OpenBB 1.0.x - Private Message Disclosure

source: https://www.securityfocus.com/bid/10217/info It has been reported that OpenBB is affected by a private message disclosure vulnerability. This issue is due to a design error that fails to validate user credentials. This issue might allow an attacker to read arbitrary private messages poste...

Ultimate PHP Board add.php Direct Request Information Disclosure

The remote host is running Ultimate PHP Board UPB. There is a flaw in this version that could allow an attacker to view private message board information. %NASLMINLEVEL 70300 This script was written by Erik Stephens See the Nessus Scripts License for details Changes by Tenable: - Revised plugin...

Private Message System 2.x - index.php?Page Cross-Site Scripting

Private Message System 2.x - index.php?Page Cross-Site Scripting source: https://www.securityfocus.com/bid/9308/info Private Message System is prone to a cross-site scripting vulnerability. This issue may be exploited by creating a malicious link to a site hosting the software with hostile HTML a...

Private Message System 2.x - 'index.php?Page' Cross-Site Scripting

source: https://www.securityfocus.com/bid/9308/info Private Message System is prone to a cross-site scripting vulnerability. This issue may be exploited by creating a malicious link to a site hosting the software with hostile HTML and script code embedded in URI parameters. If the link is followe...

vBulletin 3.0 - Private Message HTML Injection

vBulletin 3.0 - Private Message HTML Injection source: https://www.securityfocus.com/bid/7594/info A vulnerability has been reported in vBulletin 3.0.0 beta 2. The problem is said to occur due to insufficient sanitization of private messages. As a result, an attacker may be capable of embedding...

Xoops 1.3.5 - Private Message System Font Attributes HTML Injection

Xoops 1.3.5 - Private Message System Font Attributes HTML Injection source: https://www.securityfocus.com/bid/6344/info Xoops includes a Private Message System for users, so that they may send messages to one another. HTML tags used for font attributes are not sufficiently filtered of malicious...

Xoops 1.3.5 - Private Message System Font Attributes HTML Injection

source: https://www.securityfocus.com/bid/6344/info Xoops includes a Private Message System for users, so that they may send messages to one another. HTML tags used for font attributes are not sufficiently filtered of malicious HTML code. This makes it possible for an attacker to supply malicious...

CVE-2002-0389

Pipermail in Mailman stores private mail messages with predictable filenames in a world-executable directory, which allows local users to read private mailing list archives...

CVE-2002-0217

Cross-site scripting CSS vulnerabilities in the Private Message System for XOOPS 1.0 RC1 allow remote attackers to execute Javascript on other web clients via 1 the Title field or a Private Message Box or 2 the image field parameter in pmlite.php...

[IMG] tag vulnerability in vBulletin

product : vbulletin versions : 2.2.2, 2.2.0 , maybe others. Probleme : One knows that if one sendings this code in private message : IMGjavascript:alert'hum';/IMG a space will be placed between "java" and "script". This filter can be by-passed : IMGjavasript:alert'hop';/IMG More details in french...

Xoops topics : One more time

Hi again, I just found an other Script injection issue in Xoops Private Message Box. http://xooped-site/pmlite.php?touserid=USERIDOFTARGET&msgid=&image=fo o.gif'scriptalert"test";/scriptimg20src='http://www.isecurelabs.com /images/barre.jpg&op=submit&theme=snow&subject=Are you sure...

Xoops Private Message System Script injection

-- Xoops Private Message System Script injection -- Discovered on 29/01/2002 Vendor: http://xoops.sourceforge.net -- Overview -- XOOPS is an open source portal script written extensively in object-oriented PHP, backend with MySQL Database. Xoops offers for members a Private Message System mail li...