74 matches found
CVE-2014-5106
Cross-site scripting XSS vulnerability in Invision Power IP.Board aka IPB or Power Board 3.4.x through 3.4.6 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to admin/install/index.php...
CVE-2014-5106
The CVE-2014-5106 entry describes a cross-site scripting (XSS) vulnerability in Invision Power IP.Board (IPB) 3.4.x through 3.4.6. An attacker could inject arbitrary web script or HTML via the HTTP Referer header to admin/install/index.php. This applies to IPB 3.4.x–3.4.6; no exploitation details...
CVE-2014-5106: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in Invision Power IP.Board aka IPB or Power Board 3.4.x through 3.4.6 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to admin/install/index.php...
CVE-2014-3149
Cross-site scripting XSS vulnerability in Invision Power IP.Board aka IPB or Power Board 3.3.x and 3.4.x through 3.4.6, as downloaded before 20140424, or IP.Nexus 1.5.x through 1.5.9, as downloaded before 20140424, allows remote attackers to inject arbitrary web script or HTML via unspecified...
Cross site scripting
Cross-site scripting XSS vulnerability in Invision Power IP.Board aka IPB or Power Board 3.3.x and 3.4.x through 3.4.6, as downloaded before 20140424, or IP.Nexus 1.5.x through 1.5.9, as downloaded before 20140424, allows remote attackers to inject arbitrary web script or HTML via unspecified...
CVE-2014-3149
Cross-site scripting XSS vulnerability in Invision Power IP.Board aka IPB or Power Board 3.3.x and 3.4.x through 3.4.6, as downloaded before 20140424, or IP.Nexus 1.5.x through 1.5.9, as downloaded before 20140424, allows remote attackers to inject arbitrary web script or HTML via unspecified...
CVE-2014-3149
CVE-2014-3149 is a reflected XSS in Invision Power IP.Board (IP.Board) versions 3.3.x and 3.4.x up to 3.4.6 (and IP.Nexus 1.5.x up to 1.5.9). The vulnerability allows injection of arbitrary web script via unspecified vectors and is categorized as low severity with limited exploitability; vendor p...
CVE-2014-3149: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in Invision Power IP.Board aka IPB or Power Board 3.3.x and 3.4.x through 3.4.6, as downloaded before 20140424, or IP.Nexus 1.5.x through 1.5.9, as downloaded before 20140424, allows remote attackers to inject arbitrary web script or HTML via unspecified...
IP.Board多个跨站脚本漏洞
IP.Board是一款流行的论坛程序。 由于某些未明输入在返回用户前未能正确过滤，攻击者可以利用漏洞在受影响站点上下文的用户浏览器会话中执行任意HTML和脚本代码。 0 IP.Board Invision Power Board 3.3.x IP.Board Invision Power Board 3.4.x 厂商补丁： IP.Board ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://community.invisionpower.com/topic/398552-ipboard-33x-34x-security-update/...
Invision IP.Board unserialize() PHP Code Execution
A remote code execution vulnerability has been reported in Invision IP.Board versions up to 3.3.4...
IP.Board管理登录GET和POST参数名脚本注入漏洞
IP.Board是一款流行的论坛程序 通过GET和POST参数名传递给admin/index.php的输入，在使用之前缺少过滤，允许攻击者利用漏洞注入任意HTML和脚本代码，可获得敏感信息或劫持用户会话 0 IP.Board Invision Power Board 3.x 厂商解决方案 用户可参考如下厂商提供的安全公告获得补丁信息： http://community.invisionpower.com/topic/382719-ipboard-31x-32x-33x-34x-critical-security-update/...
Invision Power Board <= 3.3.4 unserialize() PHP Code Execution (2)
Exploit for php platform in category web applications This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ Original:...
Invision IP.Board 3.3.4 unserialize() PHP Code Execution
This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'msf/core/exploit/phpexe' class Metasploit3...
Invision Power Board (IP.Board) 3.3.4 - 'Unserialize()' PHP Code Execution (Metasploit)
This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'Invision IP.Board %q This module...
Invision Power Board (IP.Board) 3.3.4 - Unserialize Regex Bypass
Invision Power Board IP.Board 3.3.4 - Unserialize Regex Bypass ?php / So this is the patch that sanitizes, static public function safeUnserialize $serialized // unserialize will return false for object declared with small cap o // as well as if there is any ws between O and : if isstring...
Invision Power Board (IP.Board) 3.3.4 - Unserialize Regex Bypass
?php / So this is the patch that sanitizes, static public function safeUnserialize $serialized // unserialize will return false for object declared with small cap o // as well as if there is any ws between O and : if isstring $serialized && strpos $serialized, "\0" === false if strpos $serialized...
Invision Power Board (IP.Board) 3.3.4 - Unserialize() PHP Code Execution
Invision Power Board IP.Board 3.3.4 - Unserialize PHP Code Execution ?php / ---------------------------------------------------------------- Invision Power Board = 3.3.4 "unserialize" PHP Code Execution ---------------------------------------------------------------- author..............: Egidio...
CVE-2012-5692
CVE-2012-5692 corresponds to a PHP unserialize vulnerability in Invision Power Board (IP.Board) <= 3.3.4 affecting the file admin/sources/base/core.php. The flaw allows attacker-controlled data (notably from cookies) to trigger unsafe/unserialize calls, enabling remote code execution via the _...
CVE-2012-5692
Unspecified vulnerability in admin/sources/base/core.php in Invision Power Board aka IPB or IP.Board 3.1.x through 3.3.x has unknown impact and remote attack vectors...
Invision IP.Board unserialize() PHP Code Execution
This module exploits a php unserialize vulnerability in Invision IP.Board use exploit/unix/webapp/invision/pboardunserializeexec msf undefinedpboardunserializeexec show actions ...actions... msf undefinedpboardunserializeexec set ACTION msf undefinedpboardunserializeexec show options ...show and...