Vulnerabilidades

Cross-site scripting (XSS) vulnerability in Ikonboard 3.1.1 allows remote attackers to inject arbitrary web script or HTML via a private message with a javascript: URL in the IMG tag, in which the URL ends in a ".gif" or ".jpg" string, a variant of CVE-2002-0328.

Cross-site scripting (XSS) vulnerability in the web-based message board in Prospero Technologies allows remote attackers to inject arbitrary web script or HTML via a message board post.

register.php in Ultimate PHP Board (UPB) 1.0 and 1.0b uses an administrative account Admin with a capital "A," but allows a remote attacker to impersonate the administrator by registering an account name of admin with a lower case "a."

Ultimate PHP Board (UPB) 1.0 allows remote attackers to view the physical path of the message board via a direct request to add.php, which leaks the path in an error message.

BIOS D845BG, D845HV, D845PT and D845WN on Intel motherboards does not properly restrict access to configuration information when BIOS passwords are enabled, which could allow local users to change the default boot device via the F8 key.

Motorola Surfboard 4200 cable modem allows remote attackers to cause a denial of service (crash) by performing a SYN scan using a tool such as nmap.

Ultimate PHP Board (UPB) 1.0 and 1.0b allows remote authenticated users to gain privileges and perform unauthorized actions via direct requests to (1) admin_members.php, (2) admin_config.php, (3) admin_cat.php, or (4) admin_forum.php.

Cross-site scripting (XSS) vulnerability in Pinboard 1.0 allows remote attackers to inject arbitrary web script or HTML via tasklists.

Logitech iTouch keyboards allows attackers with physical access to the system to bypass the screen locking function and execute user-defined commands that have been assigned to a button.

Cross-site scripting (XSS) vulnerability in WoltLab Burning Board (wbboard) 1.1.1 allows remote attackers to inject arbitrary web script or HTML via the message parameter.

El procedimiento de instalación en Invision Board sugiere que los usuarios instalen el programa phpinfo.php en la raíz del web, lo que filtra información sensible como nombres de rutas, información del SO, y configuración de php.

Cross-site scripting vulnerabilities in Blackboard 5 allow remote attackers to execute arbitrary web script via (1) the course_id parameter in a link to login.pl, (2) the CTID parameter in ProcessInfo.cgi, or (3) the Message parameter in index.cgi.

register.php en WoltLab Burning Board (wbboard) 1.1.1 usa un número pequeño de valores aleatorios para el parámetro "code" que se pasa a action.php para aprobar el nuevo registro, junto con IDs de usuario nuevo predecibles, lo que permite a atacantes remotos secuestrar nuevas cuentas de usuarios mediante ataques de…

Cross-site scripting vulnerability in Board-TNK 1.3.1 and earlier allows remote attackers to execute arbitrary Javascript via the WEB parameter.

PostBoard 2.0.1 y anteriores con BBcode permite a atacantes remotos causar una denegación de servicio (saturación de CPU) y corromper la base de datos mediante caractéres nulos en etiquetas [code].

Cross-site scripting vulnerabilities in PostBoard 2.0.1 and earlier allows remote attackers to execute script as other users via (1) an [IMG] tag when BBCode is enabled, or (2) in a topic title.

Cross-site scripting vulnerability in Ikonboard 3.0.1 allows remote attackers to execute arbitrary script as other Ikonboard users and steal cookies via Javascript in an IMG tag.

Desbordamiento de búfer en EasyBoard 2000 1.27 (aka EZboard) permite que atacantes remotos ejecuten código arbitrario mediante un valor de límite grande en un encabezamiento multipart Content-Type para o (1) ezboard.cgi, (2) ezman.cgi, o (3) ezadmin.cgi.

Infopop UBB.Threads 5.4 y Wired Community Software WWWThreads 5.0 a 5.0.9 permiten atacantes remotos cargar (upload) ficheros arbitrarios usando un nombre de fichero que contiene una extensión aceptada, pero finaliza con otra diferente.

Vulnerabilidad Cross-site en el último Bulletin Board de Infopop (UBB) 6.2.0 Beta release 1.0 que permite a atacantes remotos ejecutar scripts y cookies de robo vía un mensaje que contiene Javascript codificado en una etiqueta IMG.

Buffer overflow in CrazyWWWBoard 2000p4 and 2000LEp5 allows remote attackers to execute arbitrary code via a long HTTP_USER_AGENT CGI environment variable.

CardBoard 2.4 greeting card CGI by Michael Barretto allows remote attackers to execute arbitrary commands via shell metacharacters in the recipient field.

Directory traversal vulnerability in Search.cgi in Ikonboard ib219 and earlier allows remote attackers to overwrite files and gain privileges via .. (dot dot) sequences in the amembernamecookie cookie.

Directory traversal vulnerability in Search.cgi in Leoboard LB5000 LB5000II 1029 and earlier allows remote attackers to overwrite files and gain privileges via .. (dot dot) sequences in the amembernamecookie cookie.

Cross-site scripting vulnerability in Infopop Ultimate Bulletin Board (UBB) before 5.47e allows remote attackers to steal user cookies via an [IMG] tag that references an about: URL with an onerror field.