Vulnerabilities > Invisionpower > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2018-03-20 | CVE-2014-4928 | SQL Injection vulnerability in Invisioncommunity Invision Power Board SQL injection vulnerability in Invision Power Board (aka IPB or IP.Board) before 3.4.6 allows remote attackers to execute arbitrary SQL commands via the cId parameter. | 6.5 |
| 2017-05-11 | CVE-2017-8899 | Information Exposure vulnerability in Invisioncommunity Invision Power Board Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has a composite of Stored XSS and Information Disclosure issues in the attachments feature found in User CP. | 6.8 |
| 2017-05-11 | CVE-2017-8897 | Cross-site Scripting vulnerability in Invisioncommunity Invision Power Board Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has pre-auth reflected XSS in the IPS UTF8 Converter v1.1.18: admin/convertutf8/index.php?controller= is the attack vector. | 4.3 |
| 2016-07-12 | CVE-2016-6174 | PHP Code Injection vulnerability in IPS Community Suite applications/core/modules/front/system/content.php in Invision Power Services IPS Community Suite (aka Invision Power Board, IPB, or Power Board) before 4.1.13, when used with PHP before 5.4.24 or 5.5.x before 5.5.8, allows remote attackers to execute arbitrary code via the content_class parameter. | 6.8 |
| 2014-07-28 | CVE-2014-5106 | Cross-Site Scripting vulnerability in Invisioncommunity Invision Power Board Cross-site scripting (XSS) vulnerability in Invision Power IP.Board (aka IPB or Power Board) 3.4.x through 3.4.6 allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header to admin/install/index.php. | 4.3 |
| 2014-07-03 | CVE-2014-3149 | Cross-Site Scripting vulnerability in multiple products Cross-site scripting (XSS) vulnerability in Invision Power IP.Board (aka IPB or Power Board) 3.3.x and 3.4.x through 3.4.6, as downloaded before 20140424, or IP.Nexus 1.5.x through 1.5.9, as downloaded before 20140424, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | 4.3 |
| 2010-09-16 | CVE-2010-3424 | Cross-Site Scripting vulnerability in Invisioncommunity Invision Power Board 3.1.2 Cross-site scripting (XSS) vulnerability in admin/sources/classes/bbcode/custom/defaults.php in Invision Power Board (IP.Board) 3.1.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | 4.3 |
| 2006-02-10 | CVE-2006-0633 | Improper Authentication vulnerability in Invisionpower Invision Power Board 2.1.4 The make_password function in ipsclass.php in Invision Power Board (IPB) 2.1.4 uses random data generated from partially predictable seeds to create the authentication code that is sent by e-mail to a user with a lost password, which might make it easier for remote attackers to guess the code and change the password for an IPB account, possibly involving millions of requests. | 6.4 |