CVE-2017-8898

Invision Power Services IPS Community Suite 4.1.19.2 and earlier has stored XSS in the Announcements, allowing privilege escalation from an Invision Power Board moderator to an admin. An attack uses the announcecontent parameter in an index.php?/modcp/announcements/&action=create request. This is...

Design/Logic Flaw

Invision Power Services IPS Community Suite 4.1.19.2 and earlier has a composite of Stored XSS and Information Disclosure issues in the attachments feature found in User CP. This can be triggered by any Invision Power Board user and can be used to gain access to moderator/admin accounts. The...

CVE-2017-8897

Invision Power Services IPS Community Suite 4.1.19.2 and earlier has pre-auth reflected XSS in the IPS UTF8 Converter v1.1.18: admin/convertutf8/index.php?controller= is the attack vector. This UTF8 Converter vulnerability can easily be used to make a malicious announcement affecting any Invision...

CVE-2017-8897

CVE-2017-8897 affects Invision Power Services Community Suite (IPS) 4.1.19.2 and earlier, via the IPS UTF8 Converter v1.1.18. It is a pre-auth reflected Cross-Site Scripting (XSS) vulnerability exploitable through admin/convertutf8/index.php?controller=, potentially allowing a crafted announcemen...

CVE-2017-8898

CVE-2017-8898 affects Invision Power Services (IPS) Community Suite v4.1.19.2 and earlier. A stored XSS vulnerability exists in the Announcements feature, enabling privilege escalation from a moderator to an administrator. The attack uses the announce_content parameter via the index.php?/modcp/an...

CVE-2017-8899

CVE-2017-8899 affects Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier. The issue is a composite of Stored XSS and Information Disclosure in the attachments feature within User CP. The primary cause is the ability to upload an SVG document with a crafted attribute such as onload...

CVE-2017-8899: Improper Neutralization of Input During Web Page Generation

Invision Power Services IPS Community Suite 4.1.19.2 and earlier has a composite of Stored XSS and Information Disclosure issues in the attachments feature found in User CP. This can be triggered by any Invision Power Board user and can be used to gain access to moderator/admin accounts. The...

CVE-2017-8898: Improper Neutralization of Input During Web Page Generation

Invision Power Services IPS Community Suite 4.1.19.2 and earlier has stored XSS in the Announcements, allowing privilege escalation from an Invision Power Board moderator to an admin. An attack uses the announcecontent parameter in an index.php?/modcp/announcements/&action=create request. This is...

CVE-2017-8897: Improper Neutralization of Input During Web Page Generation

Invision Power Services IPS Community Suite 4.1.19.2 and earlier has pre-auth reflected XSS in the IPS UTF8 Converter v1.1.18: admin/convertutf8/index.php?controller= is the attack vector. This UTF8 Converter vulnerability can easily be used to make a malicious announcement affecting any Invision...

PT-2017-18607

Name of the Vulnerable Software and Affected Versions Invision Power Services IPS Community Suite versions 4.1.19.2 and earlier Description The issue concerns a pre-auth reflected XSS in the IPS UTF8 Converter v1.1.18. The attack vector is the "admin/convertutf8/index.php?controller=" endpoint...

PT-2017-18608

Name of the Vulnerable Software and Affected Versions Invision Power Services IPS Community Suite versions 4.1.19.2 and earlier Description The issue concerns stored XSS in the Announcements feature, which can lead to privilege escalation from a moderator to an admin. This is achieved by exploiti...

PT-2017-18609

Name of the Vulnerable Software and Affected Versions Invision Power Services IPS Community Suite versions 4.1.19.2 and earlier Description The issue is related to Stored XSS and Information Disclosure in the attachments feature found in User CP. It can be triggered by any Invision Power Board...

Flexispy

Flexispy. Papers exploit for Multiple platform / // / / /| |/ / / // \ / // / / / / / / / | / / / / / / / / / / / / / / / / / / | / / / // // / / / // //// //||//////// brought to you by / / / / / / // -/ \ / / // // / / |/ / // / /// // ./,/// ,/ // /, / // // / / / // / / ,/////,/ / /...

CVE-2016-2564

Invision Power Services IPS Community Suite before 4.1.9 makes session hijack easier by relying on the PHP uniqid function without the moreentropy flag. Attackers can guess an Invision Power Board session cookie if they can predict the exact time of cookie generation...

CVE-2016-2564

Invision Power Services IPS Community Suite before 4.1.9 makes session hijack easier by relying on the PHP uniqid function without the moreentropy flag. Attackers can guess an Invision Power Board session cookie if they can predict the exact time of cookie generation...

CVE-2016-2564

Affected product: Invision Power Services (IPS) Community Suite

CVE-2016-2564: Insufficient Entropy

Invision Power Services IPS Community Suite before 4.1.9 makes session hijack easier by relying on the PHP uniqid function without the moreentropy flag. Attackers can guess an Invision Power Board session cookie if they can predict the exact time of cookie generation...

PT-2017-8055

Name of the Vulnerable Software and Affected Versions Invision Power Services IPS Community Suite versions prior to 4.1.9 Description The issue makes session hijack easier by relying on the PHP uniqid function without the more entropy flag. Attackers can guess an Invision Power Board session cook...

Nextcloud: Design Issues on ( ███ ) Lead to show ( IPS of Users )

Hello , I know this Domain is maybe out of scope But it Connected to the main Website I have see it Cashable the Download IPS for Users Status. As I saw that You active statics awstats That show me Full access to Status on the website . POC...

Design/Logic Flaw

Long lived sessions in Fortinet FortiGate devices with FortiOS 5.x before 5.4.0 could violate a security policy during IPS signature updates when the FortiGate's IPSengine is configured in flow mode. All FortiGate versions with IPS configured in proxy mode the default mode are not affected...