vBulletin 3.6.4

The discovery of a potential cross-site scripting (XSS) issue in the administrators control panel has necessitated the preventative release of vBulletin 3.6.4 Due to several mitigating factors, this issue is hard to exploit and careful browsing by the admins can prevent it entirely. Nonetheless, we strongly recommend that all of our customers upgrade or apply the patch as soon as possible.

Additionally, vBulletin 3.6.4 includes fixes for several non-security-related bugs, see here for a full list.

Updating your vBulletin to combat the XSS issue:

Please note that this issue is present in other versions of vBulletin as well. Please see the appropriate announcement!

You have two options to fix the XSS issue:

1. Full Upgrade: The best way to fix the problem is to perform a full upgrade, downloading the complete 3.6.4 package from the vBulletin Members' Area and following the regular upgrade instructions.
2. Patch: A second option is to download the patch files discussed in this thread and upload them to your web server, overwriting the existing files. The patch is available from the Members' Area patch page!

If you absolutely cannot apply the patch or upgrade...

We strongly recommend you actively take steps to address this issue. However, if this is not possible, we recommend that administrators only log into the control panel when work is necessary. While you are logged into the control panel, do not click unknown links. Log out from the control panel using the link in the upper right of the screen immediately after finishing your work. If you are unexpectedly presented with the control panel login screen after clicking a link, do not login.

PHP and MySQL Requirements

Please note that vBulletin 3.6.x requires at least PHP 4.3.3 and MySQL 4.0.16 or later.

__________________
Wow Guild.......... MyDirectory

We'll be at 3.7.0 by next year at this rate. :p

__________________
Earnersforum.com - Learn how to make money online! New Look!

Ken Iovino / vBHackers.com
vBSEO 3.1 GOLD Released vB Blogs Compatible | Non-Encrypted | Branding Removal Option | Sitemaps 2.1 | Language Packs

Crawlability Network: vBulletin SEO | vBulletin Hackers

i just patched it last release, couldnt be bothered going through all the templates etc...i secretly think they are at 3.8 but are just releasing dribs and drabs of upgrades to annoy everyone who has hacked their boards to death..

yup, just patched here also ;)

__________________
Brandon Sheley / vBHackers.com
vBSEO 3.1 GOLD Released vB Blogs Compatible | Non-Encrypted | Branding Removal Option | Sitemaps 2.1 | Language Packs

Crawlability Network: vBulletin SEO | vBulletin Hackers

We offer vBulletin Services @ vBulletin Setup - = - Barcode Signature
I run a few Directories, submit your sites: Quality Link Directory, Link Directory, Link Directory
Have you seen Crowdgather yet? it's where you can Find it on Forums