CVE-2007-4913: Improper Control of Generation of Code

ipskernel/classupload.php in Invision Power Board IPB or IP.Board 2.3.1 up to 20070912 allows remote attackers to upload arbitrary script files with crafted image filenames to uploads/, where they are saved with a .txt extension and are not executable. NOTE: there are limited usage scenarios unde...

CVE-2007-4914: Improper Input Validation

Unspecified vulnerability in the subscriptions manager in Invision Power Board IPB or IP.Board 2.3.1 before 20070912 allows remote authenticated users to change the member ID and reduce the privilege level of arbitrary users via a crafted payment form, related to 1 classgw2checkout.php, 2...

Move-2006_SP6 the latest vulnerability to obtain the administrator password-vulnerability warning-the black bar safety net

Ghost boy note: from 7j there to see, and there 7j write the received page. 7j:did not find he said the receiving page,only from have PHP write a. ? $filename = date"Ymd".". txt"; $time = @date"Y years m months d number of H points i points s seconds",time; $cookie = $POST'cookie'; $url =...

Cross site scripting

Cross-site scripting XSS vulnerability in D22-Shoutbox for Invision Power Board IPB or IP.Board allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2007-4487

Cross-site scripting XSS vulnerability in D22-Shoutbox for Invision Power Board IPB or IP.Board allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2007-4487

Technical details about CVE-2007-4487 are not publicly available in the provided documents; monitor for updates. The data here only reiterates a generic XSS vulnerability in D22-Shoutbox for IPB.

CVE-2007-4487: Undefined Security Weakness

Cross-site scripting XSS vulnerability in D22-Shoutbox for Invision Power Board IPB or IP.Board allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Invision Power Board D22-Shoutbox HTML Injections

HSC Invision Power Board D22-Shoutbox HTML Injections D22-Shoutbox suffers from improper validation of HTMl tags filtration. An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the...

Move-2006_SP6 the latest vulnerability to obtain the administrator password-vulnerability warning-the black bar safety net

Ghost boy note: from 7j there to see, and there 7j write the received page. 7j:did not find he said the receiving page,only from have PHP write a. ? $filename = date"Ymd".". txt"; $time = @date"Y years m months d number of H points i points s seconds",time; $cookie = $POST'cookie'; $url =...

molyx board X_UP_CALLING_LINE_ID sql injection Remote Privilege Exploit

No description provided by source. molyx board XUPCALLINGLINEID sql injection Remote Privilege Exploit !/usr/bin/perl -w use IO::Socket; PROOF-OF-CONCEPT work only with php5 or php4&&GPC=off Example: C:\mlexp.pl 127.0.0.1 /bbs/ 1 prepare to connect... + connected prepare to send data... + OK...

Sql injection

SQL injection vulnerability in signin.aspx in Message Board / Threaded Discussion Forum Application Template allows remote attackers to execute arbitrary SQL commands via the Password parameter...

CVE-2007-4110

SQL injection vulnerability in signin.aspx in Message Board / Threaded Discussion Forum Application Template allows remote attackers to execute arbitrary SQL commands via the Password parameter...

CVE-2007-4110

The CVE-2007-4110 entry describes an SQL injection in sign_in.aspx of a Message Board/Threaded Discussion Forum Application Template, allowing remote execution of arbitrary SQL via the Password parameter. The issue is caused by unsafely incorporated user input into SQL commands, exposing partial ...

CVE-2007-4110: Undefined Security Weakness

SQL injection vulnerability in signin.aspx in Message Board / Threaded Discussion Forum Application Template allows remote attackers to execute arbitrary SQL commands via the Password parameter...

Message Board Threaded Discussion Forum - Sign_In.aspx SQL Injection

Message Board Threaded Discussion Forum - SignIn.aspx SQL Injection source: https://www.securityfocus.com/bid/25113/info Message Board / Threaded Discussion Forum is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL quer...

Message Board / Threaded Discussion Forum SQL INJECTION

A R I A - S E C U R I T Y Message Board / Threaded Discussion Forum SQL INJECTION Vendor: http://www.codewidgets.com http://target.com/PATH/signin.aspx Username: admin Password: anything' OR 'x'='x Credits: Aria-Security Team http://aria-security.net http://outlaw.aria-security.info...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Webcit before 7.11 allow remote attackers to inject arbitrary web script or HTML via 1 the who parameter to showuser; and other vectors involving 2 calendar mode, 3 bulletin board mode, 4 room names, and 5 uploaded file names...

CVE-2007-3822

Multiple cross-site scripting XSS vulnerabilities in Webcit before 7.11 allow remote attackers to inject arbitrary web script or HTML via 1 the who parameter to showuser; and other vectors involving 2 calendar mode, 3 bulletin board mode, 4 room names, and 5 uploaded file names...

CVE-2007-3822

Multiple cross-site scripting XSS vulnerabilities in Webcit before 7.11 allow remote attackers to inject arbitrary web script or HTML via 1 the who parameter to showuser; and other vectors involving 2 calendar mode, 3 bulletin board mode, 4 room names, and 5 uploaded file names...

webcit-multi.txt

Vendor contacted: 2007-06-24 Affects: Webcit 7.11 Fixed: 2007-07-06 WebCit 7.11 1. Background WebCit is the webfrontend to administer and use Citadel, which is an open-source groupware server. 2. Session Riding 2.I. Problem Description It is possible for an attacker to execute actions in the name...