Vulnerabilites related to vanillaforums - vanilla_forums
Vulnerability from fkie_nvd
Published
2021-06-22 14:15
Modified
2024-11-21 01:20
Severity ?
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
It was found in vanilla forums before 2.0.10 a potential linkbait vulnerability in dispatcher.
References
secalert@redhat.comhttps://open.vanillaforums.com/discussion/13119/vanilla-2.0.10-released/p1Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://open.vanillaforums.com/discussion/13119/vanilla-2.0.10-released/p1Vendor Advisory
Impacted products
Vendor Product Version
vanillaforums vanilla_forums *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla_forums:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B8DF1E29-0EE2-454C-92CA-62A3A0F0E5DA",
              "versionEndExcluding": "2.0.10",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "It was found in vanilla forums before 2.0.10 a potential linkbait vulnerability in dispatcher."
    },
    {
      "lang": "es",
      "value": "Se encontr\u00f3 en vanilla forums versiones anteriores a 2.0.10, una potencial vulnerabilidad de linkbait en dispatcher"
    }
  ],
  "id": "CVE-2010-4266",
  "lastModified": "2024-11-21T01:20:34.680",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 4.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-06-22T14:15:08.370",
  "references": [
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://open.vanillaforums.com/discussion/13119/vanilla-2.0.10-released/p1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://open.vanillaforums.com/discussion/13119/vanilla-2.0.10-released/p1"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ],
      "source": "secalert@redhat.com",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2015-02-25 22:59
Modified
2025-04-12 10:46
Severity ?
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Vanilla Forums before 2.0.18.13 and 2.1.x before 2.1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
cve@mitre.orghttp://vanillaforums.org/discussion/27540/vanilla-2-1-1-important-security-bug-releasePatch, Vendor Advisory
cve@mitre.orghttp://vanillaforums.org/discussion/27541/vanilla-2-0-18-12-security-release-for-old-2-0-18-installsPatch, Vendor Advisory
cve@mitre.orghttp://www.securitytracker.com/id/1031822
af854a3a-2127-422b-91ae-364da2661108http://vanillaforums.org/discussion/27540/vanilla-2-1-1-important-security-bug-releasePatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://vanillaforums.org/discussion/27541/vanilla-2-0-18-12-security-release-for-old-2-0-18-installsPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1031822
Impacted products
Vendor Product Version
vanillaforums vanilla *
vanillaforums vanilla_forums 2.1


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C91387CD-1F56-4590-A890-526C40946CBD",
              "versionEndIncluding": "2.0.18.12",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla_forums:2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "D2BC24DF-EBC7-4AA4-A4D2-E8AE35BC0032",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple cross-site scripting (XSS) vulnerabilities in Vanilla Forums before 2.0.18.13 and 2.1.x before 2.1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples vulnerabilidades de XSS en Vanilla Forums anterior a 2.0.18.13 y 2.1.x anterior a 2.1.1 permiten a atacantes remotos inyectar secuencias de comandos web arbitrarios o HTML a trav\u00e9s de vectores no especificados."
    }
  ],
  "id": "CVE-2014-9685",
  "lastModified": "2025-04-12T10:46:40.837",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2015-02-25T22:59:00.047",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://vanillaforums.org/discussion/27540/vanilla-2-1-1-important-security-bug-release"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://vanillaforums.org/discussion/27541/vanilla-2-0-18-12-security-release-for-old-2-0-18-installs"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securitytracker.com/id/1031822"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://vanillaforums.org/discussion/27540/vanilla-2-1-1-important-security-bug-release"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "http://vanillaforums.org/discussion/27541/vanilla-2-0-18-12-security-release-for-old-2-0-18-installs"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securitytracker.com/id/1031822"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2019-03-02 01:29
Modified
2024-11-21 04:49
Severity ?
5.4 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Summary
Multiple stored XSS in Vanilla Forums before 2.5 allow remote attackers to inject arbitrary JavaScript code into any message on forum.
References
vulnerability@kaspersky.comhttps://scriptinjection.blogspot.com/2019/02/vanilla-forums-25-stored-xss-in-any.htmlExploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://scriptinjection.blogspot.com/2019/02/vanilla-forums-25-stored-xss-in-any.htmlExploit, Third Party Advisory
Impacted products
Vendor Product Version
vanillaforums vanilla_forums *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla_forums:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E55B7050-8F53-4CDB-AE0B-68728D92AEC3",
              "versionEndExcluding": "2.5.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple stored XSS in Vanilla Forums before 2.5 allow remote attackers to inject arbitrary JavaScript code into any message on forum."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples Cross-Site Scripting (XSS) persistentes en Vanilla Forums, en versiones anteriores a la 2.5, permiten que los atacantes remotos inyecten c\u00f3digo JavaScript arbitrario en cualquier mensaje del foro."
    }
  ],
  "id": "CVE-2019-8279",
  "lastModified": "2024-11-21T04:49:38.323",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 3.5,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 6.8,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2019-03-02T01:29:00.357",
  "references": [
    {
      "source": "vulnerability@kaspersky.com",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://scriptinjection.blogspot.com/2019/02/vanilla-forums-25-stored-xss-in-any.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "url": "https://scriptinjection.blogspot.com/2019/02/vanilla-forums-25-stored-xss-in-any.html"
    }
  ],
  "sourceIdentifier": "vulnerability@kaspersky.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2018-01-02 23:29
Modified
2024-11-21 03:04
Severity ?
8.0 (High) - CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Summary
Vanilla Forums below 2.1.5 are affected by CSRF leading to Deleting topics and comments from forums Admin access
References
cve@mitre.orghttps://open.vanillaforums.com/discussion/28337/vanilla-2-1-5-released-and-2-0-18-14Issue Tracking, Release Notes
cve@mitre.orghttps://www.exploit-db.com/exploits/43462/Exploit, Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://open.vanillaforums.com/discussion/28337/vanilla-2-1-5-released-and-2-0-18-14Issue Tracking, Release Notes
af854a3a-2127-422b-91ae-364da2661108https://www.exploit-db.com/exploits/43462/Exploit, Third Party Advisory, VDB Entry
Impacted products
Vendor Product Version
vanillaforums vanilla_forums *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla_forums:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DF8BEF7A-6506-42AE-B970-9407C0A68F30",
              "versionEndExcluding": "2.1.5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Vanilla Forums below 2.1.5 are affected by CSRF leading to Deleting topics and comments from forums Admin access"
    },
    {
      "lang": "es",
      "value": "Vanilla Forums, en versiones anteriores a la 2.1.5, se ha visto afectado por CSRF. Esto conduce a la eliminaci\u00f3n de temas y comentarios de los foros con acceso Admin."
    }
  ],
  "id": "CVE-2017-1000432",
  "lastModified": "2024-11-21T03:04:43.840",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 6.8,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.0,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2018-01-02T23:29:00.303",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Issue Tracking",
        "Release Notes"
      ],
      "url": "https://open.vanillaforums.com/discussion/28337/vanilla-2-1-5-released-and-2-0-18-14"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://www.exploit-db.com/exploits/43462/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Release Notes"
      ],
      "url": "https://open.vanillaforums.com/discussion/28337/vanilla-2-1-5-released-and-2-0-18-14"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "https://www.exploit-db.com/exploits/43462/"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2021-06-22 14:15
Modified
2024-11-21 01:20
Severity ?
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
It was found in vanilla forums before 2.0.10 a cross-site scripting vulnerability where a filename could contain arbitrary code to execute on the client side.
References
secalert@redhat.comhttps://github.com/vanilla/vanilla/commit/4535a059e4e24ca11a2ef0b4d754f262398bcecePatch, Third Party Advisory
secalert@redhat.comhttps://seclists.org/oss-sec/2010/q4/282Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/vanilla/vanilla/commit/4535a059e4e24ca11a2ef0b4d754f262398bcecePatch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://seclists.org/oss-sec/2010/q4/282Mailing List, Third Party Advisory
Impacted products
Vendor Product Version
vanillaforums vanilla_forums *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla_forums:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B8DF1E29-0EE2-454C-92CA-62A3A0F0E5DA",
              "versionEndExcluding": "2.0.10",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "It was found in vanilla forums before 2.0.10 a cross-site scripting vulnerability where a filename could contain arbitrary code to execute on the client side."
    },
    {
      "lang": "es",
      "value": "Se encontr\u00f3 en vanilla forums versiones anteriores a 2.0.10, una vulnerabilidad de tipo cross-site scripting donde un nombre de archivo podr\u00eda contener c\u00f3digo arbitrario para ejecutar en el lado del cliente"
    }
  ],
  "id": "CVE-2010-4264",
  "lastModified": "2024-11-21T01:20:34.447",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-06-22T14:15:08.167",
  "references": [
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/vanilla/vanilla/commit/4535a059e4e24ca11a2ef0b4d754f262398bcece"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://seclists.org/oss-sec/2010/q4/282"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/vanilla/vanilla/commit/4535a059e4e24ca11a2ef0b4d754f262398bcece"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "url": "https://seclists.org/oss-sec/2010/q4/282"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "secalert@redhat.com",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2018-08-26 17:29
Modified
2024-11-21 03:51
Severity ?
4.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Summary
In Vanilla before 2.6.1, the polling functionality allows Insecure Direct Object Reference (IDOR) via the Poll ID, leading to the ability of a single user to select multiple Poll Options (e.g., vote for multiple items).
References
cve@mitre.orghttps://hackerone.com/reports/326434Third Party Advisory
cve@mitre.orghttps://open.vanillaforums.com/discussion/36559Vendor Advisory
cve@mitre.orghttps://twitter.com/viperbluff/status/1033067882941304832Third Party Advisory
cve@mitre.orghttps://twitter.com/viperbluff/status/1033640333890834433Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://hackerone.com/reports/326434Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://open.vanillaforums.com/discussion/36559Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://twitter.com/viperbluff/status/1033067882941304832Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://twitter.com/viperbluff/status/1033640333890834433Third Party Advisory
Impacted products
Vendor Product Version
vanillaforums vanilla_forums *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla_forums:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "42F1AACE-618A-47A8-A98A-D4968347F43F",
              "versionEndExcluding": "2.6.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In Vanilla before 2.6.1, the polling functionality allows Insecure Direct Object Reference (IDOR) via the Poll ID, leading to the ability of a single user to select multiple Poll Options (e.g., vote for multiple items)."
    },
    {
      "lang": "es",
      "value": "En Vanilla en versiones anteriores a la 2.6.1, la funcionalidad de votaci\u00f3n permite un IDOR (referencia insegura directa a objeto) mediante el ID de la votaci\u00f3n, lo que conduce a la capacidad de un \u00fanico usuario para que seleccione m\u00faltiples opciones de votaci\u00f3n (p.ej., votar por m\u00faltiples \u00edtems)."
    }
  ],
  "id": "CVE-2018-15833",
  "lastModified": "2024-11-21T03:51:31.667",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 4.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2018-08-26T17:29:00.247",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://hackerone.com/reports/326434"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://open.vanillaforums.com/discussion/36559"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://twitter.com/viperbluff/status/1033067882941304832"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://twitter.com/viperbluff/status/1033640333890834433"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://hackerone.com/reports/326434"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://open.vanillaforums.com/discussion/36559"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://twitter.com/viperbluff/status/1033067882941304832"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://twitter.com/viperbluff/status/1033640333890834433"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Vulnerability from fkie_nvd
Published
2012-11-15 11:58
Modified
2025-04-11 00:51
Severity ?
Summary
The edit-profile page in Vanilla Forums before 2.1a32 allows remote authenticated users to modify arbitrary profile settings by replacing the UserID value during a man-in-the-middle attack, related to a "parameter manipulation" issue.
References
cret@cert.orghttp://www.kb.cert.org/vuls/id/611988US Government Resource
cret@cert.orghttp://www.securityfocus.com/bid/56483
cret@cert.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/80000
af854a3a-2127-422b-91ae-364da2661108http://www.kb.cert.org/vuls/id/611988US Government Resource
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/56483
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/80000
Impacted products
Vendor Product Version
vanillaforums vanilla *
vanillaforums vanilla 2.0.0
vanillaforums vanilla 2.0.1
vanillaforums vanilla 2.0.2
vanillaforums vanilla 2.0.3
vanillaforums vanilla 2.0.4
vanillaforums vanilla 2.0.5
vanillaforums vanilla 2.0.6
vanillaforums vanilla 2.0.7
vanillaforums vanilla 2.0.8
vanillaforums vanilla 2.0.9
vanillaforums vanilla 2.0.10
vanillaforums vanilla 2.0.11
vanillaforums vanilla 2.0.12
vanillaforums vanilla 2.0.13
vanillaforums vanilla 2.0.14
vanillaforums vanilla 2.0.15
vanillaforums vanilla 2.0.16
vanillaforums vanilla 2.0.16.1
vanillaforums vanilla 2.0.17
vanillaforums vanilla 2.0.17.1
vanillaforums vanilla 2.0.17.2
vanillaforums vanilla 2.0.17.3
vanillaforums vanilla 2.0.17.4
vanillaforums vanilla 2.0.17.5
vanillaforums vanilla 2.0.17.6
vanillaforums vanilla 2.0.17.7
vanillaforums vanilla 2.0.17.8
vanillaforums vanilla 2.0.17.9
vanillaforums vanilla 2.0.17.10
vanillaforums vanilla 2.0.18
vanillaforums vanilla 2.0.18
vanillaforums vanilla 2.0.18
vanillaforums vanilla 2.0.18
vanillaforums vanilla 2.0.18
vanillaforums vanilla 2.0.18
vanillaforums vanilla 2.0.18
vanillaforums vanilla 2.0.18
vanillaforums vanilla 2.0.18.1
vanillaforums vanilla 2.0.18.3
vanillaforums vanilla_forums *


To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "378B55A1-FFDD-4BB3-9E2A-7DC0F64A84E2",
              "versionEndIncluding": "2.0.18.4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:2.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "173BF8BD-1B30-404B-964D-1A487BD28624",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:2.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "DE1BDD28-B3D5-4CEF-B718-AEDB1BB85478",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:2.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "13A31A31-3D82-47B5-9FAE-4FCAD23E9FCA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:2.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "41C2DCAF-E514-473F-BA2F-0EEE9AE634D7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:2.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "A5F1392F-711D-4C0E-94C7-4467E50E9212",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:2.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "69041BD4-FE5A-4B02-BD1B-CEFA9604FE57",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:2.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "C77AE762-2955-447D-826B-D5DC2F62BE7C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:2.0.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "D7365AC0-3C35-43D4-AC8E-F64EEC0061F1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:2.0.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "49E55ABC-15E7-4002-9BE4-CF1F1A5EFB17",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:2.0.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "4AF565C5-1A0E-4C19-9354-FFBFA454B457",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:2.0.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "3B31A038-7B6A-43EB-B525-EF9CBB5F81C7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:2.0.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "57E4F91A-ED9A-4B98-80FF-6621237C285C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:2.0.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "0F3E2758-F9D3-46C5-9D32-FF284B91DA92",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:2.0.13:*:*:*:*:*:*:*",
              "matchCriteriaId": "27D49ACC-7D32-422F-916A-8B37512CA0FB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:2.0.14:*:*:*:*:*:*:*",
              "matchCriteriaId": "2F2BCC4D-DA3D-4EFE-A607-D03FCC7491E5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:2.0.15:*:*:*:*:*:*:*",
              "matchCriteriaId": "FC6FAD04-0DF7-4D32-8604-52A5C6C4C15E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:2.0.16:*:*:*:*:*:*:*",
              "matchCriteriaId": "EF88B68F-D781-41D3-92DD-672C432BA763",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:2.0.16.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "04C9B20F-E0E0-4A67-BF20-651655B88AAD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:2.0.17:*:*:*:*:*:*:*",
              "matchCriteriaId": "158E0328-3C61-4C95-B197-DE813DD0F810",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:2.0.17.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "585F5145-1342-4EAD-A9F9-065A9694D227",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:2.0.17.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "42800B41-380A-462A-8B21-9E014910D680",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:2.0.17.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "DB2B4009-09C3-49DD-AC10-D0D8F1CBE91A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:2.0.17.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "229FB439-E8BD-411B-B3B9-EF8A7EF20947",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:2.0.17.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "1C979A25-6BFF-4269-AE58-30363A45735F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:2.0.17.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "E6A9B704-61C1-4E6C-A3A1-9149E2A80B61",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:2.0.17.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "03EF7909-A01B-430D-903E-225E0A7335FA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:2.0.17.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "9D0ECC55-B2E5-433D-AA95-0E901B6D0343",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:2.0.17.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "3A800CA9-F408-45EA-8D11-F24F23E457D2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:2.0.17.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "9D65A488-2B65-42B9-B610-19AA705351AC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:2.0.18:*:*:*:*:*:*:*",
              "matchCriteriaId": "ED6C8E5D-1085-4D1F-820F-73A0F1D66481",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:2.0.18:alpha3:*:*:*:*:*:*",
              "matchCriteriaId": "E1E17588-DD2D-453D-BAC2-FB468D3CBDB1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:2.0.18:beta1:*:*:*:*:*:*",
              "matchCriteriaId": "7ECCCE34-CC7F-4B2D-9A6B-9FBC37F572A6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:2.0.18:beta2:*:*:*:*:*:*",
              "matchCriteriaId": "CE042198-0481-489B-A8EA-545367169659",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:2.0.18:beta4:*:*:*:*:*:*",
              "matchCriteriaId": "D521F90F-0F93-4E64-B43A-B4188532BE33",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:2.0.18:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "59936633-D176-4F25-B349-87F461C00B82",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:2.0.18:rc2:*:*:*:*:*:*",
              "matchCriteriaId": "355C6F2A-88FB-44CF-82E3-AEF60F9CA8AC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:2.0.18:rc3:*:*:*:*:*:*",
              "matchCriteriaId": "0B1AFB55-42FF-40EF-8BEB-11CDE65FBDDC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:2.0.18.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "94086F8C-5F24-4D95-9B20-10719C562ABF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla:2.0.18.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "F8BBE95A-1EF7-44F6-B94F-FD01E48CEF3C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:vanillaforums:vanilla_forums:*:a26:*:*:*:*:*:*",
              "matchCriteriaId": "4E60FE57-0A13-41DF-8C23-2CE4CD01DA86",
              "versionEndIncluding": "2.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The edit-profile page in Vanilla Forums before 2.1a32 allows remote authenticated users to modify arbitrary profile settings by replacing the UserID value during a man-in-the-middle attack, related to a \"parameter manipulation\" issue."
    },
    {
      "lang": "es",
      "value": "La p\u00e1gina de edici\u00f3n de perfil en Vanilla Forums antes de v2.1a32 permite a usuarios remotos autenticados modificar los ajustes de su perfil que desee sustituyendo el valor UserID durante un ataque man-in-the-middle. Se trata de un problema relacionado con una \"manipulaci\u00f3n de par\u00e1metros\".\r\n"
    }
  ],
  "id": "CVE-2012-4954",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 3.5,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 6.8,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2012-11-15T11:58:40.103",
  "references": [
    {
      "source": "cret@cert.org",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.kb.cert.org/vuls/id/611988"
    },
    {
      "source": "cret@cert.org",
      "url": "http://www.securityfocus.com/bid/56483"
    },
    {
      "source": "cret@cert.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80000"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "US Government Resource"
      ],
      "url": "http://www.kb.cert.org/vuls/id/611988"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/56483"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80000"
    }
  ],
  "sourceIdentifier": "cret@cert.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2019-8279 (GCVE-0-2019-8279)
Vulnerability from cvelistv5
Published
2019-03-02 01:00
Modified
2024-09-17 00:21
Severity ?
CWE
  • Multiple XSS
Summary
Multiple stored XSS in Vanilla Forums before 2.5 allow remote attackers to inject arbitrary JavaScript code into any message on forum.
References
Impacted products
Vendor Product Version
Kaspersky Lab Vanilla Forums Version: Before 2.5
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T21:17:30.787Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://scriptinjection.blogspot.com/2019/02/vanilla-forums-25-stored-xss-in-any.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Vanilla Forums",
          "vendor": "Kaspersky Lab",
          "versions": [
            {
              "status": "affected",
              "version": "Before 2.5"
            }
          ]
        }
      ],
      "datePublic": "2019-02-15T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple stored XSS in Vanilla Forums before 2.5 allow remote attackers to inject arbitrary JavaScript code into any message on forum."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Multiple XSS",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-03-02T00:57:01",
        "orgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
        "shortName": "Kaspersky"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://scriptinjection.blogspot.com/2019/02/vanilla-forums-25-stored-xss-in-any.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vulnerability@kaspersky.com",
          "DATE_PUBLIC": "2019-02-15T00:00:00",
          "ID": "CVE-2019-8279",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Vanilla Forums",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Before 2.5"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Kaspersky Lab"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple stored XSS in Vanilla Forums before 2.5 allow remote attackers to inject arbitrary JavaScript code into any message on forum."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Multiple XSS"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://scriptinjection.blogspot.com/2019/02/vanilla-forums-25-stored-xss-in-any.html",
              "refsource": "MISC",
              "url": "https://scriptinjection.blogspot.com/2019/02/vanilla-forums-25-stored-xss-in-any.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988",
    "assignerShortName": "Kaspersky",
    "cveId": "CVE-2019-8279",
    "datePublished": "2019-03-02T01:00:00Z",
    "dateReserved": "2019-02-12T00:00:00",
    "dateUpdated": "2024-09-17T00:21:56.165Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-1000432 (GCVE-0-2017-1000432)
Vulnerability from cvelistv5
Published
2018-01-02 23:00
Modified
2024-08-05 22:00
Severity ?
CWE
  • n/a
Summary
Vanilla Forums below 2.1.5 are affected by CSRF leading to Deleting topics and comments from forums Admin access
References
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T22:00:40.993Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "43462",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/43462/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://open.vanillaforums.com/discussion/28337/vanilla-2-1-5-released-and-2-0-18-14"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "dateAssigned": "2017-12-29T00:00:00",
      "datePublic": "2014-10-30T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Vanilla Forums below 2.1.5 are affected by CSRF leading to Deleting topics and comments from forums Admin access"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-11T10:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "43462",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/43462/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://open.vanillaforums.com/discussion/28337/vanilla-2-1-5-released-and-2-0-18-14"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "DATE_ASSIGNED": "2017-12-29",
          "ID": "CVE-2017-1000432",
          "REQUESTER": "anandkmr27@gmail.com",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Vanilla Forums below 2.1.5 are affected by CSRF leading to Deleting topics and comments from forums Admin access"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "43462",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/43462/"
            },
            {
              "name": "https://open.vanillaforums.com/discussion/28337/vanilla-2-1-5-released-and-2-0-18-14",
              "refsource": "CONFIRM",
              "url": "https://open.vanillaforums.com/discussion/28337/vanilla-2-1-5-released-and-2-0-18-14"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-1000432",
    "datePublished": "2018-01-02T23:00:00",
    "dateReserved": "2018-01-02T00:00:00",
    "dateUpdated": "2024-08-05T22:00:40.993Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2014-9685 (GCVE-0-2014-9685)
Vulnerability from cvelistv5
Published
2015-02-25 22:00
Modified
2024-08-06 13:55
Severity ?
CWE
  • n/a
Summary
Multiple cross-site scripting (XSS) vulnerabilities in Vanilla Forums before 2.0.18.13 and 2.1.x before 2.1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T13:55:04.611Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://vanillaforums.org/discussion/27540/vanilla-2-1-1-important-security-bug-release"
          },
          {
            "name": "1031822",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1031822"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://vanillaforums.org/discussion/27541/vanilla-2-0-18-12-security-release-for-old-2-0-18-installs"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-08-02T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple cross-site scripting (XSS) vulnerabilities in Vanilla Forums before 2.0.18.13 and 2.1.x before 2.1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2015-03-19T15:57:00",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://vanillaforums.org/discussion/27540/vanilla-2-1-1-important-security-bug-release"
        },
        {
          "name": "1031822",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1031822"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://vanillaforums.org/discussion/27541/vanilla-2-0-18-12-security-release-for-old-2-0-18-installs"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2014-9685",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple cross-site scripting (XSS) vulnerabilities in Vanilla Forums before 2.0.18.13 and 2.1.x before 2.1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://vanillaforums.org/discussion/27540/vanilla-2-1-1-important-security-bug-release",
              "refsource": "CONFIRM",
              "url": "http://vanillaforums.org/discussion/27540/vanilla-2-1-1-important-security-bug-release"
            },
            {
              "name": "1031822",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1031822"
            },
            {
              "name": "http://vanillaforums.org/discussion/27541/vanilla-2-0-18-12-security-release-for-old-2-0-18-installs",
              "refsource": "CONFIRM",
              "url": "http://vanillaforums.org/discussion/27541/vanilla-2-0-18-12-security-release-for-old-2-0-18-installs"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2014-9685",
    "datePublished": "2015-02-25T22:00:00",
    "dateReserved": "2015-02-25T00:00:00",
    "dateUpdated": "2024-08-06T13:55:04.611Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2010-4266 (GCVE-0-2010-4266)
Vulnerability from cvelistv5
Published
2021-06-22 13:38
Modified
2024-08-07 03:43
Severity ?
CWE
Summary
It was found in vanilla forums before 2.0.10 a potential linkbait vulnerability in dispatcher.
References
Impacted products
Vendor Product Version
n/a vanilla forums Version: vanilla forums before 2.0.10
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T03:43:13.298Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://open.vanillaforums.com/discussion/13119/vanilla-2.0.10-released/p1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vanilla forums",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "vanilla forums before 2.0.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "It was found in vanilla forums before 2.0.10 a potential linkbait vulnerability in dispatcher."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-06-22T13:38:24",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://open.vanillaforums.com/discussion/13119/vanilla-2.0.10-released/p1"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2010-4266",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "vanilla forums",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "vanilla forums before 2.0.10"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "It was found in vanilla forums before 2.0.10 a potential linkbait vulnerability in dispatcher."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-601"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://open.vanillaforums.com/discussion/13119/vanilla-2.0.10-released/p1",
              "refsource": "MISC",
              "url": "https://open.vanillaforums.com/discussion/13119/vanilla-2.0.10-released/p1"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2010-4266",
    "datePublished": "2021-06-22T13:38:24",
    "dateReserved": "2010-11-16T00:00:00",
    "dateUpdated": "2024-08-07T03:43:13.298Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2012-4954 (GCVE-0-2012-4954)
Vulnerability from cvelistv5
Published
2012-11-15 11:00
Modified
2024-08-06 20:50
Severity ?
CWE
  • n/a
Summary
The edit-profile page in Vanilla Forums before 2.1a32 allows remote authenticated users to modify arbitrary profile settings by replacing the UserID value during a man-in-the-middle attack, related to a "parameter manipulation" issue.
References
http://www.securityfocus.com/bid/56483 vdb-entry, x_refsource_BID
https://exchange.xforce.ibmcloud.com/vulnerabilities/80000 vdb-entry, x_refsource_XF
http://www.kb.cert.org/vuls/id/611988 third-party-advisory, x_refsource_CERT-VN
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T20:50:18.236Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "56483",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/56483"
          },
          {
            "name": "vanilla-forums-parameter-sec-bypass(80000)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80000"
          },
          {
            "name": "VU#611988",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "http://www.kb.cert.org/vuls/id/611988"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-11-12T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The edit-profile page in Vanilla Forums before 2.1a32 allows remote authenticated users to modify arbitrary profile settings by replacing the UserID value during a man-in-the-middle attack, related to a \"parameter manipulation\" issue."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-28T12:57:01",
        "orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
        "shortName": "certcc"
      },
      "references": [
        {
          "name": "56483",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/56483"
        },
        {
          "name": "vanilla-forums-parameter-sec-bypass(80000)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80000"
        },
        {
          "name": "VU#611988",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "http://www.kb.cert.org/vuls/id/611988"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cert@cert.org",
          "ID": "CVE-2012-4954",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The edit-profile page in Vanilla Forums before 2.1a32 allows remote authenticated users to modify arbitrary profile settings by replacing the UserID value during a man-in-the-middle attack, related to a \"parameter manipulation\" issue."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "56483",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/56483"
            },
            {
              "name": "vanilla-forums-parameter-sec-bypass(80000)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80000"
            },
            {
              "name": "VU#611988",
              "refsource": "CERT-VN",
              "url": "http://www.kb.cert.org/vuls/id/611988"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
    "assignerShortName": "certcc",
    "cveId": "CVE-2012-4954",
    "datePublished": "2012-11-15T11:00:00",
    "dateReserved": "2012-09-17T00:00:00",
    "dateUpdated": "2024-08-06T20:50:18.236Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2010-4264 (GCVE-0-2010-4264)
Vulnerability from cvelistv5
Published
2021-06-22 13:24
Modified
2024-08-07 03:43
Severity ?
CWE
Summary
It was found in vanilla forums before 2.0.10 a cross-site scripting vulnerability where a filename could contain arbitrary code to execute on the client side.
References
Impacted products
Vendor Product Version
n/a vanilla forums Version: vanilla forums before 2.0.10
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T03:43:13.315Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/vanilla/vanilla/commit/4535a059e4e24ca11a2ef0b4d754f262398bcece"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://seclists.org/oss-sec/2010/q4/282"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "vanilla forums",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "vanilla forums before 2.0.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "It was found in vanilla forums before 2.0.10 a cross-site scripting vulnerability where a filename could contain arbitrary code to execute on the client side."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-06-22T13:24:04",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/vanilla/vanilla/commit/4535a059e4e24ca11a2ef0b4d754f262398bcece"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://seclists.org/oss-sec/2010/q4/282"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2010-4264",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "vanilla forums",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "vanilla forums before 2.0.10"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "It was found in vanilla forums before 2.0.10 a cross-site scripting vulnerability where a filename could contain arbitrary code to execute on the client side."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/vanilla/vanilla/commit/4535a059e4e24ca11a2ef0b4d754f262398bcece",
              "refsource": "MISC",
              "url": "https://github.com/vanilla/vanilla/commit/4535a059e4e24ca11a2ef0b4d754f262398bcece"
            },
            {
              "name": "https://seclists.org/oss-sec/2010/q4/282",
              "refsource": "MISC",
              "url": "https://seclists.org/oss-sec/2010/q4/282"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2010-4264",
    "datePublished": "2021-06-22T13:24:04",
    "dateReserved": "2010-11-16T00:00:00",
    "dateUpdated": "2024-08-07T03:43:13.315Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-15833 (GCVE-0-2018-15833)
Vulnerability from cvelistv5
Published
2018-08-26 17:00
Modified
2024-08-05 10:01
Severity ?
CWE
  • n/a
Summary
In Vanilla before 2.6.1, the polling functionality allows Insecure Direct Object Reference (IDOR) via the Poll ID, leading to the ability of a single user to select multiple Poll Options (e.g., vote for multiple items).
References
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T10:01:54.600Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://twitter.com/viperbluff/status/1033067882941304832"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://open.vanillaforums.com/discussion/36559"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/326434"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://twitter.com/viperbluff/status/1033640333890834433"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-08-26T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "In Vanilla before 2.6.1, the polling functionality allows Insecure Direct Object Reference (IDOR) via the Poll ID, leading to the ability of a single user to select multiple Poll Options (e.g., vote for multiple items)."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-08-26T16:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://twitter.com/viperbluff/status/1033067882941304832"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://open.vanillaforums.com/discussion/36559"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://hackerone.com/reports/326434"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://twitter.com/viperbluff/status/1033640333890834433"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-15833",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Vanilla before 2.6.1, the polling functionality allows Insecure Direct Object Reference (IDOR) via the Poll ID, leading to the ability of a single user to select multiple Poll Options (e.g., vote for multiple items)."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://twitter.com/viperbluff/status/1033067882941304832",
              "refsource": "MISC",
              "url": "https://twitter.com/viperbluff/status/1033067882941304832"
            },
            {
              "name": "https://open.vanillaforums.com/discussion/36559",
              "refsource": "MISC",
              "url": "https://open.vanillaforums.com/discussion/36559"
            },
            {
              "name": "https://hackerone.com/reports/326434",
              "refsource": "MISC",
              "url": "https://hackerone.com/reports/326434"
            },
            {
              "name": "https://twitter.com/viperbluff/status/1033640333890834433",
              "refsource": "MISC",
              "url": "https://twitter.com/viperbluff/status/1033640333890834433"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-15833",
    "datePublished": "2018-08-26T17:00:00",
    "dateReserved": "2018-08-23T00:00:00",
    "dateUpdated": "2024-08-05T10:01:54.600Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}