Invision Power Board (IP.Board) 2.1.7 - 'ACTIVE' Cross-Site Scripting / SQL Injection

---- INVISION POWER BOARD 2.1.7 EXPLOIT ... ITDefence.ru Antichat.ru INVISION POWER BOARD 2.1.7 ACTIVE XSS/SQL INJECTION Eugene Minaev [email protected] / \ \ \ / .\ / /// // / \ / \ // / / / /// /\ / / / / // / / / / / /\ / / / / / / / / / / / //\ \ / / / / // / // / /\ / // 2007 ////...

CVE-2007-5688

CVE-2007-5688: Multiple SQL injection vulnerabilities in the Multi-Forums (aka Multi Host Forum Pro) module 1.3.3 for phpBB/IPB, in directory.php, allow remote attackers to execute arbitrary SQL via the (1) go and (2) cat parameters. Affected software is the Multi-Forums module version 1.3.3; roo...

CVE-2007-4914

CVE-2007-4914 affects Invision Power Board (IPB/IP.Board) 2.3.1 prior to 20070912. The issue, described across multiple sources, is an unspecified vulnerability in the subscriptions manager that lets remote authenticated users change the member ID and thereby reduce the privilege level of arbitra...

CVE-2007-4914

Unspecified vulnerability in the subscriptions manager in Invision Power Board IPB or IP.Board 2.3.1 before 20070912 allows remote authenticated users to change the member ID and reduce the privilege level of arbitrary users via a crafted payment form, related to 1 classgw2checkout.php, 2...

CVE-2007-4913

CVE-2007-4913 concerns Invision Power Board (IPB/IP.Board) 2.3.1 up to 20070912. The vulnerability lies in ips_kernel/class_upload.php, where remote attackers can upload arbitrary script files using crafted image filenames to the uploads/ directory. The uploaded files are saved with a .txt extens...

CVE-2007-4487

Cross-site scripting XSS vulnerability in D22-Shoutbox for Invision Power Board IPB or IP.Board allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2007-4487

Technical details about CVE-2007-4487 are not publicly available in the provided documents; monitor for updates. The data here only reiterates a generic XSS vulnerability in D22-Shoutbox for IPB.

CVE-2007-4487

Cross-site scripting XSS vulnerability in D22-Shoutbox for Invision Power Board IPB or IP.Board allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2007-3219

CVE-2007-3219 affects Invision Power Board (IPB/IP.Board) versions 2.2.0–2.2.2. The vulnerability is in sources/action_public/xmlout.php and is described as an unspecified issue that allows remote attackers to modify another user’s profile data (e.g., AIM screen name, Yahoo! identity). Documented...

CVE-2007-2963

CVE-2007-2963 describes multiple cross-site scripting (XSS) vulnerabilities in Invision Power Board (IPB/IP.Board) 2.2.2 and possibly earlier. The issues allow remote attackers to inject arbitrary web script or HTML via specific vectors in the web UI: (1) module_bbcodeloader.php, (2) module_div.p...

CVE-2007-2349

CVE-2007-2349 describes a cross-site scripting (XSS) vulnerability in Invision Power Board (IP.Board) versions 2.1.x and 2.2.x. According to the records, remote attackers can inject arbitrary web script or HTML by uploading crafted images or PDF files. The documents do not specify the underlying ...

CVE-2007-2349: Undefined Security Weakness

Cross-site scripting XSS vulnerability in Invision Power Board IP.Board 2.1.x and 2.2.x allows remote attackers to inject arbitrary web script or HTML by uploading crafted images or PDF files...

CVE-2005-3548

Directory traversal vulnerability in Task Manager in Invision Power Board IP.Board 2.0.1 allows limited remote attackers to include files via a .. dot dot in the "Task PHP File To Run" field...

CVE-2005-3548

CVE-2005-3548 affects Invision Power Board (IP.Board) 2.0.1: a directory traversal in the Task Manager component (Task PHP File To Run field) allows limited remote file inclusion via .., enabling network-accessible exploitation. According to the NVD entry, the attack vector is NETWORK with LOW co...