Advisory: ASPSitem <= 2.0 Multiple Vulnerabilities.

--Security Report-- Advisory: ASPSitem = 2.0 Multiple Vulnerabilities. --- Author: Mustafa Can Bjorn "nukedx a.k.a nuker" IPEKCI --- Date: 27/05/06 08:26 PM --- Contacts: ICQ: 10072 MSN/Email: [email protected] Web: http://www.nukedx.com --- Vendor: ASPSitem http://www.aspsitem.com Version: 2.0 a...

CVE-2006-2188

Multiple cross-site scripting XSS vulnerabilities in CMScout 1.10 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the Body field of a private message PM, 2 BBCode, or 3 a forum post...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in CMScout 1.10 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the Body field of a private message PM, 2 BBCode, or 3 a forum post...

CVE-2006-2188

Multiple cross-site scripting XSS vulnerabilities in CMScout 1.10 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 the Body field of a private message PM, 2 BBCode, or 3 a forum post...

CVE-2006-1369

Cross-site scripting XSS vulnerability in Invision Power Board IPB 2.1.5 and earlier before 20060308 allows remote attackers to inject arbitrary web script or HTML via a Private Message PM in certain circumstances...

CVE-2006-1369

Cross-site scripting XSS vulnerability in Invision Power Board IPB 2.1.5 and earlier before 20060308 allows remote attackers to inject arbitrary web script or HTML via a Private Message PM in certain circumstances...

Code injection

The send-private-message functionality send-private-message.asp in PD9 Software MegaBBS 2.1 allows remote attackers to read private messages of other users via a modified replyid parameter...

CVE-2006-0139

The CVE-2006-0139 vulnerability affects PD9 Software MegaBBS 2.1 , specifically the send-private-message.asp feature. A remote attacker can read other users’ private messages by supplying a modified replyid parameter, indicating improper input handling/validation for that field. The available doc...

CVE-2006-0139

The send-private-message functionality send-private-message.asp in PD9 Software MegaBBS 2.1 allows remote attackers to read private messages of other users via a modified replyid parameter...

Ultimate PHP Board Information Leak

The remote host is running Ultimate PHP Board UPB. There is a flaw in this version which may allow an attacker to view private message board information. SPDX-FileCopyrightText: 2004 Edgeos, Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

chacmool Private Message System 1.1.3 - send.php?tid Cross-Site Scripting

chacmool Private Message System 1.1.3 - send.php?tid Cross-Site Scripting source: https://www.securityfocus.com/bid/11671/info Private Message System is reported prone to multiple vulnerabilities that can allow remote attackers to carry out cross-site scripting attacks and disclose arbitrary...

chacmool Private Message System 1.1.3 - send.php Arbitrary Message Access

chacmool Private Message System 1.1.3 - send.php Arbitrary Message Access source: https://www.securityfocus.com/bid/11671/info Private Message System is reported prone to multiple vulnerabilities that can allow remote attackers to carry out cross-site scripting attacks and disclose arbitrary...

chacmool Private Message System 1.1.3 - 'send.php' Arbitrary Message Access

source: https://www.securityfocus.com/bid/11671/info Private Message System is reported prone to multiple vulnerabilities that can allow remote attackers to carry out cross-site scripting attacks and disclose arbitrary private messages. Private Message System 1.1.3 is reported vulnerable to these...

chacmool Private Message System 1.1.3 - 'send.php?tid' Cross-Site Scripting

source: https://www.securityfocus.com/bid/11671/info Private Message System is reported prone to multiple vulnerabilities that can allow remote attackers to carry out cross-site scripting attacks and disclose arbitrary private messages. Private Message System 1.1.3 is reported vulnerable to these...

PowerPortal 1.1/1.3 - Private Message HTML Injection

source: https://www.securityfocus.com/bid/10835/info A vulnerability is reported for PowerPortal which may make it prone to HTML injection attacks. The problem is said to occur due to a lack of sufficient sanitization performed on private message data. Specifically, when creating PowerPortal...

OpenBB 1.0.x - Private Message Disclosure

OpenBB 1.0.x - Private Message Disclosure source: https://www.securityfocus.com/bid/10217/info It has been reported that OpenBB is affected by a private message disclosure vulnerability. This issue is due to a design error that fails to validate user credentials. This issue might allow an attacke...

OpenBB 1.0.x - Private Message Disclosure

source: https://www.securityfocus.com/bid/10217/info It has been reported that OpenBB is affected by a private message disclosure vulnerability. This issue is due to a design error that fails to validate user credentials. This issue might allow an attacker to read arbitrary private messages poste...

Ultimate PHP Board add.php Direct Request Information Disclosure

The remote host is running Ultimate PHP Board UPB. There is a flaw in this version that could allow an attacker to view private message board information. %NASLMINLEVEL 70300 This script was written by Erik Stephens See the Nessus Scripts License for details Changes by Tenable: - Revised plugin...

Private Message System 2.x - index.php?Page Cross-Site Scripting

Private Message System 2.x - index.php?Page Cross-Site Scripting source: https://www.securityfocus.com/bid/9308/info Private Message System is prone to a cross-site scripting vulnerability. This issue may be exploited by creating a malicious link to a site hosting the software with hostile HTML a...

Private Message System 2.x - 'index.php?Page' Cross-Site Scripting

source: https://www.securityfocus.com/bid/9308/info Private Message System is prone to a cross-site scripting vulnerability. This issue may be exploited by creating a malicious link to a site hosting the software with hostile HTML and script code embedded in URI parameters. If the link is followe...