I know An-net personally, and to the best of my knowledge he thinks he fixed all XSS vunerabilities. Kirby can you PM me and tell me whats wrong so I can tell him personally tomorrow? I know he is busy with his site so that could be the reason for not knowing about any other vunerabilities...
I know An-net personally, and to the best of my knowledge he thinks he fixed all XSS vunerabilities. Kirby can you PM me and tell me whats wrong so I can tell him personally tomorrow? I know he is busy with his site so that could be the reason for not knowing about any other vunerabilities...
i am sry but personal things have kept me occupied such as my website, school, work, and life its self. i am currently very busy but i will try to find sometime to fix this. i am currently revising the fixes a i posted earlier with a better and more efficient fix. also at PaulM you are always for warned of file modifications and i am not required to provide you with edits if you modified my hack. Try getting a file comparer in the future
i am sry but personal things have kept me occupied such as my website, school, work, and life its self. i am currently very busy but i will try to find sometime to fix this. i am currently revising the fixes a i posted earlier with a better and more efficient fix. also at PaulM you are always for warned of file modifications and i am not required to provide you with edits if you modified my hack. Try getting a file comparer in the future
As long as you are looking into it, and will work on a fix, I think we are all happy. It's just scary to have somebody post a big ugly message about security issues, and have no idea what they are talking about, or how to fix it.
As I said earlier, my users are just figuring out how to use this thing, and they like it.
also at PaulM you are always for warned of file modifications and i am not required to provide you with edits if you modified my hack. Try getting a file comparer in the future
FFS, please actually read the posts - at no point did I ask you to provide edits, I ASKED FOR DETAILS OF THE PROBLEM, not the fixes - I can do my own fixes as long as I know what I'm supposed to be fixing.
FYI - I have a file compare program, please don't try and be smart, it doesn't suit you.
Thanks for your input.
We know that announcing that a vulnerability exists can cause people to go search for it and try to exploit for it. In this case, the author had been contacted multiple times, but didn't seem willing to fix the script.
After discussing this internally, vBulletin.org staff decided to announce, that there is a vulnerability. We assumed that people using this modification would in the most cases be able to temporarily remove it and announce on their forum that it was removed due to security issues.
Still, I'm sure we will be reviewing our procedure for such cases. If you would like to provide any input, feel free to PM me.