YabbSE
by Yabb
CVEs (8)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2004-2754 | 0.03 | — | 0.02 | Dec 31, 2004 | SQL injection vulnerability in SSI.php in YaBB SE 1.5.4, 1.5.3, and possibly other versions before 1.5.5 allows remote attackers to execute arbitrary SQL commands via the ID_MEMBER parameter to the (1) recentTopics and (2) welcome functions. | |||
| CVE-2004-0344 | 0.03 | — | 0.02 | Nov 23, 2004 | Directory traversal vulnerability in ModifyMessage.php in YaBB SE 1.5.4 through 1.5.5b allows remote attackers to delete arbitrary files via a .. (dot dot) in the attachOld parameter. | |||
| CVE-2004-0291 | 0.03 | — | 0.01 | Nov 23, 2004 | SQL injection vulnerability in post.php for YaBB SE 1.5.4 and 1.5.5 allows remote attackers to obtain hashed passwords via the quote parameter. | |||
| CVE-2004-1827 | 0.03 | — | 0.02 | Mar 15, 2004 | Cross-site scripting (XSS) vulnerability in YaBB 1 Gold(SP1.3) and YaBB SE 1.5.1 Final allows remote attackers to inject arbitrary web script via the background:url property in (1) glow or (2) shadow tags. | |||
| CVE-2006-3275 | 0.00 | — | 0.01 | Jun 28, 2006 | SQL injection vulnerability in profile.php in YaBB SE 1.5.5 and earlier allows remote attackers to execute SQL commands via a double-encoded user parameter in a viewprofile action. | |||
| CVE-2005-2296 | 0.00 | — | 0.01 | Jul 18, 2005 | YabbSE 1.5.5c allows remote attackers to obtain sensitive information via a direct request to ssi_examples.php, which reveals the path. | |||
| CVE-2004-1662 | 0.00 | — | 0.02 | Aug 25, 2004 | YaBB SE 1.5.1 allows remote attackers to obtain sensitive information via a direct HTTP request to Admin.php, which reveals the full path in a PHP error message. | |||
| CVE-2003-0275 | 0.00 | — | 0.01 | Jun 16, 2003 | SSI.php in YaBB SE 1.5.2 allows remote attackers to execute arbitrary PHP code by modifying the sourcedir parameter to reference a URL on a remote web server that contains the code. |
- CVE-2004-2754Dec 31, 2004risk 0.03cvss —epss 0.02
SQL injection vulnerability in SSI.php in YaBB SE 1.5.4, 1.5.3, and possibly other versions before 1.5.5 allows remote attackers to execute arbitrary SQL commands via the ID_MEMBER parameter to the (1) recentTopics and (2) welcome functions.
- CVE-2004-0344Nov 23, 2004risk 0.03cvss —epss 0.02
Directory traversal vulnerability in ModifyMessage.php in YaBB SE 1.5.4 through 1.5.5b allows remote attackers to delete arbitrary files via a .. (dot dot) in the attachOld parameter.
- CVE-2004-0291Nov 23, 2004risk 0.03cvss —epss 0.01
SQL injection vulnerability in post.php for YaBB SE 1.5.4 and 1.5.5 allows remote attackers to obtain hashed passwords via the quote parameter.
- CVE-2004-1827Mar 15, 2004risk 0.03cvss —epss 0.02
Cross-site scripting (XSS) vulnerability in YaBB 1 Gold(SP1.3) and YaBB SE 1.5.1 Final allows remote attackers to inject arbitrary web script via the background:url property in (1) glow or (2) shadow tags.
- CVE-2006-3275Jun 28, 2006risk 0.00cvss —epss 0.01
SQL injection vulnerability in profile.php in YaBB SE 1.5.5 and earlier allows remote attackers to execute SQL commands via a double-encoded user parameter in a viewprofile action.
- CVE-2005-2296Jul 18, 2005risk 0.00cvss —epss 0.01
YabbSE 1.5.5c allows remote attackers to obtain sensitive information via a direct request to ssi_examples.php, which reveals the path.
- CVE-2004-1662Aug 25, 2004risk 0.00cvss —epss 0.02
YaBB SE 1.5.1 allows remote attackers to obtain sensitive information via a direct HTTP request to Admin.php, which reveals the full path in a PHP error message.
- CVE-2003-0275Jun 16, 2003risk 0.00cvss —epss 0.01
SSI.php in YaBB SE 1.5.2 allows remote attackers to execute arbitrary PHP code by modifying the sourcedir parameter to reference a URL on a remote web server that contains the code.