CVE-2006-2287

Multiple cross-site scripting XSS vulnerabilities in Vision Source 0.6 and earlier allow remote attackers to inject arbitrary web script or HTML via the fields in a user's profile...

VisionSource CMS <= 0.6 XSS vectors

VisionSource CMS = 0.6 XSS vectors Discovered by: Nomenumbra Date: 5/4/2006 impact:moderate privilege escalation,possible defacement No data inside the user's profile is filtered thus allowing them to embed malicious XSS vectors to potentially steal cookies. Nomenumbra/0x4F4C...

CVE-2006-1891

Cross-site scripting XSS vulnerability in Martin Scheffler betaboard 0.1 allows remote attackers to inject arbitrary web script or HTML via a user's profile, possibly using the FormValprofile parameter. NOTE: it is not clear whether this is a distributable product or a site-specific vulnerability...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in FlexBB 0.5.5 BETA allow remote attackers to inject arbitrary web script or HTML via the 1 ICQ, 2 AIM, 3 MSN, 4 Google Talk, 5 Website Name, 6 Website Address, 7 Email Address, 8 Location, 9 Signature, and 10 Sub-Titles fields in the user profil...

Sql injection

Multiple SQL injection vulnerabilities in FlexBB 0.5.5 BETA allow remote attackers to execute arbitrary SQL commands via the 1 id, 2 forumid, or 3 threadid parameter to index.php; the 4 ICQ, 5 AIM, 6 MSN, 7 Google Talk, 8 Website Name, 9 Website Address, 10 Email Address, 11 Location, 12 Signatur...

CVE-2006-1810

Multiple cross-site scripting XSS vulnerabilities in FlexBB 0.5.5 BETA allow remote attackers to inject arbitrary web script or HTML via the 1 ICQ, 2 AIM, 3 MSN, 4 Google Talk, 5 Website Name, 6 Website Address, 7 Email Address, 8 Location, 9 Signature, and 10 Sub-Titles fields in the user profil...

CVE-2006-1810

CVE-2006-1810 involves multiple cross-site scripting (XSS) vulnerabilities in FlexBB 0.5.5 BETA . The affected component is the user profile handling, with attacker-controlled inputs in fields such as ICQ, AIM, MSN, Google Talk, Website Name, Website Address, Email Address, Location, Signature, a...

CVE-2006-1811

Multiple SQL injection vulnerabilities in FlexBB 0.5.5 BETA allow remote attackers to execute arbitrary SQL commands via the 1 id, 2 forumid, or 3 threadid parameter to index.php; the 4 ICQ, 5 AIM, 6 MSN, 7 Google Talk, 8 Website Name, 9 Website Address, 10 Email Address, 11 Location, 12 Signatur...

CVE-2006-1810

Multiple cross-site scripting XSS vulnerabilities in FlexBB 0.5.5 BETA allow remote attackers to inject arbitrary web script or HTML via the 1 ICQ, 2 AIM, 3 MSN, 4 Google Talk, 5 Website Name, 6 Website Address, 7 Email Address, 8 Location, 9 Signature, and 10 Sub-Titles fields in the user profil...

CVE-2006-1811: Undefined Security Weakness

Multiple SQL injection vulnerabilities in FlexBB 0.5.5 BETA allow remote attackers to execute arbitrary SQL commands via the 1 id, 2 forumid, or 3 threadid parameter to index.php; the 4 ICQ, 5 AIM, 6 MSN, 7 Google Talk, 8 Website Name, 9 Website Address, 10 Email Address, 11 Location, 12 Signatur...

CVE-2006-1810: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in FlexBB 0.5.5 BETA allow remote attackers to inject arbitrary web script or HTML via the 1 ICQ, 2 AIM, 3 MSN, 4 Google Talk, 5 Website Name, 6 Website Address, 7 Email Address, 8 Location, 9 Signature, and 10 Sub-Titles fields in the user profil...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in phpBB 2.0.19, when Link to off-site Avatar or bbcode IMG are enabled, allows remote attackers to perform unauthorized actions as a logged in user via a link or IMG tag in a user profile, as demonstrated using links to 1 admin/adminusers.php and 2...

CVE-2006-0438

Cross-site request forgery CSRF vulnerability in phpBB 2.0.19, when Link to off-site Avatar or bbcode IMG are enabled, allows remote attackers to perform unauthorized actions as a logged in user via a link or IMG tag in a user profile, as demonstrated using links to 1 admin/adminusers.php and 2...

CVE-2006-0438

Cross-site request forgery CSRF vulnerability in phpBB 2.0.19, when Link to off-site Avatar or bbcode IMG are enabled, allows remote attackers to perform unauthorized actions as a logged in user via a link or IMG tag in a user profile, as demonstrated using links to 1 admin/adminusers.php and 2...

CVE-2005-4613

Cross-site scripting XSS vulnerability in VUBB alpha rc1 allows remote attackers to inject arbitrary web script or HTML via unspecified fields in the user edit profile...

IRM 013: Ultraapps Issue Manager is vulnerable to Privilege Escalation

---------------------------------------------------------------------- IRM Security Advisory No. 013 Ultraapps Issue Manager is vulnerable to Privilege Escalation Vulnerablity Type / Importance: Privilege Escalation / High Problem discovered: November 25th 2005 Vendor contacted: November 25th 200...

PunBB < 1.2.8 Multiple Vulnerabilities

According to its banner, the version of PunBB installed on the remote host suffers from several flaws. - A File Include Vulnerability The application fails to validate the 'language' parameter when a user updates his profile and uses that throughout the application to require PHP code in order to...

multiVulns.txt

Multi-CMS/Forum Vulnability's Found by ap0c hackers pacifico & ratboy Yo! Ok, well a couple new vulnabilitys have been found by.. us : ------------------ First; e107 xss--- ------------------ link=http://w000000w00tw00t/asdadLIlink= onMouseOver='alertdocument.cookie;'...

CVE-2005-2193

SQL injection vulnerability in the user profile edit module in profile.php for PunBB 1.2.5 and earlier allows remote attackers to execute arbitrary SQL statements via the temp array, which is not initialized before it is used and prevents the attacker-supplied portions of the array from being...

CVE-2005-2193

CVE-2005-2193 affects PunBB up to version 1.2.5, where the profile.php:temp parameter is not initialized/sanitized before being used in a database query, enabling remote SQL injection. The root cause is improper handling of the temp array, allowing attacker-controlled input to influence SQL state...