Invision Power Board <=2.3.x iFrame Vuln

Tested On: http://www.abarjigs.com/forum/ Effected on:Invision Power Board =2.3.x Type:Signature With iFrame Discovered By:CYBER.DARK.HIMU SHAHEEMIRZA Google: "style designed by Soi" or "Powered by IP.Board 2.3.1" Mail: [email protected],[email protected] HI TO ALL. HOW TO USE THIS...

CVE-2008-1481

Cross-site scripting XSS vulnerability in index.php in webSPELL 4.1.2 allows remote attackers to inject arbitrary web script or HTML via the board parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

CVE-2008-1481

The provided sources confirm a Cross-site Scripting (XSS) vulnerability in webSPELL 4.1.2 (component: index.php) exposed via the board parameter. The root cause discussed is lack of input sanitization/validation for that parameter, enabling injection of arbitrary script or HTML. Public references...

CVE-2008-1481: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in index.php in webSPELL 4.1.2 allows remote attackers to inject arbitrary web script or HTML via the board parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...

Cross site scripting

Cross-site scripting XSS vulnerability in Invision Power Board IPB or IP.Board 2.3.4 before 2008-03-13 allows remote attackers to inject arbitrary web script or HTML via nested BBCodes, a different vector than CVE-2008-0913...

CVE-2008-1359

Cross-site scripting XSS vulnerability in Invision Power Board IPB or IP.Board 2.3.4 before 2008-03-13 allows remote attackers to inject arbitrary web script or HTML via nested BBCodes, a different vector than CVE-2008-0913...

CVE-2008-1359

Technical details about CVE-2008-1359 are not provided in the connected documents. The material covers related CVEs (e.g., CVE-2008-0913) and generic IPB XSS context. Monitor for updates.

CVE-2008-1359: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Invision Power Board IPB or IP.Board 2.3.4 before 2008-03-13 allows remote attackers to inject arbitrary web script or HTML via nested BBCodes, a different vector than CVE-2008-0913...

retrobottega-xss.txt

---------------------------------------------------------------------------------- | . .. . | | ..\ | || | ||/ | / | | |/ | | /\ | ||| /|/||| /| /| | | // / / / / / | | | --------------------------------------------------------------------------------- Author: cybermilitant Site:...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in index.php in WoltLab Burning Board Lite wBB 2 Beta 1 allows remote attackers to delete threads as other users via the ThreadDelete action...

CVE-2008-1323

Cross-site request forgery CSRF vulnerability in index.php in WoltLab Burning Board Lite wBB 2 Beta 1 allows remote attackers to delete threads as other users via the ThreadDelete action...

CVE-2008-1323

Cross-site request forgery CSRF vulnerability in index.php in WoltLab Burning Board Lite wBB 2 Beta 1 allows remote attackers to delete threads as other users via the ThreadDelete action...

CVE-2008-1323

The CVE-2008-1323 entry documents a CSRF vulnerability in WoltLab Burning Board Lite (wBB) 2 Beta 1, where index.php’s ThreadDelete action can be abused by an attacker to delete threads as other users. This is triggered via forged requests, enabling unauthorized modification of data (thread delet...

CVE-2008-1323: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in index.php in WoltLab Burning Board Lite wBB 2 Beta 1 allows remote attackers to delete threads as other users via the ThreadDelete action...

woltlab-csrf.txt

WoltLab Burning Board Lite 2 Beta 1 Thread Delete CSRF Vulnerability Vendor: woltlab.de Version: Lite 2 Beta 1 Released: March 6 2008 Bug found by NBBN on March 8 2008 ::Example ::Fix No codefix...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in WebCT Campus Edition 4.1.5.8, when "Don't wrap text" is enabled, allow remote authenticated users to inject arbitrary web script or HTML via a 1 mail message or 2 discussion board message. NOTE: this might overlap CVE-2005-1076...

CVE-2008-1225

Multiple cross-site scripting XSS vulnerabilities in WebCT Campus Edition 4.1.5.8, when "Don't wrap text" is enabled, allow remote authenticated users to inject arbitrary web script or HTML via a 1 mail message or 2 discussion board message. NOTE: this might overlap CVE-2005-1076...

CVE-2008-1225: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in WebCT Campus Edition 4.1.5.8, when "Don't wrap text" is enabled, allow remote authenticated users to inject arbitrary web script or HTML via a 1 mail message or 2 discussion board message. NOTE: this might overlap CVE-2005-1076...

WoltLab Burning Board Lite 2 Beta 1 Thread Delete CSRF Vulnerability

WoltLab Burning Board Lite 2 Beta 1 Thread Delete CSRF Vulnerability Vendor: woltlab.de Version: Lite 2 Beta 1 Released: March 6 2008 Bug found by NBBN on March 8 2008 ::Example htmlhead/headbody onLoad="javascript:document.attack.submit" form action="http://site.tld/wbblite/index.php"...

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHP inclusions, SQL injections, directory traversals, crossite scripting, information leaks, etc. Power Board: crossite scripting with flash files...