vBulletin 3.7.2 PL2 and 3.6.10 PL4 Released

no template changes in this patch !!!

referance this post at vBulletin.com: vBulletin 3.7.2 PL2 and 3.6.10 PL4 Released - vBulletin Community Forum

vBulletin 3.7.2 PL2 / vBulletin 3.6.10 PL4

An XSS flaw related to JavaScript escaping has been identified. This could allow an attacker to carry out an action as a user or obtain access to a user's account. To resolve this issue, it is necessary to release patch level versions of vBulletin 3.7.2 and 3.6.10.

This flaw was discovered by Federico Muttis.

The upgrade process is the same as previous patch level releases - simply download the patch from the Members Area, extract the files and upload to your webserver, overwriting the existing files. There is no upgrade script required.

As with all security-based releases, we recommend that all customers upgrade as soon as possible in order to prevent any potential damage resulting from the flaw being exploited.


vBulletin 3.7.3 and 3.6.11 to be Released Next Week

In line with our new scheduled maintenance release policy, a new release for 3.6 and 3.7 will be made on Tuesday, August 26th.

These releases will contain bug fixes, but will also address a situation related to users that use their username as their password. In 3.6.11 and 3.7.3, this will be completely disallowed. Users affected by this will be forced to change their password on their first login. Additionally, a tool will be provided to email affected users with a new password. Please be aware of these potential compatibility changes when upgrading.

This release will be mentioned in the security bulletin sent out to customers today, but we will not send a further notification next week when 3.7.3 and 3.6.11 are released. Watch your Admin CP News, or the latest version check in the Admin CP to see when the new version is available. Alternatively, keep an eye on this forum for the 3.7.3 and 3.6.11 announcements.

what!! okay, going back to my forum then..

and now getting ready for this :

vBulletin 3.7.3 and 3.6.11 to be Released Next Week

In line with our new scheduled maintenance release policy, a new release for 3.6 and 3.7 will be made on Tuesday, August 26th.

These releases will contain bug fixes, but will also address a situation related to users that use their username as their password. In 3.6.11 and 3.7.3, this will be completely disallowed. Users affected by this will be forced to change their password on their first login. Additionally, a tool will be provided to email affected users with a new password. Please be aware of these potential compatibility changes when upgrading.

This release will be mentioned in the security bulletin sent out to customers today, but we will not send a further notification next week when 3.7.3 and 3.6.11 are released. Watch your Admin CP News, or the latest version check in the Admin CP to see when the new version is available. Alternatively, keep an eye on this forum for the 3.7.3 and 3.6.11 announcements.

not one thing another -- not sure how much they did but who knows .. .

Originally Posted by Forum Lover

what!! okay, going back to my forum then..

Not again!! They really don't want us at ease.

Anyway santai, I think there will be more fun at version 4.0 for sure.

first we need to do a 3.8 - improvements in the social part in it .. .

an 4 -- next year some time - so can rest some

Originally Posted by Forum Lover

Not again!! They really don't want us at ease.

Anyway santai, I think there will be more fun at version 4.0 for sure.

Originally Posted by Forum Lover

Anyway santai, I think there will be more fun at version 4.0 for sure.

According to what I've read and heared is: The new vB 4.0 Version will break a lot of Standard Coding Rules with better and esp new improvements. The CSRF was at least the most simplest and easiest one so we will get more work for the feature. Let's see what the feature brings

lets hope - i hope they keep things working with as few problems and hassles as possible.

- need to find the post and read it again .