 3.4.3 allows remote attackers to inject arbitrary web script and HTML tags via a message with a \"\u003c\u003c\" before a tag name in the (1) subject, (2) author\u0027s name, or (3) author\u0027s e-mail."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "phorum-message-html-injection(11974)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/11974"
},
{
"name": "20030509 Re: A Phorum\u0027s bug...",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=105251421925394\u0026w=2"
},
{
"name": "7545",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/7545"
},
{
"name": "20030509 A Phorum\u0027s bug...",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=105251043821533\u0026w=2"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2003-0283",
"datePublished": "2003-05-14T04:00:00",
"dateReserved": "2003-05-12T00:00:00",
"dateUpdated": "2024-08-08T01:50:47.626Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2004-2110
Vulnerability from cvelistv5
Published
2005-05-27 04:00
Modified
2024-08-08 01:15
Severity ?
EPSS score ?
Summary
SQL injection vulnerability in register.php in Phorum before 3.4.6 allows remote attackers to execute arbitrary SQL commands via the hide_email parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://phorum.org/ | x_refsource_CONFIRM | |
| http://marc.info/?l=bugtraq&m=107487971405960&w=2 | mailing-list, x_refsource_BUGTRAQ |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T01:15:01.578Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phorum.org/"
},
{
"name": "20040123 Multiple Vulnerabilities in Phorum 3.4.5",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=107487971405960\u0026w=2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2004-01-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in register.php in Phorum before 3.4.6 allows remote attackers to execute arbitrary SQL commands via the hide_email parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-10-17T13:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phorum.org/"
},
{
"name": "20040123 Multiple Vulnerabilities in Phorum 3.4.5",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=107487971405960\u0026w=2"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2004-2110",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "SQL injection vulnerability in register.php in Phorum before 3.4.6 allows remote attackers to execute arbitrary SQL commands via the hide_email parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://phorum.org/",
"refsource": "CONFIRM",
"url": "http://phorum.org/"
},
{
"name": "20040123 Multiple Vulnerabilities in Phorum 3.4.5",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=107487971405960\u0026w=2"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2004-2110",
"datePublished": "2005-05-27T04:00:00",
"dateReserved": "2005-05-27T00:00:00",
"dateUpdated": "2024-08-08T01:15:01.578Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-6550
Vulnerability from cvelistv5
Published
2006-12-14 18:00
Modified
2024-08-07 20:33
Severity ?
EPSS score ?
Summary
PHP remote file inclusion vulnerability in common.php in Phorum 3.2.11 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the db_file parameter. NOTE: CVE disputes this vulnerability because db_file is defined before use
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.exploit-db.com/exploits/2894 | exploit, x_refsource_EXPLOIT-DB | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/30741 | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T20:33:58.571Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "2894",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/2894"
},
{
"name": "phorum-dbfile-file-include(30741)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30741"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-12-06T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "PHP remote file inclusion vulnerability in common.php in Phorum 3.2.11 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the db_file parameter. NOTE: CVE disputes this vulnerability because db_file is defined before use"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-10-18T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "2894",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/2894"
},
{
"name": "phorum-dbfile-file-include(30741)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30741"
}
],
"tags": [
"disputed"
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-6550",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** DISPUTED ** PHP remote file inclusion vulnerability in common.php in Phorum 3.2.11 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the db_file parameter. NOTE: CVE disputes this vulnerability because db_file is defined before use."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "2894",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/2894"
},
{
"name": "phorum-dbfile-file-include(30741)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/30741"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-6550",
"datePublished": "2006-12-14T18:00:00",
"dateReserved": "2006-12-14T00:00:00",
"dateUpdated": "2024-08-07T20:33:58.571Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-3615
Vulnerability from cvelistv5
Published
2006-07-14 21:00
Modified
2024-08-07 18:39
Severity ?
EPSS score ?
Summary
Multiple PHP remote file inclusion vulnerabilities in Phorum 5.1.14, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via unspecified vectors related to an uninitialized variable.
References
| ▼ | URL | Tags |
|---|---|---|
| http://archives.neohapsis.com/archives/bugtraq/2006-07/0200.html | mailing-list, x_refsource_BUGTRAQ | |
| http://secunia.com/advisories/21043 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.osvdb.org/27164 | vdb-entry, x_refsource_OSVDB | |
| http://www.phorum.org/phorum5/read.php?14%2C114358 | x_refsource_CONFIRM | |
| http://www.vupen.com/english/advisories/2006/2794 | vdb-entry, x_refsource_VUPEN | |
| http://www.osvdb.org/27167 | vdb-entry, x_refsource_OSVDB | |
| http://retrogod.altervista.org/phorum5_local_incl_xpl.html | x_refsource_MISC | |
| http://archives.neohapsis.com/archives/bugtraq/2006-07/0191.html | mailing-list, x_refsource_BUGTRAQ |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T18:39:52.560Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20060713 Phorum 5.1.15 security release (fixes \"PHORUM 5 arbitrary local inclusion\")",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2006-07/0200.html"
},
{
"name": "21043",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/21043"
},
{
"name": "27164",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/27164"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phorum.org/phorum5/read.php?14%2C114358"
},
{
"name": "ADV-2006-2794",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/2794"
},
{
"name": "27167",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/27167"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://retrogod.altervista.org/phorum5_local_incl_xpl.html"
},
{
"name": "20060713 PHORUM 5 arbitrary local inclusion",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2006-07/0191.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-07-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple PHP remote file inclusion vulnerabilities in Phorum 5.1.14, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via unspecified vectors related to an uninitialized variable."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2006-08-02T09:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20060713 Phorum 5.1.15 security release (fixes \"PHORUM 5 arbitrary local inclusion\")",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2006-07/0200.html"
},
{
"name": "21043",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/21043"
},
{
"name": "27164",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/27164"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phorum.org/phorum5/read.php?14%2C114358"
},
{
"name": "ADV-2006-2794",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/2794"
},
{
"name": "27167",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/27167"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://retrogod.altervista.org/phorum5_local_incl_xpl.html"
},
{
"name": "20060713 PHORUM 5 arbitrary local inclusion",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://archives.neohapsis.com/archives/bugtraq/2006-07/0191.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-3615",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple PHP remote file inclusion vulnerabilities in Phorum 5.1.14, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via unspecified vectors related to an uninitialized variable."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20060713 Phorum 5.1.15 security release (fixes \"PHORUM 5 arbitrary local inclusion\")",
"refsource": "BUGTRAQ",
"url": "http://archives.neohapsis.com/archives/bugtraq/2006-07/0200.html"
},
{
"name": "21043",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/21043"
},
{
"name": "27164",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/27164"
},
{
"name": "http://www.phorum.org/phorum5/read.php?14,114358",
"refsource": "CONFIRM",
"url": "http://www.phorum.org/phorum5/read.php?14,114358"
},
{
"name": "ADV-2006-2794",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/2794"
},
{
"name": "27167",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/27167"
},
{
"name": "http://retrogod.altervista.org/phorum5_local_incl_xpl.html",
"refsource": "MISC",
"url": "http://retrogod.altervista.org/phorum5_local_incl_xpl.html"
},
{
"name": "20060713 PHORUM 5 arbitrary local inclusion",
"refsource": "BUGTRAQ",
"url": "http://archives.neohapsis.com/archives/bugtraq/2006-07/0191.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-3615",
"datePublished": "2006-07-14T21:00:00",
"dateReserved": "2006-07-14T00:00:00",
"dateUpdated": "2024-08-07T18:39:52.560Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2004-0035
Vulnerability from cvelistv5
Published
2004-09-01 04:00
Modified
2024-08-08 00:01
Severity ?
EPSS score ?
Summary
SQL injection vulnerability in register.php for Phorum 3.4.5 and earlier allows remote attackers to execute arbitrary SQL commands via the hide_email parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://marc.info/?l=bugtraq&m=107340481804110&w=2 | mailing-list, x_refsource_BUGTRAQ | |
| http://secunia.com/advisories/10567 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.osvdb.org/3508 | vdb-entry, x_refsource_OSVDB | |
| http://www.securityfocus.com/bid/9363 | vdb-entry, x_refsource_BID | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/14146 | vdb-entry, x_refsource_XF |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T00:01:23.624Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20040105 Multiple Vulnerabilities in Phorum 3.4.5",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=107340481804110\u0026w=2"
},
{
"name": "10567",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/10567"
},
{
"name": "3508",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/3508"
},
{
"name": "9363",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/9363"
},
{
"name": "phorum-register-sql-injection(14146)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/14146"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2004-01-05T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in register.php for Phorum 3.4.5 and earlier allows remote attackers to execute arbitrary SQL commands via the hide_email parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2007-11-13T00:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20040105 Multiple Vulnerabilities in Phorum 3.4.5",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=107340481804110\u0026w=2"
},
{
"name": "10567",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/10567"
},
{
"name": "3508",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/3508"
},
{
"name": "9363",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/9363"
},
{
"name": "phorum-register-sql-injection(14146)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/14146"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2004-0035",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "SQL injection vulnerability in register.php for Phorum 3.4.5 and earlier allows remote attackers to execute arbitrary SQL commands via the hide_email parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20040105 Multiple Vulnerabilities in Phorum 3.4.5",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=107340481804110\u0026w=2"
},
{
"name": "10567",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/10567"
},
{
"name": "3508",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/3508"
},
{
"name": "9363",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/9363"
},
{
"name": "phorum-register-sql-injection(14146)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/14146"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2004-0035",
"datePublished": "2004-09-01T04:00:00",
"dateReserved": "2004-01-07T00:00:00",
"dateUpdated": "2024-08-08T00:01:23.624Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2005-0843
Vulnerability from cvelistv5
Published
2005-03-24 05:00
Modified
2024-08-07 21:28
Severity ?
EPSS score ?
Summary
CRLF injection vulnerability in search.php in Phorum 5.0.14a allows remote attackers to perform HTTP Response Splitting attacks via the body parameter, which is included in the resulting Location header.
References
| ▼ | URL | Tags |
|---|---|---|
| http://marc.info/?l=bugtraq&m=111151651621097&w=2 | mailing-list, x_refsource_BUGTRAQ | |
| http://secunia.com/advisories/14680 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T21:28:28.944Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20050322 [ Positive Technologies #SA] Phorum \"location\" HTTP Response",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=111151651621097\u0026w=2"
},
{
"name": "14680",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/14680"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2005-03-22T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "CRLF injection vulnerability in search.php in Phorum 5.0.14a allows remote attackers to perform HTTP Response Splitting attacks via the body parameter, which is included in the resulting Location header."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-10-17T13:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20050322 [ Positive Technologies #SA] Phorum \"location\" HTTP Response",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=111151651621097\u0026w=2"
},
{
"name": "14680",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/14680"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2005-0843",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "CRLF injection vulnerability in search.php in Phorum 5.0.14a allows remote attackers to perform HTTP Response Splitting attacks via the body parameter, which is included in the resulting Location header."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20050322 [ Positive Technologies #SA] Phorum \"location\" HTTP Response",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=111151651621097\u0026w=2"
},
{
"name": "14680",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/14680"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2005-0843",
"datePublished": "2005-03-24T05:00:00",
"dateReserved": "2005-03-24T00:00:00",
"dateUpdated": "2024-08-07T21:28:28.944Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2002-0352
Vulnerability from cvelistv5
Published
2002-05-03 04:00
Modified
2024-08-08 02:49
Severity ?
EPSS score ?
Summary
Phorum 3.3.2 allows remote attackers to determine the email addresses of the 10 most active users via a direct HTTP request to the stats.php program, which does not require authentication.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.iss.net/security_center/static/8344.php | vdb-entry, x_refsource_XF | |
| http://www.securityfocus.com/bid/4226 | vdb-entry, x_refsource_BID | |
| http://marc.info/?l=bugtraq&m=101508207206900&w=2 | mailing-list, x_refsource_BUGTRAQ |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T02:49:27.998Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "phorum-admin-users-information(8344)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "http://www.iss.net/security_center/static/8344.php"
},
{
"name": "4226",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/4226"
},
{
"name": "20020302 Phorum Discussion Board Security Bug (Email Disclosure)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=101508207206900\u0026w=2"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2002-03-02T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Phorum 3.3.2 allows remote attackers to determine the email addresses of the 10 most active users via a direct HTTP request to the stats.php program, which does not require authentication."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-10-17T13:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "phorum-admin-users-information(8344)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "http://www.iss.net/security_center/static/8344.php"
},
{
"name": "4226",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/4226"
},
{
"name": "20020302 Phorum Discussion Board Security Bug (Email Disclosure)",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=101508207206900\u0026w=2"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2002-0352",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Phorum 3.3.2 allows remote attackers to determine the email addresses of the 10 most active users via a direct HTTP request to the stats.php program, which does not require authentication."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "phorum-admin-users-information(8344)",
"refsource": "XF",
"url": "http://www.iss.net/security_center/static/8344.php"
},
{
"name": "4226",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/4226"
},
{
"name": "20020302 Phorum Discussion Board Security Bug (Email Disclosure)",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=101508207206900\u0026w=2"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2002-0352",
"datePublished": "2002-05-03T04:00:00",
"dateReserved": "2002-05-01T00:00:00",
"dateUpdated": "2024-08-08T02:49:27.998Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2000-1231
Vulnerability from cvelistv5
Published
2005-07-14 04:00
Modified
2024-09-17 04:15
Severity ?
EPSS score ?
Summary
code.php3 in Phorum 3.0.7 allows remote attackers to read arbitrary files in the phorum directory via the query string.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm | x_refsource_MISC | |
| http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html | mailing-list, x_refsource_BUGTRAQ | |
| http://hispahack.ccc.de/mi020.html | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T05:45:37.522Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm"
},
{
"name": "20000106 Phorum 3.0.7 exploits and IDS signatures",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://hispahack.ccc.de/mi020.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "code.php3 in Phorum 3.0.7 allows remote attackers to read arbitrary files in the phorum directory via the query string."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2005-07-14T04:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm"
},
{
"name": "20000106 Phorum 3.0.7 exploits and IDS signatures",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://hispahack.ccc.de/mi020.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2000-1231",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "code.php3 in Phorum 3.0.7 allows remote attackers to read arbitrary files in the phorum directory via the query string."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm",
"refsource": "MISC",
"url": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm"
},
{
"name": "20000106 Phorum 3.0.7 exploits and IDS signatures",
"refsource": "BUGTRAQ",
"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html"
},
{
"name": "http://hispahack.ccc.de/mi020.html",
"refsource": "MISC",
"url": "http://hispahack.ccc.de/mi020.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2000-1231",
"datePublished": "2005-07-14T04:00:00Z",
"dateReserved": "2005-07-14T00:00:00Z",
"dateUpdated": "2024-09-17T04:15:17.691Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2003-1487
Vulnerability from cvelistv5
Published
2007-10-24 23:00
Modified
2024-08-08 02:28
Severity ?
EPSS score ?
Summary
Multiple "command injection" vulnerabilities in Phorum 3.4 through 3.4.2 allow remote attackers to execute arbitrary commands and modify the Phorum configuration files via the (1) UserAdmin program, (2) Edit user profile, or (3) stats program.
References
| ▼ | URL | Tags |
|---|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/12500 | vdb-entry, x_refsource_XF | |
| http://www.securityfocus.com/bid/7579 | vdb-entry, x_refsource_BID | |
| http://www.securityfocus.com/bid/7578 | vdb-entry, x_refsource_BID | |
| http://securityreason.com/securityalert/3288 | third-party-advisory, x_refsource_SREASON | |
| http://www.securityfocus.com/bid/7574 | vdb-entry, x_refsource_BID | |
| http://www.securityfocus.com/archive/1/321310 | mailing-list, x_refsource_BUGTRAQ |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T02:28:03.744Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "phorum-command-execution(12500)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/12500"
},
{
"name": "7579",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/7579"
},
{
"name": "7578",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/7578"
},
{
"name": "3288",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/3288"
},
{
"name": "7574",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/7574"
},
{
"name": "20030513 Phorum Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/321310"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2003-05-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple \"command injection\" vulnerabilities in Phorum 3.4 through 3.4.2 allow remote attackers to execute arbitrary commands and modify the Phorum configuration files via the (1) UserAdmin program, (2) Edit user profile, or (3) stats program."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "phorum-command-execution(12500)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/12500"
},
{
"name": "7579",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/7579"
},
{
"name": "7578",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/7578"
},
{
"name": "3288",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/3288"
},
{
"name": "7574",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/7574"
},
{
"name": "20030513 Phorum Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/321310"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2003-1487",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple \"command injection\" vulnerabilities in Phorum 3.4 through 3.4.2 allow remote attackers to execute arbitrary commands and modify the Phorum configuration files via the (1) UserAdmin program, (2) Edit user profile, or (3) stats program."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "phorum-command-execution(12500)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/12500"
},
{
"name": "7579",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/7579"
},
{
"name": "7578",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/7578"
},
{
"name": "3288",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/3288"
},
{
"name": "7574",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/7574"
},
{
"name": "20030513 Phorum Vulnerabilities",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/321310"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2003-1487",
"datePublished": "2007-10-24T23:00:00",
"dateReserved": "2007-10-24T00:00:00",
"dateUpdated": "2024-08-08T02:28:03.744Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-2248
Vulnerability from cvelistv5
Published
2007-04-25 16:00
Modified
2024-08-07 13:33
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in admin.php in Phorum before 5.1.22 allow remote attackers to inject arbitrary web script or HTML via the (1) group_id parameter in the groups module or (2) the smiley_id parameter in the smileys modsettings module.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.waraxe.us/advisory-49.html | x_refsource_MISC | |
| http://www.phorum.org/story.php?76 | x_refsource_CONFIRM | |
| http://www.securitytracker.com/id?1017936 | vdb-entry, x_refsource_SECTRACK | |
| http://secunia.com/advisories/24932 | third-party-advisory, x_refsource_SECUNIA | |
| http://osvdb.org/35058 | vdb-entry, x_refsource_OSVDB | |
| http://www.securityfocus.com/archive/1/466286/100/0/threaded | mailing-list, x_refsource_BUGTRAQ | |
| http://securityreason.com/securityalert/2617 | third-party-advisory, x_refsource_SREASON | |
| http://www.securityfocus.com/bid/23616 | vdb-entry, x_refsource_BID | |
| http://osvdb.org/35057 | vdb-entry, x_refsource_OSVDB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T13:33:28.260Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.waraxe.us/advisory-49.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phorum.org/story.php?76"
},
{
"name": "1017936",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1017936"
},
{
"name": "24932",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/24932"
},
{
"name": "35058",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/35058"
},
{
"name": "20070419 [waraxe-2007-SA#049] - Multiple vulnerabilities in Phorum 5.1.20",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/466286/100/0/threaded"
},
{
"name": "2617",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/2617"
},
{
"name": "23616",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/23616"
},
{
"name": "35057",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/35057"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-04-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in admin.php in Phorum before 5.1.22 allow remote attackers to inject arbitrary web script or HTML via the (1) group_id parameter in the groups module or (2) the smiley_id parameter in the smileys modsettings module."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-16T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.waraxe.us/advisory-49.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phorum.org/story.php?76"
},
{
"name": "1017936",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1017936"
},
{
"name": "24932",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/24932"
},
{
"name": "35058",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/35058"
},
{
"name": "20070419 [waraxe-2007-SA#049] - Multiple vulnerabilities in Phorum 5.1.20",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/466286/100/0/threaded"
},
{
"name": "2617",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/2617"
},
{
"name": "23616",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/23616"
},
{
"name": "35057",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/35057"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-2248",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in admin.php in Phorum before 5.1.22 allow remote attackers to inject arbitrary web script or HTML via the (1) group_id parameter in the groups module or (2) the smiley_id parameter in the smileys modsettings module."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.waraxe.us/advisory-49.html",
"refsource": "MISC",
"url": "http://www.waraxe.us/advisory-49.html"
},
{
"name": "http://www.phorum.org/story.php?76",
"refsource": "CONFIRM",
"url": "http://www.phorum.org/story.php?76"
},
{
"name": "1017936",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1017936"
},
{
"name": "24932",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/24932"
},
{
"name": "35058",
"refsource": "OSVDB",
"url": "http://osvdb.org/35058"
},
{
"name": "20070419 [waraxe-2007-SA#049] - Multiple vulnerabilities in Phorum 5.1.20",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/466286/100/0/threaded"
},
{
"name": "2617",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/2617"
},
{
"name": "23616",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/23616"
},
{
"name": "35057",
"refsource": "OSVDB",
"url": "http://osvdb.org/35057"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-2248",
"datePublished": "2007-04-25T16:00:00",
"dateReserved": "2007-04-25T00:00:00",
"dateUpdated": "2024-08-07T13:33:28.260Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2008-4513
Vulnerability from cvelistv5
Published
2008-10-09 16:00
Modified
2024-08-07 10:17
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in BBcode API module in Phorum 5.2.8 allows remote attackers to inject arbitrary web script or HTML via nested BBcode image tags.
References
| ▼ | URL | Tags |
|---|---|---|
| http://trac.phorum.org/changeset/3528 | x_refsource_CONFIRM | |
| http://secunia.com/advisories/32225 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.phorum.org/phorum5/read.php?64%2C133699 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/45686 | vdb-entry, x_refsource_XF | |
| http://nulledcore.com/?p=126 | x_refsource_MISC | |
| http://www.securityfocus.com/bid/31589 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T10:17:09.793Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://trac.phorum.org/changeset/3528"
},
{
"name": "32225",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/32225"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phorum.org/phorum5/read.php?64%2C133699"
},
{
"name": "phorum-img-xss(45686)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45686"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://nulledcore.com/?p=126"
},
{
"name": "31589",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/31589"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2008-10-05T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in BBcode API module in Phorum 5.2.8 allows remote attackers to inject arbitrary web script or HTML via nested BBcode image tags."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-07T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://trac.phorum.org/changeset/3528"
},
{
"name": "32225",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/32225"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phorum.org/phorum5/read.php?64%2C133699"
},
{
"name": "phorum-img-xss(45686)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45686"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://nulledcore.com/?p=126"
},
{
"name": "31589",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/31589"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2008-4513",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in BBcode API module in Phorum 5.2.8 allows remote attackers to inject arbitrary web script or HTML via nested BBcode image tags."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://trac.phorum.org/changeset/3528",
"refsource": "CONFIRM",
"url": "http://trac.phorum.org/changeset/3528"
},
{
"name": "32225",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/32225"
},
{
"name": "http://www.phorum.org/phorum5/read.php?64,133699",
"refsource": "CONFIRM",
"url": "http://www.phorum.org/phorum5/read.php?64,133699"
},
{
"name": "phorum-img-xss(45686)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45686"
},
{
"name": "http://nulledcore.com/?p=126",
"refsource": "MISC",
"url": "http://nulledcore.com/?p=126"
},
{
"name": "31589",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/31589"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2008-4513",
"datePublished": "2008-10-09T16:00:00",
"dateReserved": "2008-10-09T00:00:00",
"dateUpdated": "2024-08-07T10:17:09.793Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-0769
Vulnerability from cvelistv5
Published
2007-02-06 02:00
Modified
2024-08-07 12:34
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in register.php in Phorum 5.1.18 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: the vendor disputes this vulnerability, stating that "The characters are escaped properly.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.vupen.com/english/advisories/2007/0410 | vdb-entry, x_refsource_VUPEN | |
| http://www.securityfocus.com/bid/22297 | vdb-entry, x_refsource_BID | |
| http://www.phorum.org/phorum5/read.php?12%2C119757 | x_refsource_MISC | |
| http://www.securityfocus.com/archive/1/458461/100/0/threaded | mailing-list, x_refsource_BUGTRAQ | |
| http://www.securityfocus.com/archive/1/458467/100/0/threaded | mailing-list, x_refsource_BUGTRAQ |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T12:34:19.769Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ADV-2007-0410",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/0410"
},
{
"name": "22297",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/22297"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.phorum.org/phorum5/read.php?12%2C119757"
},
{
"name": "20070129 Phorum HTML Injection Vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/458461/100/0/threaded"
},
{
"name": "20070129 Re: Phorum HTML Injection Vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/458467/100/0/threaded"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-01-29T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in register.php in Phorum 5.1.18 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: the vendor disputes this vulnerability, stating that \"The characters are escaped properly."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-16T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "ADV-2007-0410",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/0410"
},
{
"name": "22297",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/22297"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.phorum.org/phorum5/read.php?12%2C119757"
},
{
"name": "20070129 Phorum HTML Injection Vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/458461/100/0/threaded"
},
{
"name": "20070129 Re: Phorum HTML Injection Vulnerability",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/458467/100/0/threaded"
}
],
"tags": [
"disputed"
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-0769",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** DISPUTED ** Cross-site scripting (XSS) vulnerability in register.php in Phorum 5.1.18 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: the vendor disputes this vulnerability, stating that \"The characters are escaped properly.\""
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "ADV-2007-0410",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/0410"
},
{
"name": "22297",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/22297"
},
{
"name": "http://www.phorum.org/phorum5/read.php?12,119757",
"refsource": "MISC",
"url": "http://www.phorum.org/phorum5/read.php?12,119757"
},
{
"name": "20070129 Phorum HTML Injection Vulnerability",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/458461/100/0/threaded"
},
{
"name": "20070129 Re: Phorum HTML Injection Vulnerability",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/458467/100/0/threaded"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-0769",
"datePublished": "2007-02-06T02:00:00",
"dateReserved": "2007-02-05T00:00:00",
"dateUpdated": "2024-08-07T12:34:19.769Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2003-1465
Vulnerability from cvelistv5
Published
2007-10-24 23:00
Modified
2024-08-08 02:28
Severity ?
EPSS score ?
Summary
Directory traversal vulnerability in download.php in Phorum 3.4 through 3.4.2 allows remote attackers to read arbitrary files.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/7569 | vdb-entry, x_refsource_BID | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/12482 | vdb-entry, x_refsource_XF | |
| http://securityreason.com/securityalert/3288 | third-party-advisory, x_refsource_SREASON | |
| http://www.securityfocus.com/archive/1/321310 | mailing-list, x_refsource_BUGTRAQ |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T02:28:03.625Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "7569",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/7569"
},
{
"name": "phorum-download-directory-traversal(12482)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/12482"
},
{
"name": "3288",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/3288"
},
{
"name": "20030513 Phorum Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/321310"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2003-05-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in download.php in Phorum 3.4 through 3.4.2 allows remote attackers to read arbitrary files."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "7569",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/7569"
},
{
"name": "phorum-download-directory-traversal(12482)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/12482"
},
{
"name": "3288",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/3288"
},
{
"name": "20030513 Phorum Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/321310"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2003-1465",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Directory traversal vulnerability in download.php in Phorum 3.4 through 3.4.2 allows remote attackers to read arbitrary files."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "7569",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/7569"
},
{
"name": "phorum-download-directory-traversal(12482)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/12482"
},
{
"name": "3288",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/3288"
},
{
"name": "20030513 Phorum Vulnerabilities",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/321310"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2003-1465",
"datePublished": "2007-10-24T23:00:00",
"dateReserved": "2007-10-24T00:00:00",
"dateUpdated": "2024-08-08T02:28:03.625Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2010-1629
Vulnerability from cvelistv5
Published
2010-05-19 22:00
Modified
2024-08-07 01:28
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in Phorum before 5.2.15 allows remote attackers to inject arbitrary web script or HTML via an invalid email address.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2010/05/18/11 | mailing-list, x_refsource_MLIST | |
| http://www.openwall.com/lists/oss-security/2010/05/16/2 | mailing-list, x_refsource_MLIST | |
| http://www.facebook.com/note.php?note_id=371190874581 | x_refsource_CONFIRM | |
| http://osvdb.org/64759 | vdb-entry, x_refsource_OSVDB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T01:28:42.109Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20100518 Re: CVE request: phorum \u003c 5.2.15 backend XSS",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2010/05/18/11"
},
{
"name": "[oss-security] 20100517 CVE request: phorum \u003c 5.2.15 backend XSS",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2010/05/16/2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.facebook.com/note.php?note_id=371190874581"
},
{
"name": "64759",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/64759"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2010-05-17T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Phorum before 5.2.15 allows remote attackers to inject arbitrary web script or HTML via an invalid email address."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2010-04-30T09:00:00",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "[oss-security] 20100518 Re: CVE request: phorum \u003c 5.2.15 backend XSS",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2010/05/18/11"
},
{
"name": "[oss-security] 20100517 CVE request: phorum \u003c 5.2.15 backend XSS",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2010/05/16/2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.facebook.com/note.php?note_id=371190874581"
},
{
"name": "64759",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/64759"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2010-1629",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Phorum before 5.2.15 allows remote attackers to inject arbitrary web script or HTML via an invalid email address."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "[oss-security] 20100518 Re: CVE request: phorum \u003c 5.2.15 backend XSS",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2010/05/18/11"
},
{
"name": "[oss-security] 20100517 CVE request: phorum \u003c 5.2.15 backend XSS",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2010/05/16/2"
},
{
"name": "http://www.facebook.com/note.php?note_id=371190874581",
"refsource": "CONFIRM",
"url": "http://www.facebook.com/note.php?note_id=371190874581"
},
{
"name": "64759",
"refsource": "OSVDB",
"url": "http://osvdb.org/64759"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2010-1629",
"datePublished": "2010-05-19T22:00:00",
"dateReserved": "2010-04-29T00:00:00",
"dateUpdated": "2024-08-07T01:28:42.109Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2004-0034
Vulnerability from cvelistv5
Published
2004-01-08 05:00
Modified
2024-08-08 00:01
Severity ?
EPSS score ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Phorum 3.4.5 and earlier allow remote attackers to inject arbitrary HTML or web script via (1) the phorum_check_xss function in common.php, (2) the EditError variable in profile.php, and (3) the Error variable in login.php.
References
| ▼ | URL | Tags |
|---|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/14145 | vdb-entry, x_refsource_XF | |
| http://www.osvdb.org/3434 | vdb-entry, x_refsource_OSVDB | |
| http://www.osvdb.org/3510 | vdb-entry, x_refsource_OSVDB | |
| http://www.securityfocus.com/bid/9361 | vdb-entry, x_refsource_BID | |
| http://marc.info/?l=bugtraq&m=107340481804110&w=2 | mailing-list, x_refsource_BUGTRAQ | |
| http://phorum.org/ | x_refsource_CONFIRM | |
| http://secunia.com/advisories/10567 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.osvdb.org/3506 | vdb-entry, x_refsource_OSVDB | |
| http://www.securitytracker.com/id?1008633 | vdb-entry, x_refsource_SECTRACK |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T00:01:23.592Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "phorum-common-xss(14145)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/14145"
},
{
"name": "3434",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/3434"
},
{
"name": "3510",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/3510"
},
{
"name": "9361",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/9361"
},
{
"name": "20040105 Multiple Vulnerabilities in Phorum 3.4.5",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://marc.info/?l=bugtraq\u0026m=107340481804110\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phorum.org/"
},
{
"name": "10567",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/10567"
},
{
"name": "3506",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/3506"
},
{
"name": "1008633",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1008633"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2004-01-05T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Phorum 3.4.5 and earlier allow remote attackers to inject arbitrary HTML or web script via (1) the phorum_check_xss function in common.php, (2) the EditError variable in profile.php, and (3) the Error variable in login.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "phorum-common-xss(14145)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/14145"
},
{
"name": "3434",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/3434"
},
{
"name": "3510",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/3510"
},
{
"name": "9361",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/9361"
},
{
"name": "20040105 Multiple Vulnerabilities in Phorum 3.4.5",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://marc.info/?l=bugtraq\u0026m=107340481804110\u0026w=2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phorum.org/"
},
{
"name": "10567",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/10567"
},
{
"name": "3506",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/3506"
},
{
"name": "1008633",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1008633"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2004-0034",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site scripting (XSS) vulnerabilities in Phorum 3.4.5 and earlier allow remote attackers to inject arbitrary HTML or web script via (1) the phorum_check_xss function in common.php, (2) the EditError variable in profile.php, and (3) the Error variable in login.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "phorum-common-xss(14145)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/14145"
},
{
"name": "3434",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/3434"
},
{
"name": "3510",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/3510"
},
{
"name": "9361",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/9361"
},
{
"name": "20040105 Multiple Vulnerabilities in Phorum 3.4.5",
"refsource": "BUGTRAQ",
"url": "http://marc.info/?l=bugtraq\u0026m=107340481804110\u0026w=2"
},
{
"name": "http://phorum.org/",
"refsource": "CONFIRM",
"url": "http://phorum.org/"
},
{
"name": "10567",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/10567"
},
{
"name": "3506",
"refsource": "OSVDB",
"url": "http://www.osvdb.org/3506"
},
{
"name": "1008633",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1008633"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2004-0034",
"datePublished": "2004-01-08T05:00:00",
"dateReserved": "2004-01-07T00:00:00",
"dateUpdated": "2024-08-08T00:01:23.592Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2011-3622
Vulnerability from cvelistv5
Published
2020-01-22 19:48
Modified
2024-08-06 23:37
Severity ?
EPSS score ?
Summary
A Cross-Site Scripting (XSS) vulnerability exists in the admin login screen in Phorum before 5.2.18.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.openwall.com/lists/oss-security/2011/10/18/9 | x_refsource_MISC | |
| https://www.phorum.org/phorum5/read.php?64%2C149588 | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T23:37:48.680Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.openwall.com/lists/oss-security/2011/10/18/9"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.phorum.org/phorum5/read.php?64%2C149588"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Phorum",
"vendor": "Phorum",
"versions": [
{
"status": "affected",
"version": "before 5.2.18"
}
]
}
],
"datePublic": "2011-10-18T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "A Cross-Site Scripting (XSS) vulnerability exists in the admin login screen in Phorum before 5.2.18."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "XSS",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-01-22T19:48:47",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.openwall.com/lists/oss-security/2011/10/18/9"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.phorum.org/phorum5/read.php?64%2C149588"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2011-3622",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Phorum",
"version": {
"version_data": [
{
"version_value": "before 5.2.18"
}
]
}
}
]
},
"vendor_name": "Phorum"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A Cross-Site Scripting (XSS) vulnerability exists in the admin login screen in Phorum before 5.2.18."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "XSS"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.openwall.com/lists/oss-security/2011/10/18/9",
"refsource": "MISC",
"url": "https://www.openwall.com/lists/oss-security/2011/10/18/9"
},
{
"name": "https://www.phorum.org/phorum5/read.php?64,149588",
"refsource": "MISC",
"url": "https://www.phorum.org/phorum5/read.php?64,149588"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2011-3622",
"datePublished": "2020-01-22T19:48:47",
"dateReserved": "2011-09-21T00:00:00",
"dateUpdated": "2024-08-06T23:37:48.680Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2000-1233
Vulnerability from cvelistv5
Published
2005-07-14 04:00
Modified
2024-08-08 05:45
Severity ?
EPSS score ?
Summary
SQL injection vulnerability in read.php3 and other scripts in Phorum 3.0.7 allows remote attackers to execute arbitrary SQL queries via the sSQL parameter.
References
| ▼ | URL | Tags |
|---|---|---|
| http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html | mailing-list, x_refsource_BUGTRAQ | |
| http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm | x_refsource_MISC | |
| http://hispahack.ccc.de/mi020.html | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T05:45:37.356Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20000106 Phorum 3.0.7 exploits and IDS signatures",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://hispahack.ccc.de/mi020.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2000-01-06T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in read.php3 and other scripts in Phorum 3.0.7 allows remote attackers to execute arbitrary SQL queries via the sSQL parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-06-15T16:40:34",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20000106 Phorum 3.0.7 exploits and IDS signatures",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://hispahack.ccc.de/mi020.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2000-1233",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "SQL injection vulnerability in read.php3 and other scripts in Phorum 3.0.7 allows remote attackers to execute arbitrary SQL queries via the sSQL parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20000106 Phorum 3.0.7 exploits and IDS signatures",
"refsource": "BUGTRAQ",
"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html"
},
{
"name": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm",
"refsource": "MISC",
"url": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm"
},
{
"name": "http://hispahack.ccc.de/mi020.html",
"refsource": "MISC",
"url": "http://hispahack.ccc.de/mi020.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2000-1233",
"datePublished": "2005-07-14T04:00:00",
"dateReserved": "2005-07-14T00:00:00",
"dateUpdated": "2024-08-08T05:45:37.356Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2003-1486
Vulnerability from cvelistv5
Published
2007-10-24 23:00
Modified
2024-08-08 02:28
Severity ?
EPSS score ?
Summary
Phorum 3.4 through 3.4.2 allows remote attackers to obtain the full path of the web server via an incorrect HTTP request to (1) smileys.php, (2) quick_listrss.php, (3) purge.php, (4) news.php, (5) memberlist.php, (6) forum_listrss.php, (7) forum_list_rdf.php, (8) forum_list.php, or (9) move.php, which leaks the information in an error message.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/7571 | vdb-entry, x_refsource_BID | |
| http://securityreason.com/securityalert/3288 | third-party-advisory, x_refsource_SREASON | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/12499 | vdb-entry, x_refsource_XF | |
| http://www.securityfocus.com/archive/1/321310 | mailing-list, x_refsource_BUGTRAQ |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T02:28:03.620Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "7571",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/7571"
},
{
"name": "3288",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/3288"
},
{
"name": "phorum-multiple-path-disclosure(12499)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/12499"
},
{
"name": "20030513 Phorum Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/321310"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2003-05-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Phorum 3.4 through 3.4.2 allows remote attackers to obtain the full path of the web server via an incorrect HTTP request to (1) smileys.php, (2) quick_listrss.php, (3) purge.php, (4) news.php, (5) memberlist.php, (6) forum_listrss.php, (7) forum_list_rdf.php, (8) forum_list.php, or (9) move.php, which leaks the information in an error message."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "7571",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/7571"
},
{
"name": "3288",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/3288"
},
{
"name": "phorum-multiple-path-disclosure(12499)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/12499"
},
{
"name": "20030513 Phorum Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/321310"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2003-1486",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Phorum 3.4 through 3.4.2 allows remote attackers to obtain the full path of the web server via an incorrect HTTP request to (1) smileys.php, (2) quick_listrss.php, (3) purge.php, (4) news.php, (5) memberlist.php, (6) forum_listrss.php, (7) forum_list_rdf.php, (8) forum_list.php, or (9) move.php, which leaks the information in an error message."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "7571",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/7571"
},
{
"name": "3288",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/3288"
},
{
"name": "phorum-multiple-path-disclosure(12499)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/12499"
},
{
"name": "20030513 Phorum Vulnerabilities",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/321310"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2003-1486",
"datePublished": "2007-10-24T23:00:00",
"dateReserved": "2007-10-24T00:00:00",
"dateUpdated": "2024-08-08T02:28:03.620Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-2249
Vulnerability from cvelistv5
Published
2007-04-25 16:00
Modified
2024-08-07 13:33
Severity ?
EPSS score ?
Summary
include/controlcenter/users.php in Phorum before 5.1.22 allows remote authenticated moderators to gain privileges via a modified (1) user_ids POST parameter or (2) userdata array.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.waraxe.us/advisory-49.html | x_refsource_MISC | |
| http://www.phorum.org/story.php?76 | x_refsource_CONFIRM | |
| http://osvdb.org/35059 | vdb-entry, x_refsource_OSVDB | |
| http://www.securitytracker.com/id?1017936 | vdb-entry, x_refsource_SECTRACK | |
| http://www.vupen.com/english/advisories/2007/1479 | vdb-entry, x_refsource_VUPEN | |
| http://secunia.com/advisories/24932 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/archive/1/466286/100/0/threaded | mailing-list, x_refsource_BUGTRAQ | |
| http://securityreason.com/securityalert/2617 | third-party-advisory, x_refsource_SREASON | |
| http://www.securityfocus.com/bid/23616 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T13:33:28.286Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.waraxe.us/advisory-49.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phorum.org/story.php?76"
},
{
"name": "35059",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/35059"
},
{
"name": "1017936",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://www.securitytracker.com/id?1017936"
},
{
"name": "ADV-2007-1479",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/1479"
},
{
"name": "24932",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/24932"
},
{
"name": "20070419 [waraxe-2007-SA#049] - Multiple vulnerabilities in Phorum 5.1.20",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/466286/100/0/threaded"
},
{
"name": "2617",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/2617"
},
{
"name": "23616",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/23616"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-04-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "include/controlcenter/users.php in Phorum before 5.1.22 allows remote authenticated moderators to gain privileges via a modified (1) user_ids POST parameter or (2) userdata array."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-16T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.waraxe.us/advisory-49.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phorum.org/story.php?76"
},
{
"name": "35059",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/35059"
},
{
"name": "1017936",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://www.securitytracker.com/id?1017936"
},
{
"name": "ADV-2007-1479",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/1479"
},
{
"name": "24932",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/24932"
},
{
"name": "20070419 [waraxe-2007-SA#049] - Multiple vulnerabilities in Phorum 5.1.20",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/466286/100/0/threaded"
},
{
"name": "2617",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/2617"
},
{
"name": "23616",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/23616"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-2249",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "include/controlcenter/users.php in Phorum before 5.1.22 allows remote authenticated moderators to gain privileges via a modified (1) user_ids POST parameter or (2) userdata array."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.waraxe.us/advisory-49.html",
"refsource": "MISC",
"url": "http://www.waraxe.us/advisory-49.html"
},
{
"name": "http://www.phorum.org/story.php?76",
"refsource": "CONFIRM",
"url": "http://www.phorum.org/story.php?76"
},
{
"name": "35059",
"refsource": "OSVDB",
"url": "http://osvdb.org/35059"
},
{
"name": "1017936",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1017936"
},
{
"name": "ADV-2007-1479",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/1479"
},
{
"name": "24932",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/24932"
},
{
"name": "20070419 [waraxe-2007-SA#049] - Multiple vulnerabilities in Phorum 5.1.20",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/466286/100/0/threaded"
},
{
"name": "2617",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/2617"
},
{
"name": "23616",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/23616"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-2249",
"datePublished": "2007-04-25T16:00:00",
"dateReserved": "2007-04-25T00:00:00",
"dateUpdated": "2024-08-07T13:33:28.286Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2011-3768
Vulnerability from cvelistv5
Published
2011-09-24 00:00
Modified
2024-08-06 23:46
Severity ?
EPSS score ?
Summary
Phorum 5.2.15a allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by css.php and certain other files.
References
| ▼ | URL | Tags |
|---|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/70604 | vdb-entry, x_refsource_XF | |
| http://www.openwall.com/lists/oss-security/2011/06/27/6 | mailing-list, x_refsource_MLIST | |
| http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README | x_refsource_MISC | |
| http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/phorum-5.2.15a | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T23:46:02.998Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "phorum-css-path-disclosure(70604)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/70604"
},
{
"name": "[oss-security] 20110627 Re: CVE request: Joomla unspecified information disclosure vulnerability",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2011/06/27/6"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/phorum-5.2.15a"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2011-06-27T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Phorum 5.2.15a allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by css.php and certain other files."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "phorum-css-path-disclosure(70604)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/70604"
},
{
"name": "[oss-security] 20110627 Re: CVE request: Joomla unspecified information disclosure vulnerability",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2011/06/27/6"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/phorum-5.2.15a"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-3768",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Phorum 5.2.15a allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by css.php and certain other files."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "phorum-css-path-disclosure(70604)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/70604"
},
{
"name": "[oss-security] 20110627 Re: CVE request: Joomla unspecified information disclosure vulnerability",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2011/06/27/6"
},
{
"name": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README",
"refsource": "MISC",
"url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README"
},
{
"name": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/phorum-5.2.15a",
"refsource": "MISC",
"url": "http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/phorum-5.2.15a"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-3768",
"datePublished": "2011-09-24T00:00:00",
"dateReserved": "2011-09-23T00:00:00",
"dateUpdated": "2024-08-06T23:46:02.998Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2004-2241
Vulnerability from cvelistv5
Published
2005-07-17 04:00
Modified
2024-08-08 01:22
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in Phorum 5.0.11 and earlier allows remote attackers to inject arbitrary HTML or web script via search.php. NOTE: some sources have reported that the affected file is read.php, but this is inconsistent with the vendor's patch.
References
| ▼ | URL | Tags |
|---|---|---|
| http://phorum.org/cvs-changelog-5.txt | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/11538 | vdb-entry, x_refsource_BID | |
| http://securitytracker.com/id?1011921 | vdb-entry, x_refsource_SECTRACK | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/17846 | vdb-entry, x_refsource_XF | |
| http://secunia.com/advisories/12980 | third-party-advisory, x_refsource_SECUNIA |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T01:22:13.226Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://phorum.org/cvs-changelog-5.txt"
},
{
"name": "11538",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/11538"
},
{
"name": "1011921",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1011921"
},
{
"name": "phorum-xss(17846)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17846"
},
{
"name": "12980",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/12980"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2004-10-26T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Phorum 5.0.11 and earlier allows remote attackers to inject arbitrary HTML or web script via search.php. NOTE: some sources have reported that the affected file is read.php, but this is inconsistent with the vendor\u0027s patch."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-07-10T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://phorum.org/cvs-changelog-5.txt"
},
{
"name": "11538",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/11538"
},
{
"name": "1011921",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1011921"
},
{
"name": "phorum-xss(17846)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17846"
},
{
"name": "12980",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/12980"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2004-2241",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Phorum 5.0.11 and earlier allows remote attackers to inject arbitrary HTML or web script via search.php. NOTE: some sources have reported that the affected file is read.php, but this is inconsistent with the vendor\u0027s patch."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://phorum.org/cvs-changelog-5.txt",
"refsource": "CONFIRM",
"url": "http://phorum.org/cvs-changelog-5.txt"
},
{
"name": "11538",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/11538"
},
{
"name": "1011921",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1011921"
},
{
"name": "phorum-xss(17846)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/17846"
},
{
"name": "12980",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/12980"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2004-2241",
"datePublished": "2005-07-17T04:00:00",
"dateReserved": "2005-07-17T00:00:00",
"dateUpdated": "2024-08-08T01:22:13.226Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2006-3053
Vulnerability from cvelistv5
Published
2006-06-16 10:00
Modified
2024-08-07 18:16
Severity ?
EPSS score ?
Summary
PHP remote file inclusion vulnerability in common.php in PHORUM 5.1.13 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the PHORUM[http_path] parameter. NOTE: this issue has been disputed by the vendor, who states "common.php is checked on the very first line of non-comment code that it is not being called directly. It has been this way in all 5.x version of Phorum." CVE analysis concurs with the vendor
References
| ▼ | URL | Tags |
|---|---|---|
| http://securityreason.com/securityalert/1103 | third-party-advisory, x_refsource_SREASON | |
| http://www.securityfocus.com/bid/16977 | vdb-entry, x_refsource_BID | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/27064 | vdb-entry, x_refsource_XF | |
| http://www.securityfocus.com/archive/1/437988/100/0/threaded | mailing-list, x_refsource_BUGTRAQ | |
| http://www.securityfocus.com/archive/1/436863/100/0/threaded | mailing-list, x_refsource_BUGTRAQ |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T18:16:05.376Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "1103",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/1103"
},
{
"name": "16977",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/16977"
},
{
"name": "phorum-common-file-include(27064)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27064"
},
{
"name": "20060619 Re: # MHG Security Team --- PHORUM 5.1.13 Remote File Inc.",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/437988/100/0/threaded"
},
{
"name": "20060611 # MHG Security Team --- PHORUM 5.1.13 Remote File Inc.",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/436863/100/0/threaded"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-06-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "PHP remote file inclusion vulnerability in common.php in PHORUM 5.1.13 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the PHORUM[http_path] parameter. NOTE: this issue has been disputed by the vendor, who states \"common.php is checked on the very first line of non-comment code that it is not being called directly. It has been this way in all 5.x version of Phorum.\" CVE analysis concurs with the vendor"
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-18T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "1103",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/1103"
},
{
"name": "16977",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/16977"
},
{
"name": "phorum-common-file-include(27064)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27064"
},
{
"name": "20060619 Re: # MHG Security Team --- PHORUM 5.1.13 Remote File Inc.",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/437988/100/0/threaded"
},
{
"name": "20060611 # MHG Security Team --- PHORUM 5.1.13 Remote File Inc.",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/436863/100/0/threaded"
}
],
"tags": [
"disputed"
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-3053",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** DISPUTED ** PHP remote file inclusion vulnerability in common.php in PHORUM 5.1.13 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the PHORUM[http_path] parameter. NOTE: this issue has been disputed by the vendor, who states \"common.php is checked on the very first line of non-comment code that it is not being called directly. It has been this way in all 5.x version of Phorum.\" CVE analysis concurs with the vendor."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "1103",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/1103"
},
{
"name": "16977",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/16977"
},
{
"name": "phorum-common-file-include(27064)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/27064"
},
{
"name": "20060619 Re: # MHG Security Team --- PHORUM 5.1.13 Remote File Inc.",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/437988/100/0/threaded"
},
{
"name": "20060611 # MHG Security Team --- PHORUM 5.1.13 Remote File Inc.",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/436863/100/0/threaded"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-3053",
"datePublished": "2006-06-16T10:00:00",
"dateReserved": "2006-06-16T00:00:00",
"dateUpdated": "2024-08-07T18:16:05.376Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2003-1466
Vulnerability from cvelistv5
Published
2007-10-24 23:00
Modified
2024-08-08 02:28
Severity ?
EPSS score ?
Summary
Unspecified vulnerability in Phorum 3.4 through 3.4.2 allows remote attackers to use Phorum as a connection proxy to other sites via (1) register.php or (2) login.php.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/7583 | vdb-entry, x_refsource_BID | |
| http://www.securityfocus.com/bid/7581 | vdb-entry, x_refsource_BID | |
| http://securityreason.com/securityalert/3288 | third-party-advisory, x_refsource_SREASON | |
| http://www.securityfocus.com/archive/1/321310 | mailing-list, x_refsource_BUGTRAQ |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T02:28:03.565Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "7583",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/7583"
},
{
"name": "7581",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/7581"
},
{
"name": "3288",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/3288"
},
{
"name": "20030513 Phorum Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/321310"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2003-05-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Unspecified vulnerability in Phorum 3.4 through 3.4.2 allows remote attackers to use Phorum as a connection proxy to other sites via (1) register.php or (2) login.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2007-11-28T10:00:00",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "7583",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/7583"
},
{
"name": "7581",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/7581"
},
{
"name": "3288",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/3288"
},
{
"name": "20030513 Phorum Vulnerabilities",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/321310"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2003-1466",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Unspecified vulnerability in Phorum 3.4 through 3.4.2 allows remote attackers to use Phorum as a connection proxy to other sites via (1) register.php or (2) login.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "7583",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/7583"
},
{
"name": "7581",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/7581"
},
{
"name": "3288",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/3288"
},
{
"name": "20030513 Phorum Vulnerabilities",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/321310"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2003-1466",
"datePublished": "2007-10-24T23:00:00",
"dateReserved": "2007-10-24T00:00:00",
"dateUpdated": "2024-08-08T02:28:03.565Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2000-1232
Vulnerability from cvelistv5
Published
2005-07-14 04:00
Modified
2024-09-17 02:26
Severity ?
EPSS score ?
Summary
upgrade.php3 in Phorum 3.0.7 could allow remote attackers to modify certain Phorum database tables via an unknown method.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm | x_refsource_MISC | |
| http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html | mailing-list, x_refsource_BUGTRAQ | |
| http://hispahack.ccc.de/mi020.html | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-08T05:45:37.523Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm"
},
{
"name": "20000106 Phorum 3.0.7 exploits and IDS signatures",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://hispahack.ccc.de/mi020.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "upgrade.php3 in Phorum 3.0.7 could allow remote attackers to modify certain Phorum database tables via an unknown method."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2005-07-14T04:00:00Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm"
},
{
"name": "20000106 Phorum 3.0.7 exploits and IDS signatures",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://hispahack.ccc.de/mi020.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2000-1232",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "upgrade.php3 in Phorum 3.0.7 could allow remote attackers to modify certain Phorum database tables via an unknown method."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm",
"refsource": "MISC",
"url": "http://www.digitalsec.net/stuff/z-mirrors/hispahack/mi020.htm"
},
{
"name": "20000106 Phorum 3.0.7 exploits and IDS signatures",
"refsource": "BUGTRAQ",
"url": "http://cert.uni-stuttgart.de/archive/bugtraq/2000/01/msg00215.html"
},
{
"name": "http://hispahack.ccc.de/mi020.html",
"refsource": "MISC",
"url": "http://hispahack.ccc.de/mi020.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2000-1232",
"datePublished": "2005-07-14T04:00:00Z",
"dateReserved": "2005-07-14T00:00:00Z",
"dateUpdated": "2024-09-17T02:26:38.040Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2007-2339
Vulnerability from cvelistv5
Published
2007-04-27 16:00
Modified
2024-08-07 13:33
Severity ?
EPSS score ?
Summary
Multiple SQL injection vulnerabilities in Phorum before 5.1.22 allow remote attackers to execute arbitrary SQL commands via (1) a modified recipients parameter name in (a) pm.php; (2) the curr parameter to the (b) badwords (aka censorlist) or (c) banlist module in admin.php; or (3) the "Edit groups / Add group" field in the (d) groups module in admin.php.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.waraxe.us/advisory-49.html | x_refsource_MISC | |
| http://www.phorum.org/story.php?76 | x_refsource_CONFIRM | |
| http://securitytracker.com/id?1017936 | vdb-entry, x_refsource_SECTRACK | |
| http://osvdb.org/35062 | vdb-entry, x_refsource_OSVDB | |
| http://www.vupen.com/english/advisories/2007/1479 | vdb-entry, x_refsource_VUPEN | |
| http://secunia.com/advisories/24932 | third-party-advisory, x_refsource_SECUNIA | |
| http://www.securityfocus.com/archive/1/466286/100/0/threaded | mailing-list, x_refsource_BUGTRAQ | |
| http://securityreason.com/securityalert/2617 | third-party-advisory, x_refsource_SREASON | |
| http://www.securityfocus.com/bid/23616 | vdb-entry, x_refsource_BID | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/34081 | vdb-entry, x_refsource_XF | |
| http://osvdb.org/35064 | vdb-entry, x_refsource_OSVDB | |
| http://osvdb.org/35063 | vdb-entry, x_refsource_OSVDB |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T13:33:28.718Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.waraxe.us/advisory-49.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.phorum.org/story.php?76"
},
{
"name": "1017936",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK",
"x_transferred"
],
"url": "http://securitytracker.com/id?1017936"
},
{
"name": "35062",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/35062"
},
{
"name": "ADV-2007-1479",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2007/1479"
},
{
"name": "24932",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/24932"
},
{
"name": "20070419 [waraxe-2007-SA#049] - Multiple vulnerabilities in Phorum 5.1.20",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ",
"x_transferred"
],
"url": "http://www.securityfocus.com/archive/1/466286/100/0/threaded"
},
{
"name": "2617",
"tags": [
"third-party-advisory",
"x_refsource_SREASON",
"x_transferred"
],
"url": "http://securityreason.com/securityalert/2617"
},
{
"name": "23616",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/23616"
},
{
"name": "phorum-multiple-scripts-sql-injection(34081)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34081"
},
{
"name": "35064",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/35064"
},
{
"name": "35063",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/35063"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2007-04-19T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Multiple SQL injection vulnerabilities in Phorum before 5.1.22 allow remote attackers to execute arbitrary SQL commands via (1) a modified recipients parameter name in (a) pm.php; (2) the curr parameter to the (b) badwords (aka censorlist) or (c) banlist module in admin.php; or (3) the \"Edit groups / Add group\" field in the (d) groups module in admin.php."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-16T14:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.waraxe.us/advisory-49.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.phorum.org/story.php?76"
},
{
"name": "1017936",
"tags": [
"vdb-entry",
"x_refsource_SECTRACK"
],
"url": "http://securitytracker.com/id?1017936"
},
{
"name": "35062",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/35062"
},
{
"name": "ADV-2007-1479",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2007/1479"
},
{
"name": "24932",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/24932"
},
{
"name": "20070419 [waraxe-2007-SA#049] - Multiple vulnerabilities in Phorum 5.1.20",
"tags": [
"mailing-list",
"x_refsource_BUGTRAQ"
],
"url": "http://www.securityfocus.com/archive/1/466286/100/0/threaded"
},
{
"name": "2617",
"tags": [
"third-party-advisory",
"x_refsource_SREASON"
],
"url": "http://securityreason.com/securityalert/2617"
},
{
"name": "23616",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/23616"
},
{
"name": "phorum-multiple-scripts-sql-injection(34081)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34081"
},
{
"name": "35064",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/35064"
},
{
"name": "35063",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/35063"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-2339",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple SQL injection vulnerabilities in Phorum before 5.1.22 allow remote attackers to execute arbitrary SQL commands via (1) a modified recipients parameter name in (a) pm.php; (2) the curr parameter to the (b) badwords (aka censorlist) or (c) banlist module in admin.php; or (3) the \"Edit groups / Add group\" field in the (d) groups module in admin.php."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.waraxe.us/advisory-49.html",
"refsource": "MISC",
"url": "http://www.waraxe.us/advisory-49.html"
},
{
"name": "http://www.phorum.org/story.php?76",
"refsource": "CONFIRM",
"url": "http://www.phorum.org/story.php?76"
},
{
"name": "1017936",
"refsource": "SECTRACK",
"url": "http://securitytracker.com/id?1017936"
},
{
"name": "35062",
"refsource": "OSVDB",
"url": "http://osvdb.org/35062"
},
{
"name": "ADV-2007-1479",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/1479"
},
{
"name": "24932",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/24932"
},
{
"name": "20070419 [waraxe-2007-SA#049] - Multiple vulnerabilities in Phorum 5.1.20",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/466286/100/0/threaded"
},
{
"name": "2617",
"refsource": "SREASON",
"url": "http://securityreason.com/securityalert/2617"
},
{
"name": "23616",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/23616"
},
{
"name": "phorum-multiple-scripts-sql-injection(34081)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34081"
},
{
"name": "35064",
"refsource": "OSVDB",
"url": "http://osvdb.org/35064"
},
{
"name": "35063",
"refsource": "OSVDB",
"url": "http://osvdb.org/35063"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2007-2339",
"datePublished": "2007-04-27T16:00:00",
"dateReserved": "2007-04-27T00:00:00",
"dateUpdated": "2024-08-07T13:33:28.718Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
jvndb-2006-000627
Vulnerability from jvndb
Published
2008-05-21 00:00
Modified
2008-05-21 00:00
Summary
Phorum cross-site scripting vulnerability
Details
Phorum, an open source message board system, contains a cross-site scripting vulnerability.
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2006/JVNDB-2006-000627.html",
"dc:date": "2008-05-21T00:00+09:00",
"dcterms:issued": "2008-05-21T00:00+09:00",
"dcterms:modified": "2008-05-21T00:00+09:00",
"description": "Phorum, an open source message board system, contains a cross-site scripting vulnerability.",
"link": "https://jvndb.jvn.jp/en/contents/2006/JVNDB-2006-000627.html",
"sec:cpe": {
"#text": "cpe:/a:phorum:phorum",
"@product": "Phorum",
"@vendor": "Phorum",
"@version": "2.2"
},
"sec:cvss": {
"@score": "4.3",
"@severity": "Medium",
"@type": "Base",
"@vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"@version": "2.0"
},
"sec:identifier": "JVNDB-2006-000627",
"sec:references": {
"#text": "http://jvn.jp/en/jp/JVN76207423/index.html",
"@id": "JVN#76207423",
"@source": "JVN"
},
"title": "Phorum cross-site scripting vulnerability"
}
jvndb-2011-000068
Vulnerability from jvndb
Published
2011-09-02 19:11
Modified
2011-09-02 19:11
Summary
Multiple vulnerabilities in Phorum
Details
Phorum contains multiple vulnerabilities.
Phorum is a message board software. Phorum contains cross-site request forgery and cross-site scripting vulnerabilities.
Daiki Fukumori of Cyber Defense Institute, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
References
| ▼ | Type | URL |
|---|---|---|
| JVN | https://jvn.jp/en/jp/JVN71435255/index.html | |
| CVE | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3381 | |
| CVE | http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3382 | |
| NVD | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3381 | |
| NVD | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3382 | |
| Cross-Site Request Forgery(CWE-352) | https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html | |
| Cross-site Scripting(CWE-79) | https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html |
{
"@rdf:about": "https://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000068.html",
"dc:date": "2011-09-02T19:11+09:00",
"dcterms:issued": "2011-09-02T19:11+09:00",
"dcterms:modified": "2011-09-02T19:11+09:00",
"description": "Phorum contains multiple vulnerabilities.\r\n\r\nPhorum is a message board software. Phorum contains cross-site request forgery and cross-site scripting vulnerabilities.\r\n\r\nDaiki Fukumori of Cyber Defense Institute, Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
"link": "https://jvndb.jvn.jp/en/contents/2011/JVNDB-2011-000068.html",
"sec:cpe": {
"#text": "cpe:/a:phorum:phorum",
"@product": "Phorum",
"@vendor": "Phorum",
"@version": "2.2"
},
"sec:cvss": {
"@score": "2.6",
"@severity": "Low",
"@type": "Base",
"@vector": "AV:N/AC:H/Au:N/C:N/I:P/A:N",
"@version": "2.0"
},
"sec:identifier": "JVNDB-2011-000068",
"sec:references": [
{
"#text": "https://jvn.jp/en/jp/JVN71435255/index.html",
"@id": "JVN#71435255",
"@source": "JVN"
},
{
"#text": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3381",
"@id": "CVE-2011-3381",
"@source": "CVE"
},
{
"#text": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3382",
"@id": "CVE-2011-3382",
"@source": "CVE"
},
{
"#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3381",
"@id": "CVE-2011-3381",
"@source": "NVD"
},
{
"#text": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-3382",
"@id": "CVE-2011-3382",
"@source": "NVD"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-352",
"@title": "Cross-Site Request Forgery(CWE-352)"
},
{
"#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
"@id": "CWE-79",
"@title": "Cross-site Scripting(CWE-79)"
}
],
"title": "Multiple vulnerabilities in Phorum"
}