vBulletin 5.5.4

CPE Details

vBulletin 5.5.4
vbulletin
vbulletin
5.5.4
2019-09-25
13h54 +00:00
2019-09-25
13h54 +00:00
CPE NVD
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
Gestion des notifications

CPE Name: cpe:2.3:a:vbulletin:vbulletin:5.5.4:*:*:*:*:*:*:*

Informations

Vendor

vbulletin

Product

vbulletin

Version

5.5.4

Related CVE

Open and find in CVE List

CVE ID Publié Description Score Gravité
CVE-2023-39777 2023-09-15 22h00 +00:00 A cross-site scripting (XSS) vulnerability in the Admin Control Panel of vBulletin 5.7.5 and 6.0.0 allows attackers to execute arbitrary web scripts or HTML via the /login.php?do=login url parameter.
5.4
Moyen
CVE-2020-7373 2020-10-30 15h50 +00:00 vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759. ALSO NOTE: CVE-2020-7373 is a duplicate of CVE-2020-17496. CVE-2020-17496 is the preferred CVE ID to track this vulnerability.
9.8
Critique
CVE-2020-17496 2020-08-12 13h07 +00:00 vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759.
9.8
Critique
CVE-2020-12720 2020-05-07 21h52 +00:00 vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control.
9.8
Critique
CVE-2019-17271 2019-10-08 10h26 +00:00 vBulletin 5.5.4 allows SQL Injection via the ajax/api/hook/getHookList or ajax/api/widget/getWidgetList where parameter.
4.9
Moyen
CVE-2019-17132 2019-10-04 09h36 +00:00 vBulletin through 5.5.4 mishandles custom avatars.
9.8
Critique
CVE-2019-17130 2019-10-04 09h36 +00:00 vBulletin through 5.5.4 mishandles external URLs within the /core/vb/vurl.php file and the /core/vb/vurl directories.
6.5
Moyen
CVE-2019-16759 2019-09-24 21h01 +00:00 vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig[code] parameter in an ajax/render/widget_php routestring request.
9.8
Critique
CVE-2010-1077 2010-03-23 18h00 +00:00 Directory traversal vulnerability in vbseo.php in Crawlability vBSEO plugin 3.1.0 for vBulletin allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the vbseourl parameter.
6.8