vBulletin 5.1.0

CPE Details

vBulletin 5.1.0
vbulletin
vbulletin
5.1.0
2014-07-28
15h25 +00:00
2020-09-03
18h32 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:vbulletin:vbulletin:5.1.0:*:*:*:*:*:*:*

Informations

Vendor

vbulletin

Product

vbulletin

Version

5.1.0

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2023-39777 2023-09-15 22h00 +00:00 A cross-site scripting (XSS) vulnerability in the Admin Control Panel of vBulletin 5.7.5 and 6.0.0 allows attackers to execute arbitrary web scripts or HTML via the /login.php?do=login url parameter.
5.4
Medium
CVE-2020-12720 2020-05-07 21h52 +00:00 vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control.
9.8
Critical
CVE-2019-17271 2019-10-08 10h26 +00:00 vBulletin 5.5.4 allows SQL Injection via the ajax/api/hook/getHookList or ajax/api/widget/getWidgetList where parameter.
4.9
Medium
CVE-2019-17132 2019-10-04 09h36 +00:00 vBulletin through 5.5.4 mishandles custom avatars.
9.8
Critical
CVE-2019-17131 2019-10-04 09h36 +00:00 vBulletin before 5.5.4 allows clickjacking.
4.3
Medium
CVE-2019-17130 2019-10-04 09h36 +00:00 vBulletin through 5.5.4 mishandles external URLs within the /core/vb/vurl.php file and the /core/vb/vurl directories.
6.5
Medium
CVE-2019-16759 2019-09-24 21h01 +00:00 vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.
9.8
Critical
CVE-2017-17671 2017-12-13 23h00 +00:00 vBulletin through 5.3.x on Windows allows remote PHP code execution because a require_once call is reachable with an unauthenticated request that can include directory traversal sequences to specify an arbitrary pathname, and because ../ traversal is blocked but ..\ traversal is not blocked. For example, an attacker can make an invalid HTTP request containing PHP code, and then make an index.php?routestring= request with enough instances of ".." to reach an Apache HTTP Server log file.
9.8
Critical
CVE-2017-17672 2017-12-13 23h00 +00:00 In vBulletin through 5.3.x, there is an unauthenticated deserialization vulnerability that leads to arbitrary file deletion and, under certain circumstances, code execution, because of unsafe usage of PHP's unserialize() in vB_Library_Template's cacheTemplates() function, which is a publicly exposed API. This is exploited with the templateidlist parameter to ajax/api/template/cacheTemplates.
9.8
Critical
CVE-2015-3419 2017-09-19 13h00 +00:00 vBulletin 5.x through 5.1.6 allows remote authenticated users to bypass authorization checks and inject private messages into conversations via vectors related to an input validation failure.
6.5
Medium
CVE-2017-7569 2017-04-06 17h00 +00:00 In vBulletin before 5.3.0, remote attackers can bypass the CVE-2016-6483 patch and conduct SSRF attacks by leveraging the behavior of the PHP parse_url function, aka VBV-17037.
8.6
High
CVE-2015-7808 2015-11-24 19h00 +00:00 The vB_Api_Hook::decodeArguments method in vBulletin 5 Connect 5.1.2 through 5.1.9 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object in the arguments parameter to ajax/api/hook/decodeArguments.
7.5
CVE-2014-5102 2014-07-25 17h00 +00:00 SQL injection vulnerability in vBulletin 5.0.4 through 5.1.3 Alpha 5 allows remote attackers to execute arbitrary SQL commands via the criteria[startswith] parameter to ajax/render/memberlist_items.
7.5
CVE-2010-1077 2010-03-23 18h00 +00:00 Directory traversal vulnerability in vbseo.php in Crawlability vBSEO plugin 3.1.0 for vBulletin allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the vbseourl parameter.
6.8