Xenforo vs vBulletin vs Invision - history of vulnerabilities (Xenforo the clear winner)

[Digital Doctor]

How secure is your forum software ?
Does your forum provider spit out code with vulnerabilities or do they have better quality control than that ?

Xenforo: (source: https://www.cvedetails.com/vendor/25815/Xenforo.html )



vBulletin: source: https://www.cvedetails.com/vendor/8142/Vbulletin.html




Invision Coummunity / source: https://www.cvedetails.com/vendor/21021/Invisioncommunity.html



I'll let the numbers speak for themselves.

 

[Digital Doctor]

Is code execution worse than SQL injection ?

 

[Digital Doctor]

That's alot of zero.

 

[Suzanne O]

Interesting take!

I go by taste rather than looking up those stats.

Sniff test = if it is buggy the software stinks.

Xenforo usually passes the sniff test!
vB doesn't
Invision is too buggy and doesn't

 

[avalanch]

Xenforo has 2 right now.

 

[Chris D]

The first one is already fixed and was shipped with 2.2.14 or .15.

The second one is absolutely not a valid vulnerability. Being able to edit advertising HTML is an as-designed feature. It's no secret that if you can edit HTML, you can insert scripts. And with advertising more than anything, we absolutely expect various scripts to be used here - how else would advertising ever be able to work?

 

[DragonByte Tech]

An admin with access to editing forums can add scripts to forum descriptions too, and can close the forum and add the XSS scripts there too!

 

[James]

An admin with access to editing forums can add scripts to forum descriptions too, and can close the forum and add the XSS scripts there too!

And to be fair a Web server admin can absolutely ping local host and ddos! What is the world coming to?

 

[zappaDPJ]

When comparing vulnerabilities it's worth noting the actual payload e.g. vBulletin's worst data breach not only compromised forum users but also customer accounts including names, addresses, birth dates, security Q&As, email addresses, home page URLs, IM identities, IP addresses and passwords.

 

[Suzanne O]

When comparing vulnerabilities it's worth noting the actual payload e.g. vBulletin's worst data breach not only compromised forum users but also customer accounts including names, addresses, birth dates, security Q&As, email addresses, home page URLs, IM identities, IP addresses and passwords.

How recent was that?

 

[zappaDPJ]

How recent was that?

Have I Been Pwned: Pwned websites

Have I Been Pwned allows you to search across multiple data breaches to see if your email address or phone number has been compromised.

haveibeenpwned.com

Password reset invoked after vBulletin.com forum software site defaced

Hacker claims to have 480,000 records

www.theregister.com

 

[Suzanne O]

Password reset invoked after vBulletin.com forum software site defaced

Hacker claims to have 480,000 records

www.theregister.com

Ok thanks for that.