Several people have asked both on the forums and in the support ticket system for exact details of the changes to the FORUMHOME and navbar templates between 3.6.5 and 3.6.6/7, so here they are:

navbar

Remove this code completely: HTML Code:
<script type="text/javascript"><!--function log_out(){ ht = document.getElementsByTagName("html"); ht[0].style.filter = "progid:DXImageTransform.Microsoft.BasicImage(gray scale=1)"; if (confirm('$vbphrase[sure_you_want_to_log_out]')) { return true; } else { ht[0].style.filter = ""; return false; }}//--></script>
Then find this code HTML Code:
onclick="return log_out()"
and replace it with this code HTML Code:
onclick="return log_out('$vbphrase[sure_you_want_to_log_out]')"
FORUMHOME

Find this code HTML Code:
onclick="return log_out()"
and replace it with this code HTML Code:
onclick="return log_out('$vbphrase[sure_you_want_to_log_out]')"




It would appear that the XSS that necessitated the release of 3.6.7 extends to another system we did not appreciate at the time of the release.

Therefore, here are a further set of patches and plugins for you to apply.

Here are your options, depending on the version of vBulletin you are currently running.

Currently running vBulletin 3.6.7
Either:

• Download the patch for 3.6.7 from the members' area (or this thread - 367_patch.zip) and upload the contents to your forum directory
  or
• Apply the plugin vb_367_xss_fix_plugin.xml attached to this thread

Those using vBulletin 3.6.7 can make use of the new Patch Level release system, which allows the correct version number to be displayed in the admin control panel - with the patch applied, your version number in the ACP will reflect the fact that you are now running 3.6.7 PL1.

Currently running vBulletin 3.6.4, 3.6.5 or 3.6.6
Either:

• Upgrade to the new vBulletin 3.6.7 package available in the members' area
  or
• Download the patch for 3.6.6 available in the members' area (or this thread - 366_patch.zip) and upload the contents to your forum directory
  or
• Apply the plugin vb_366_xss_fix_plugin.xml attached to this thread

Currently running vBulletin 3.6.xolder than3.6.4
Either:

• Upgrade to the vBulletin 3.6.7 package available in the members' area
  or
• Apply the plugin vb_366_xss_fix_plugin.xml attached to this thread

Once again, we are sorry that this latest problem has occurred. We are looking into ways to ensure that this sort of thing does not happen again.

شكرا لك اخوي بلال

يعطيك العافية عزيزي

اخويه ممكن توضيح اكثررر شنوا الباج او شنوا عمله

شكرا لمروركم

الباج عبارة عن ملفين تبدلهم بالانكلود اضافةplugin ترفعة

مشكور وبارك الله فيك