CVE-2006-3208

CVE-2006-3208 affects Ultimate PHP Board (UPB) up to version 1.9.6. The issue is a direct static code injection vulnerability that allows remote authenticated administrators to execute arbitrary PHP code via multiple configuration fields stored in admin_chatconfig.php, admin_configcss.php, admin_...

CVE-2006-3206

register.php in Ultimate PHP Board UPB 1.9.6 and earlier allows remote attackers to create arbitrary accounts via the "NR" sequence in the signature field, which is used to separate multiple records...

CVE-2006-3208

Direct static code injection vulnerability in Ultimate PHP Board UPB 1.9.6 and earlier allows remote authenticated administrators to execute arbitrary PHP code via multiple unspecified "configuration fields" in 1 adminchatconfig.php, 2 adminconfigcss.php, 3 adminconfig.php, or 4 adminconfig2.php,...

CVE-2006-3207

Directory traversal vulnerability in newpost.php in Ultimate PHP Board UPB 1.9.6 and earlier allows remote attackers to overwrite arbitrary files via a .. dot dot sequence and trailing null %00 byte in the id parameter, as demonstrated by injecting a Perl CGI script using "NR" sequences in the...

CVE-2006-3206: Undefined Security Weakness

register.php in Ultimate PHP Board UPB 1.9.6 and earlier allows remote attackers to create arbitrary accounts via the "NR" sequence in the signature field, which is used to separate multiple records...

PT-2006-4099 · Upb · Ultimate Php Board

Name of the Vulnerable Software and Affected Versions: Ultimate PHP Board UPB versions 1.9.6 and earlier Description: The issue allows remote attackers to determine a suitable decryption key given the plaintext and ciphertext. This is achieved by obtaining the plaintext password, which is sent wh...

CVE-2006-3208: Undefined Security Weakness

Direct static code injection vulnerability in Ultimate PHP Board UPB 1.9.6 and earlier allows remote authenticated administrators to execute arbitrary PHP code via multiple unspecified "configuration fields" in 1 adminchatconfig.php, 2 adminconfigcss.php, 3 adminconfig.php, or 4 adminconfig2.php,...

CVE-2006-3203: Undefined Security Weakness

The installation of Ultimate PHP Board UPB 1.9.6 and earlier includes a default administrator login account and password, which allows remote attackers to gain privileges...

CVE-2006-3218: Undefined Security Weakness

SQL injection vulnerability in profile.php in Woltlab Burning Board WBB 2.1.6 allows remote attackers to execute arbitrary SQL commands via the userid parameter...

PT-2006-4103 · Upb · Ultimate Php Board

Name of the Vulnerable Software and Affected Versions: Ultimate PHP Board UPB versions 1.9.6 and earlier Description: The issue allows remote authenticated administrators to execute arbitrary PHP code via multiple unspecified configuration fields in admin chatconfig.php, admin configcss.php, admi...

PT-2006-4098 · Upb · Ultimate Php Board

Name of the Vulnerable Software and Affected Versions: Ultimate PHP Board UPB versions 1.9.6 and earlier Description: The issue concerns a default administrator login account and password included in the installation of the software, allowing remote attackers to gain privileges. Recommendations:...

CVE-2006-3220: Undefined Security Weakness

SQL injection vulnerability in studienplatztausch.php in Woltlab Burning Board WBB 2.2.1 allows remote attackers to execute arbitrary SQL commands via the sid parameter...

CVE-2006-3207: Undefined Security Weakness

Directory traversal vulnerability in newpost.php in Ultimate PHP Board UPB 1.9.6 and earlier allows remote attackers to overwrite arbitrary files via a .. dot dot sequence and trailing null %00 byte in the id parameter, as demonstrated by injecting a Perl CGI script using "NR" sequences in the...

CVE-2006-3204: Undefined Security Weakness

Ultimate PHP Board UPB 1.9.6 and earlier uses a cryptographically weak block cipher with a large key collision space, which allows remote attackers to determine a suitable decryption key given the plaintext and ciphertext by obtaining the plaintext password, which is sent when logging in, and the...

CVE-2006-3219: Undefined Security Weakness

SQL injection vulnerability in thread.php in Woltlab Burning Board WBB 2.2.2 allows remote attackers to execute arbitrary SQL commands via the threadid parameter...

CVE-2006-3205: Undefined Security Weakness

Ultimate PHP Board UPB 1.9.6 and earlier allows remote attackers to gain access via modified userenv, passenv, powerenv, and idenv parameters in a cookie, which comprise a persistent logon that does not vary across sessions...

PT-2006-4100 · Upb · Ultimate Php Board

Name of the Vulnerable Software and Affected Versions: Ultimate PHP Board UPB versions 1.9.6 and earlier Description: The issue allows remote attackers to gain access by modifying certain parameters in a cookie. These parameters, including user env, pass env, power env, and id env, can be exploit...

CVE-2006-3197

Cross-site scripting XSS vulnerability in Invision Power Board IPB 2.1.6 and earlier allows remote attackers to inject arbitrary web script or HTML via a POST that contains hexadecimal-encoded HTML...

CVE-2006-3197: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Invision Power Board IPB 2.1.6 and earlier allows remote attackers to inject arbitrary web script or HTML via a POST that contains hexadecimal-encoded HTML...

CVE-2006-3197

Invision Power Board (IPB) 2.1.6 and earlier contains a Cross-site scripting (XSS) vulnerability. A POST request carrying hexadecimal-encoded HTML can allow an attacker to inject arbitrary web script/HTML. The affected component is the IPB posting handler (as described in the CVE). The available ...