vBulletin 4.2.2 Patch Level 6

CPE Details

vBulletin 4.2.2 Patch Level 6
vbulletin
vbulletin
4.2.2
2019-06-20
11h30 +00:00
2019-06-20
11h30 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:vbulletin:vbulletin:4.2.2:patch_level_6:*:*:*:*:*:*

Informations

Vendor

vbulletin

Product

vbulletin

Version

4.2.2

Update

patch_level_6

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2023-39777 2023-09-15 22h00 +00:00 A cross-site scripting (XSS) vulnerability in the Admin Control Panel of vBulletin 5.7.5 and 6.0.0 allows attackers to execute arbitrary web scripts or HTML via the /login.php?do=login url parameter.
5.4
Medium
CVE-2019-17271 2019-10-08 10h26 +00:00 vBulletin 5.5.4 allows SQL Injection via the ajax/api/hook/getHookList or ajax/api/widget/getWidgetList where parameter.
4.9
Medium
CVE-2019-17132 2019-10-04 09h36 +00:00 vBulletin through 5.5.4 mishandles custom avatars.
9.8
Critical
CVE-2019-17131 2019-10-04 09h36 +00:00 vBulletin before 5.5.4 allows clickjacking.
4.3
Medium
CVE-2019-17130 2019-10-04 09h36 +00:00 vBulletin through 5.5.4 mishandles external URLs within the /core/vb/vurl.php file and the /core/vb/vurl directories.
6.5
Medium
CVE-2018-6200 2018-01-25 04h00 +00:00 vBulletin 3.x.x and 4.2.x through 4.2.5 has an open redirect via the redirector.php url parameter.
6.1
Medium
CVE-2014-9463 2017-09-15 18h00 +00:00 functions_vbseo_hook.php in the VBSEO module for vBulletin allows remote authenticated users to execute arbitrary code via the HTTP Referer header to visitormessage.php.
8.8
High
CVE-2014-9469 2017-08-28 13h00 +00:00 Cross-site scripting (XSS) vulnerability in vBulletin 3.5.4, 3.6.0, 3.6.7, 3.8.7, 4.2.2, 5.0.5, and 5.1.3.
6.1
Medium
CVE-2017-7569 2017-04-06 17h00 +00:00 In vBulletin before 5.3.0, remote attackers can bypass the CVE-2016-6483 patch and conduct SSRF attacks by leveraging the behavior of the PHP parse_url function, aka VBV-17037.
8.6
High
CVE-2016-6483 2016-09-01 23h00 +00:00 The media-file upload feature in vBulletin before 3.8.7 Patch Level 6, 3.8.8 before Patch Level 2, 3.8.9 before Patch Level 1, 4.x before 4.2.2 Patch Level 6, 4.2.3 before Patch Level 2, 5.x before 5.2.0 Patch Level 3, 5.2.1 before Patch Level 1, and 5.2.2 before Patch Level 1 allows remote attackers to conduct SSRF attacks via a crafted URL that results in a Redirection HTTP status code.
8.6
High
CVE-2014-9438 2015-01-02 18h00 +00:00 Cross-site request forgery (CSRF) vulnerability in the Moderator Control Panel in vBulletin 4.2.2 allows remote attackers to hijack the authentication of administrators for requests that (1) ban a user via the username parameter in a dobanuser action to modcp/banning.php or (2) unban a user, (3) modify user profiles, edit a (4) post or (5) topic, or approve a (6) post or (7) topic via unspecified vectors.
6.8
CVE-2014-2021 2014-10-24 22h00 +00:00 Cross-site scripting (XSS) vulnerability in admincp/apilog.php in vBulletin 4.2.2 and earlier, and 5.0.x through 5.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted XMLRPC API request, as demonstrated using the client name.
3.5
CVE-2014-2022 2014-10-15 12h00 +00:00 SQL injection vulnerability in includes/api/4/breadcrumbs_create.php in vBulletin 4.2.2, 4.2.1, 4.2.0 PL2, and earlier allows remote authenticated users to execute arbitrary SQL commands via the conceptid argument in an xmlrpc API request.
7.1
CVE-2010-1077 2010-03-23 18h00 +00:00 Directory traversal vulnerability in vbseo.php in Crawlability vBSEO plugin 3.1.0 for vBulletin allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the vbseourl parameter.
6.8