kapda-13.txt

KAPDA::13 - XMB extreme message board HTML Injection & Path Disclosure. KAPDA New advisory Vendor: http://www.xmbforum.com Bug: HTML Injection & Path Disclosure Exploitation: Remote with browser Description: -------------------- XMB is a free message board powered by PHP and MySQL. Vulnerability:...

DSA-899-1 egroupware - programming errors

Bulletin has no description...

CVE-2005-3547

Cross-site scripting XSS vulnerability in Invision Power Board 2.1 allows remote attackers to inject arbitrary web script or HTML via the 1 adsess, 2 name, and 3 description parameters in admin.php, and the 4 ACP Notes, 5 Member Name, 6 Password, 7 Email Address, 8 Components, and multiple other...

CVE-2005-3549

CVE-2005-3549 describes a direct code injection vulnerability in Invision Power Board 2.0.1 Task Manager. The flaw allows limited remote attackers to execute arbitrary code by placing a target file reference in the Task PHP File To Run field and selecting Run Task Now. The affected software is In...

CVE-2005-3548

Directory traversal vulnerability in Task Manager in Invision Power Board IP.Board 2.0.1 allows limited remote attackers to include files via a .. dot dot in the "Task PHP File To Run" field...

CVE-2005-3549

Direct code injection vulnerability in Task Manager in Invision Power Board 2.0.1 allows limited remote attackers to execute arbitrary code by referencing the file in "Task PHP File To Run" field and selecting "Run Task Now"...

CVE-2003-1277

CVE-2003-1277 describes cross-site scripting (XSS) in YaBB 1.5.0. The vulnerability allows remote attackers to execute arbitrary scripts as other users and potentially steal authentication information via cookies by injecting HTML/script into (1) news_icon of news_template.php and (2) threadid an...

CVE-2005-3547

Cross-site scripting XSS vulnerability in Invision Power Board 2.1 allows remote attackers to inject arbitrary web script or HTML via the 1 adsess, 2 name, and 3 description parameters in admin.php, and the 4 ACP Notes, 5 Member Name, 6 Password, 7 Email Address, 8 Components, and multiple other...

CVE-2005-3547

CVE-2005-3547 affects Invision Power Board 2.1. The vulnerability is a Cross-site Scripting (XSS) flaw that allows remote attackers to inject arbitrary web script or HTML via multiple input fields (e.g., adsess, name, description in admin.php, ACP Notes, Member Name, Password, Email Address, Comp...

CVE-2005-3547: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Invision Power Board 2.1 allows remote attackers to inject arbitrary web script or HTML via the 1 adsess, 2 name, and 3 description parameters in admin.php, and the 4 ACP Notes, 5 Member Name, 6 Password, 7 Email Address, 8 Components, and multiple other...

CVE-2003-1277: Undefined Security Weakness

Cross-site scripting XSS vulnerabilities in Yet Another Bulletin Board YaBB 1.5.0 allow remote attackers to execute arbitrary script as other users and possibly steal authentication information via cookies by injecting arbitrary HTML or script into 1 newsicon of newstemplate.php, and 2 threadid a...

CVE-2005-3549: Undefined Security Weakness

Direct code injection vulnerability in Task Manager in Invision Power Board 2.0.1 allows limited remote attackers to execute arbitrary code by referencing the file in "Task PHP File To Run" field and selecting "Run Task Now"...

CVE-2005-3548: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Task Manager in Invision Power Board IP.Board 2.0.1 allows limited remote attackers to include files via a .. dot dot in the "Task PHP File To Run" field...

ibProArcade.txt

Sql injection in ibProArcade. This bug was discoverd in all of the versions of ibproarcade 2.x. It was tested and found perfectly working under vBulettin or Invision power board. Date:2005-11-5 The injection is here: module=report&user=userid Query: 'SELECT name FROM ibfmembers WHERE id=userid'...

ipb.2.1-english.txt

Fast translation of benji's advisory Author : benjilenoob WebSite : http://benji.redkod.org/ and http://www.redkod.org/ Audit in pdf : http://benji.redkod.org/audits/ipb.2.1.pdf Product : Invision power board Version : 2.1 Tisk : Low. XSS I- XSS non critical: -------------------- 1. Input passed ...

Invision Power Board 2.1 : Multiple XSS Vulnerabilities

Fast translation of benji's advisory Author : benjilenoob WebSite : http://benji.redkod.org/ and http://www.redkod.org/ Audit in pdf : http://benji.redkod.org/audits/ipb.2.1.pdf Product : Invision power board Version : 2.1 Tisk : Low. XSS I- XSS non critical: -------------------- 1. Input passed ...

ipb.2.1.txt

Auteur : benjilenoob WebSite : http://benji.redkod.org/ and http://www.redkod.org/ Audit in pdf : http://benji.redkod.org/audits/ipb.2.1.pdf Produit : Invision power board Version : 2.1 Types de failles : Xss permanentes et non permanentes. Risque : Faible. I- failles XSS non critique:...

[waraxe-2005-SA#043] - Sql injection in Phorum 5.0.20 and earlier

================================================================================ waraxe-2005-SA043 ================================================================================ Sql injection in Phorum 5.0.20 and earlier...

Failles dans Invision Power Board 2.1 [xss]

Auteur : benjilenoob WebSite : http://benji.redkod.org/ and http://www.redkod.org/ Audit in pdf : http://benji.redkod.org/audits/ipb.2.1.pdf Produit : Invision power board Version : 2.1 Types de failles : Xss permanentes et non permanentes. Risque : Faible. I- failles XSS non critique:...

Sql injection in ibProArcade

Sql injection in ibProArcade. This bug was discoverd in all of the versions of ibproarcade 2.x. It was tested and found perfectly working under vBulettin or Invision power board. Date:2005-11-5 The injection is here: module=report&user=userid Query: 'SELECT name FROM ibfmembers WHERE id=userid'...