CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2016-2564
https://notcve.org/view.php?id=CVE-2016-2564
23 Apr 2017 — Invision Power Services (IPS) Community Suite before 4.1.9 makes session hijack easier by relying on the PHP uniqid function without the more_entropy flag. Attackers can guess an Invision Power Board session cookie if they can predict the exact time of cookie generation. Invision Power Services (IPS) Community Suite en versiones anteriores a 4.1.9 hace más fácil el secuestro de sesión confiando en la función uniqid de PHP sin el indicador more_entropy. Los atacantes pueden adivinar una cookie de sesión de I... • https://invisionpower.com/release-notes/419-r37 • CWE-331: Insufficient Entropy •
CVSS: 8.1EPSS: 19%CPEs: 22EXPL: 4CVE-2016-6174 – IPS Community Suite 4.1.12.3 - PHP Code Injection
https://notcve.org/view.php?id=CVE-2016-6174
07 Jul 2016 — applications/core/modules/front/system/content.php in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) before 4.1.13, when used with PHP before 5.4.24 or 5.5.x before 5.5.8, allows remote attackers to execute arbitrary code via the content_class parameter. applications/core/modules/front/system/content.php en Invision Power Services IPS Community Suite (también conocido como Invision Power Board, IPB o Power Board) en versiones anteriores a 4.1.13, cuando se utiliz... • https://packetstorm.news/files/id/137804 •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-6812
https://notcve.org/view.php?id=CVE-2015-6812
04 Sep 2015 — Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) before 4.0.12.1 allows remote attackers to cause a denial of service (loop and memory consumption) via a crafted URL. Vulnerabilidad en Invision Power Services IPS Community Suite (también conocido como Invision Power Board, IPB o Power Board) en versiones anteriores a 4.0.12.1, permite a atacantes remotos causar una denegación de servicio (bucle y consumo de memoria) a través de una URL manipulada. • https://community.invisionpower.com/release-notes/40121-r22 • CWE-399: Resource Management Errors •
CVSS: 9.8EPSS: 0%CPEs: 25EXPL: 1CVE-2014-9239
https://notcve.org/view.php?id=CVE-2014-9239
03 Dec 2014 — SQL injection vulnerability in the IPS Connect service (interface/ipsconnect/ipsconnect.php) in Invision Power Board (aka IPB or IP.Board) 3.3.x and 3.4.x through 3.4.7 before 20141114 allows remote attackers to execute arbitrary SQL commands via the id[] parameter. Vulnerabilidad de inyección SQL en el servicio IPS Connect (interface/ipsconnect/ipsconnect.php) en Invision Power Board (también conocido como IPB o IP.Board) 3.3.x y 3.4.x hasta 3.4.7 anterior a 20141114 permite a atacantes remotos ejecutar co... • http://community.invisionpower.com/blogs/entry/9704-active-security-exploit • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 13EXPL: 0CVE-2014-5106
https://notcve.org/view.php?id=CVE-2014-5106
28 Jul 2014 — Cross-site scripting (XSS) vulnerability in Invision Power IP.Board (aka IPB or Power Board) 3.4.x through 3.4.6 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to admin/install/index.php. Vulnerabilidad de XSS en Invision Power IP.Board (también conocido como IPB or Power Board) 3.4.x hasta 3.4.6 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de la cabecera HTTP Referer en admin/install/index.php. • http://www.securityfocus.com/archive/1/532822/100/0/threaded • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 34EXPL: 0CVE-2014-3149 – IP.Board 3.4.x / 3.3.x Cross Site Scripting
https://notcve.org/view.php?id=CVE-2014-3149
02 Jul 2014 — Cross-site scripting (XSS) vulnerability in Invision Power IP.Board (aka IPB or Power Board) 3.3.x and 3.4.x through 3.4.6, as downloaded before 20140424, or IP.Nexus 1.5.x through 1.5.9, as downloaded before 20140424, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en Invision Power IP.Board (también conocido como IPB o Power Board) 3.3.x y 3.4.x hasta 3.4.6, descargado antes del 20140424, o IP.Nexus 1.5.x hasta 1.5.9, descargado antes del 20140... • http://community.invisionpower.com/topic/399747-ipboard-33x-34x-security-update • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 83%CPEs: 9EXPL: 3CVE-2012-5692 – Invision Power Board (IP.Board) 3.3.4 - 'Unserialize()' PHP Code Execution
https://notcve.org/view.php?id=CVE-2012-5692
31 Oct 2012 — Unspecified vulnerability in admin/sources/base/core.php in Invision Power Board (aka IPB or IP.Board) 3.1.x through 3.3.x has unknown impact and remote attack vectors. Vulnerabilidad no específica en admin/sources/base/core.php en Invision Power Board (también conocido como IPB o IP.Board) v3.1.x hasta v3.3.x tiene un impacto y vectores de ataque desconocidos. • https://www.exploit-db.com/exploits/22686 •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2010-3424
https://notcve.org/view.php?id=CVE-2010-3424
16 Sep 2010 — Cross-site scripting (XSS) vulnerability in admin/sources/classes/bbcode/custom/defaults.php in Invision Power Board (IP.Board) 3.1.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en admin/sources/classes/bbcode/custom/defaults.php en Invision Power Board (IP.Board) v3.1.2 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores no especificados. • http://community.invisionpower.com/topic/320838-ipboard-31x-security-patch-released • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2009-3974
https://notcve.org/view.php?id=CVE-2009-3974
18 Nov 2009 — Multiple SQL injection vulnerabilities in Invision Power Board (IPB or IP.Board) 3.0.0, 3.0.1, and 3.0.2 allow remote attackers to execute arbitrary SQL commands via the (1) search_term parameter to admin/applications/core/modules_public/search/search.php and (2) aid parameter to admin/applications/core/modules_public/global/lostpass.php. NOTE: on 20090818, the vendor patched 3.0.2 without changing the version number. Múltiples vulnerabilidades de inyección SQL en Invision Power Board (IPB or IP.Board) v3.0... • http://forums.invisionpower.com/topic/291103-invision-power-board-3-0-2-security-update • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •