Invision Power Services (IPS) Community Suite vulnerabilities

In versions 4.1.19.2 and earlier of Invision Power Services (IPS) Community Suite, there is a combination of Stored XSS and Information Disclosure vulnerabilities in the attachments feature found in User CP. This can be triggered by any Invision Power Board user and can lead to gaining access to moderator/admin accounts.

In versions prior to 4.0.12.1 of Invision Power Services IPS Community Suite, remote attackers can cause a denial of service through a crafted URL, leading to loops and memory consumption.

In versions 4.1.19.2 and earlier of Invision Power Services (IPS) Community Suite, there is a stored XSS vulnerability in the Announcements section, allowing privilege escalation from an Invision Power Board moderator to an admin. The attack uses the announce_content parameter in an index.php?/modcp/announcements/&action=create request.