Invisioncommunity
Invisioncommunity Invision Power Board: vulnerabilidades y CVE
Invisioncommunity Invision Power Board tiene 19 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 3 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE19
Últimos 12 meses0
Críticas3
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2021-39250 | Media (5.4) | 0.81% | — | 17 ago 2021 | Invision Community (aka IPS Community Suite or IP-Board) before 4.6.5.1 allows stored XSS, with resultant code execution, because an uploaded file can be placed in an IFRAME element within user-generated content. For… |
| CVE-2021-39249 | Media (6.1) | 0.77% | — | 17 ago 2021 | Invision Community (aka IPS Community Suite or IP-Board) before 4.6.5.1 allows reflected XSS because the filenames of uploaded files become predictable through a brute-force attack against the PHP mt_rand function. |
| CVE-2009-5159 | Media (6.1) | 3.5% | — | 13 mar 2020 | Invision Power Board (aka IPB or IP.Board) 2.x through 3.0.4, when Internet Explorer 5 is used, allows XSS via a .txt attachment. |
| CVE-2013-3725 | Crítica (9.8) | 1.8% | — | 12 feb 2020 | Invision Power Board (IPB) through 3.x allows admin account takeover leading to code execution. |
| CVE-2012-2226 | Crítica (9.8) | 7.4% | — | 9 ene 2020 | Invision Power Board before 3.3.1 fails to sanitize user-supplied input which could allow remote attackers to obtain sensitive information or execute arbitrary code by uploading a malicious file. |
| CVE-2019-8278 | Media (6.1) | 1.9% | — | 2 mar 2019 | Stored XSS in Invision Power Board versions 3.3.1 - 3.4.8 leads to Remote Code Execution. |
| CVE-2014-4928 | Alta (8.8) | 1.1% | — | 20 mar 2018 | SQL injection vulnerability in Invision Power Board (aka IPB or IP.Board) before 3.4.6 allows remote attackers to execute arbitrary SQL commands via the cId parameter. |
| CVE-2017-8899 | Alta (8.1) | 1.5% | — | 11 may 2017 | Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has a composite of Stored XSS and Information Disclosure issues in the attachments feature found in User CP. This can be triggered by any Invision Power… |
| CVE-2017-8898 | Crítica (9.8) | 1.9% | — | 11 may 2017 | Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has stored XSS in the Announcements, allowing privilege escalation from an Invision Power Board moderator to an admin. An attack uses the… |
| CVE-2017-8897 | Media (6.1) | 1.2% | — | 11 may 2017 | Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has pre-auth reflected XSS in the IPS UTF8 Converter v1.1.18: admin/convertutf8/index.php?controller= is the attack vector. This UTF8 Converter… |
| CVE-2016-2564 | Media (5.9) | 1.3% | — | 23 abr 2017 | Invision Power Services (IPS) Community Suite before 4.1.9 makes session hijack easier by relying on the PHP uniqid function without the more_entropy flag. Attackers can guess an Invision Power Board session cookie if… |
| CVE-2016-6174 | Alta (8.1) | 12% | — | 12 jul 2016 | applications/core/modules/front/system/content.php in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) before 4.1.13, when used with PHP before 5.4.24 or 5.5.x before 5.5.8,… |
| CVE-2015-6812 | Alta (7.8) | 1.4% | — | 4 sept 2015 | Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) before 4.0.12.1 allows remote attackers to cause a denial of service (loop and memory consumption) via a crafted URL. |
| CVE-2014-9239 | Alta (7.5) | 1.4% | — | 3 dic 2014 | SQL injection vulnerability in the IPS Connect service (interface/ipsconnect/ipsconnect.php) in Invision Power Board (aka IPB or IP.Board) 3.3.x and 3.4.x through 3.4.7 before 20141114 allows remote attackers to execute… |
| CVE-2014-5106 | Media (4.3) | 1.1% | — | 28 jul 2014 | Cross-site scripting (XSS) vulnerability in Invision Power IP.Board (aka IPB or Power Board) 3.4.x through 3.4.6 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to… |
| CVE-2014-3149 | Media (4.3) | 1.9% | — | 3 jul 2014 | Cross-site scripting (XSS) vulnerability in Invision Power IP.Board (aka IPB or Power Board) 3.3.x and 3.4.x through 3.4.6, as downloaded before 20140424, or IP.Nexus 1.5.x through 1.5.9, as downloaded before 20140424,… |
| CVE-2012-5692 | Alta (10) | 26% | — | 31 oct 2012 | Unspecified vulnerability in admin/sources/base/core.php in Invision Power Board (aka IPB or IP.Board) 3.1.x through 3.3.x has unknown impact and remote attack vectors. |
| CVE-2010-3424 | Media (4.3) | 1.0% | — | 16 sept 2010 | Cross-site scripting (XSS) vulnerability in admin/sources/classes/bbcode/custom/defaults.php in Invision Power Board (IP.Board) 3.1.2 allows remote attackers to inject arbitrary web script or HTML via unspecified… |
| CVE-2009-3974 | Alta (7.5) | 1.0% | — | 18 nov 2009 | Multiple SQL injection vulnerabilities in Invision Power Board (IPB or IP.Board) 3.0.0, 3.0.1, and 3.0.2 allow remote attackers to execute arbitrary SQL commands via the (1) search_term parameter to… |