Invision Power Board v2.1.4 - session hijacking

Problem: Invision Board v2.1.4 has a problem with sessions. Once it is installed on a server where php is allowed to use transparant sessions a session can be hijacked by other users. Testing: Once you visit a site where Invision Board is used the first click on the Log In link points the visitor...

Cross site scripting

Cross-site scripting XSS vulnerability in misc.php in Woltlab Burning Board wBB 2.3.4 allows remote attackers to inject arbitrary web script or HTML via the percent parameter. NOTE: this issue has been disputed in a followup post, although the original disclosure might be related to reflected XSS...

CVE-2006-1215

Cross-site scripting XSS vulnerability in misc.php in Woltlab Burning Board wBB 2.3.4 allows remote attackers to inject arbitrary web script or HTML via the percent parameter. NOTE: this issue has been disputed in a followup post, although the original disclosure might be related to reflected XSS...

CVE-2006-1215

The CVE-2006-1215 entry describes a Cross‑site Scripting (XSS) vulnerability in Woltlab Burning Board (wBB) version 2.3.4, specifically in misc.php via the percent parameter. The underlying issue is reflected XSS-type behavior (as per the description, including notes of dispute about the disclosu...

CVE-2006-1215

Cross-site scripting XSS vulnerability in misc.php in Woltlab Burning Board wBB 2.3.4 allows remote attackers to inject arbitrary web script or HTML via the percent parameter. NOTE: this issue has been disputed in a followup post, although the original disclosure might be related to reflected XSS...

CVE-2006-1215: Undefined Security Weakness

Cross-site scripting XSS vulnerability in misc.php in Woltlab Burning Board wBB 2.3.4 allows remote attackers to inject arbitrary web script or HTML via the percent parameter. NOTE: this issue has been disputed in a followup post, although the original disclosure might be related to reflected XSS...

Sql injection

SQL injection vulnerability in D2-Shoutbox 4.2 allows remote attackers to execute arbitrary SQL commands via the load parameter, when performing a Shoutbox action through Invision Power Board IPB...

CVE-2006-1153

SQL injection vulnerability in D2-Shoutbox 4.2 allows remote attackers to execute arbitrary SQL commands via the load parameter, when performing a Shoutbox action through Invision Power Board IPB...

CVE-2006-1153: Undefined Security Weakness

SQL injection vulnerability in D2-Shoutbox 4.2 allows remote attackers to execute arbitrary SQL commands via the load parameter, when performing a Shoutbox action through Invision Power Board IPB...

Sql injection

SQL injection vulnerability in Datenbank MOD 2.7 and earlier for Woltlab Burning Board allows remote attackers to execute arbitrary SQL commands via the fileid parameter to 1 infodb.php or 2 database.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Datenbank MOD 2.7 and earlier for Woltlab Burning Board allow remote attackers to inject arbitrary web script or HTML via the fileid parameter to 1 infodb.php or 2 database.php...

CVE-2006-1097

Multiple cross-site scripting XSS vulnerabilities in Datenbank MOD 2.7 and earlier for Woltlab Burning Board allow remote attackers to inject arbitrary web script or HTML via the fileid parameter to 1 infodb.php or 2 database.php...

CVE-2006-1094

CVE-2006-1094 affects Woltlab Burning Board; the OpenVAS/NVD entries describe a SQL injection in the Database module. The vulnerable component is the Database module’s handling of the fileid parameter in info_db.php (and related database.php), which can allow remote SQL injection. The documents d...

CVE-2006-1097

Multiple cross-site scripting XSS vulnerabilities in Datenbank MOD 2.7 and earlier for Woltlab Burning Board allow remote attackers to inject arbitrary web script or HTML via the fileid parameter to 1 infodb.php or 2 database.php...

CVE-2006-1094

SQL injection vulnerability in Datenbank MOD 2.7 and earlier for Woltlab Burning Board allows remote attackers to execute arbitrary SQL commands via the fileid parameter to 1 infodb.php or 2 database.php...

CVE-2006-1097

The CVE-2006-1097 applies to Woltlab Burning Board’s Datenbank MOD 2.7 and earlier. The vulnerability is a cross-site scripting (XSS) flaw triggered via the fileid parameter in either info_db.php or database.php, allowing remote attackers to inject arbitrary scripts/HTML. The root cause is improp...

Sql injection

SQL injection vulnerability in index.php, possibly during a showtopic operation, in Invision Power Board IPB 2.1.5 allows remote attackers to execute arbitrary SQL commands via the st parameter...

CVE-2006-1076

SQL injection vulnerability in index.php, possibly during a showtopic operation, in Invision Power Board IPB 2.1.5 allows remote attackers to execute arbitrary SQL commands via the st parameter...

CVE-2006-1076

CVE-2006-1076 affects Invision Power Board (IPB) 2.1.5. The vulnerability is a SQL injection in index.php during a showtopic-like operation, exploitable via the st parameter , allowing remote attackers to execute arbitrary SQL commands. The connected documents do not provide a patch or specific r...

CVE-2006-1094: Undefined Security Weakness

SQL injection vulnerability in Datenbank MOD 2.7 and earlier for Woltlab Burning Board allows remote attackers to execute arbitrary SQL commands via the fileid parameter to 1 infodb.php or 2 database.php...