CVE-2024-23335

CVE-2024-23335 affects MyBB prior to 1.8.38. The backup management module in Admin CP may accept ".htaccess" as the backup file name, potentially exposing stored backups over HTTP on Apache servers. The fixed version is MyBB 1.8.38. Remediation: upgrade to 1.8.38 (no public workarounds documented...

CVE-2024-23335 Backups directory .htaccess deletion in. MyBB

MyBB is a free and open source forum software. The backup management module of the Admin CP may accept .htaccess as the name of the backup file to be deleted, which may expose the stored backup files over HTTP on Apache servers. MyBB 1.8.38 resolves this issue. Users are advised to upgrade. There...

CVE-2024-23336

CVE-2024-23336 concerns MyBB (prior to 1.8.38) where the default Disallowed Remote Addresses list did not include 127.0.0.0/8, enabling potential SSRF against internal resources. The issue stems from the configuration in inc/config.php where disallowed_remote_addresses contains 127.0.0.1 but omit...

CVE-2024-23336 Incomplete disallowed remote addresses list in MyBB

MyBB is a free and open source forum software. The default list of disallowed remote hosts does not contain the 127.0.0.0/8 block, which may result in a Server-Side Request Forgery SSRF vulnerability. The Configuration File's Disallowed Remote Addresses list $config'disallowedremoteaddresses'...

Stable Channel Update for Desktop

The Stable channel has been updated to 124.0.6367.118/.119 for Windows, Mac and 124.0.6367.118 for Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log. The Extended Stable channel has been updated to 124.0.6367.118 for Mac and Windows...

nordicwalkingforum.nl Improper Access Control vulnerability OBB-3923259

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Asgaros Forum < 2.9.0 - Cross-Site Request Forgery

Description The Asgaros Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.0. This is due to missing or incorrect nonce validation on the markallread function. This makes it possible for unauthenticated attackers to mark post topics as rea...

Who Stole 3.6M Tax Records from South Carolina?

For nearly a dozen years, residents of South Carolina have been kept in the dark by state and federal investigators over who was responsible for hacking into the states revenue department in 2012 and stealing tax and bank account information for 3.6 million people. The answer may no longer be a...

forum-thyroide.net Cross Site Scripting vulnerability OBB-3918466

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Hive RAT Creators and $3.5M Cryptojacking Mastermind Arrested in Global Crackdown

Two individuals have been arrested in Australia and the U.S. in connection with an alleged scheme to develop and distribute a remote access trojan called Hive RAT previously Firebird. The U.S. Justice Department DoJ said the malware "gave the malware purchasers control over victim computers and...

CVE-2024-32440

Cross-Site Request Forgery CSRF vulnerability in Thomas Belser Asgaros Forum.This issue affects Asgaros Forum: from n/a through 2.8.0...

CVE-2024-32440 WordPress Asgaros Forum plugin <= 2.8.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Thomas Belser Asgaros Forum.This issue affects Asgaros Forum: from n/a through 2.8.0...

CVE-2024-32440

CVE-2024-32440 is a CSRF vulnerability in Asgaros Forum affecting the plugin for WordPress versions up to 2.8.0 (no fixed version indicated in the provided docs). The initial description confirms Cross-Site Request Forgery as the issue; connected documents corroborate the vulnerability name and a...

CVE-2024-32440 WordPress Asgaros Forum plugin <= 2.8.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Thomas Belser Asgaros Forum.This issue affects Asgaros Forum: from n/a through 2.8.0...

CVE-2024-32440 WordPress Asgaros Forum plugin <= 2.8.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Thomas Belser Asgaros Forum.This issue affects Asgaros Forum: from n/a through 2.8.0...

WordPress Plugin Asgaros Forum 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

Codoforum 安全漏洞

Codoforum is a PHP and MySQL based forum software. A security vulnerability exists in Codoforum version v4.9, which stems from the presence of a stored cross-site scripting XSS vulnerability that allows an attacker to execute arbitrary code and obtain sensitive information via a crafted payload...

WordPress Asgaros Forum plugin <= 2.8.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Asgaros Forum versions = 2.8.0...

WordPress Asgaros Forum Plugin <= 2.8.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Asgaros Forum Type Plugin Vulnerable versions = 2.8.0 Fixed in 2.9.0 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-32440 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 4d6dad870cc9 Credits Ananda Dhakal...

kampfkunst-forum.com Cross Site Scripting vulnerability OBB-3914905

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...