GCVE - cpe:2.3:a:vwar:virtual_war:1.6.1:r2:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:vwar:virtual_war:1.6.1:r2:*:*:*:*:*:*

part: a version: 1.6.1 update: r2

Vendor	Vwar (`128d0fdd-f5f1-5b82-a5e4-250ef3fdf222`)
Product	Virtual War (`f5250010-9ecf-5a8e-878e-d767bba427a8`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2010-5279`	vulnerable	2026-06-08 04:56:32.620005	Details available article.php in Virtual War (aka VWar) 1.6.1 R2 allows remote attackers to cause a denial of service (memory consumption) via a large integer in the ratearticleselect parameter. Published: 2012-10-08T10:00:00.000Z Updated: 2024-09-17T02:05:59.826Z Open on db.gcve.eu Reference links http://dmcdonald.net/vwar.txt http://seclists.org/fulldisclosure/2010/Aug/235	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-5067`	vulnerable	2026-06-08 04:56:31.727729	Details available Virtual War (aka VWar) 1.6.1 R2 uses static session cookies that depend only on a user's password, which makes it easier for remote attackers to bypass timeout and logout actions, and retain access for a long period of time, by leveraging knowledge of a session cookie. Published: 2012-10-08T10:00:00.000Z Updated: 2024-09-16T20:48:08.766Z Open on db.gcve.eu Reference links http://dmcdonald.net/vwar.txt http://seclists.org/fulldisclosure/2010/Aug/235	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-5066`	vulnerable	2026-06-08 04:56:31.727456	Details available The createRandomPassword function in includes/functions_common.php in Virtual War (aka VWar) 1.6.1 R2 uses a small range of values to select the seed argument for the PHP mt_srand function, which makes it easier for remote attackers to determine randomly generated passwords via a brute-force attack. Published: 2012-10-08T10:00:00.000Z Updated: 2024-09-16T16:52:37.615Z Open on db.gcve.eu Reference links http://dmcdonald.net/vwar.txt http://seclists.org/fulldisclosure/2010/Aug/235	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-5065`	vulnerable	2026-06-08 04:56:31.727176	Details available popup.php in Virtual War (aka VWar) 1.6.1 R2 allows remote attackers to bypass intended member restrictions and read news posts via a modified newsid parameter in a printnews action. Published: 2012-10-08T10:00:00.000Z Updated: 2024-09-16T16:57:39.597Z Open on db.gcve.eu Reference links http://dmcdonald.net/vwar.txt http://seclists.org/fulldisclosure/2010/Aug/235	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-5064`	vulnerable	2026-06-08 04:56:31.726885	Details available Multiple cross-site scripting (XSS) vulnerabilities in Virtual War (aka VWar) 1.6.1 R2 allow remote attackers to inject arbitrary web script or HTML via (1) the Additional Information field to challenge.php, the (2) Additional Information or (3) Contact information field to joinus.php, (4) the War Report field to admin/admin.php in a finishwar action, or (5) the Nick field to profile.php. Published: 2012-10-08T10:00:00.000Z Updated: 2024-09-16T17:19:08.602Z Open on db.gcve.eu Reference links http://dmcdonald.net/vwar.txt http://seclists.org/fulldisclosure/2010/Aug/235	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-5063`	vulnerable	2026-06-08 04:56:31.726498	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

VWar Virtual War 1.6.1 R2

Notes

PURL mappings

Vulnerability references

Contribute