RSS   Podatności dla 'Jforum'   RSS

2021-09-04
 
CVE-2021-40509

CWE-79
 
 
ViewCommon.java in JForum2 2.7.0 allows XSS via a user signature.

 
2019-02-12
 
CVE-2019-7550

CWE-20
 
 
In JForum 2.1.8, an unauthenticated, remote attacker can enumerate whether a user exists by using the "create user" function. If a register/check/username?username= request corresponds to a username that exists, then an "is already in use" error is produced. NOTE: this product is discontinued.

 
2013-12-30
 
CVE-2013-7209

CWE-352
 
 
Cross-site request forgery (CSRF) vulnerability in admBase/login.page in the Admin module in JForum allows remote attackers to hijack the authentication of administrators for requests that change the user group permissions of arbitrary users via a groupsSave action.

 
2013-09-23
 
CVE-2012-5338

CWE-20
 
 
Open redirect vulnerability in JForum 2.1.9 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the returnPath parameter in a validateLogin action to jforum.page.

 
2013-02-24
 
CVE-2012-5337

 
 
Multiple cross-site scripting (XSS) vulnerabilities in jforum.page in JForum 2.1.9 allow remote attackers to inject arbitrary web script or HTML via the (1) action, (2) match_type, (3) sort_by, or (4) start parameters.

 

Copyright 2024, cxsecurity.com

 

Back to Top