CVE-2017-16781

The installer in MyBB before 1.8.13 has XSS...

CVE-2017-16781

MyBB before 1.8.13 is vulnerable to a cross-site scripting (XSS) flaw in the installer. The issue arises from missing HTML escaping of the $error variable in /install/index.php (POST path), enabling an attacker-controlled payload to execute in the victim’s browser. A PoC demonstrates injecting HT...

CVE-2017-16781

The installer in MyBB before 1.8.13 has XSS...

CVE-2017-16780

The installer in MyBB before 1.8.13 allows remote attackers to execute arbitrary code by writing to the configuration file...

CVE-2017-16780

MyBB 1.8.x is affected by CVE-2017-16780: the installer before 1.8.13 allows an unauthenticated remote attacker to write to the configuration file, enabling remote code execution. The root cause is improper handling during installation that permits arbitrary code execution via the config file. Im...

PT-2017-14554

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.13 Description The issue is related to the installer in MyBB, which has a cross-site scripting XSS problem. Recommendations For versions prior to 1.8.13, update to version 1.8.13 or later to resolve the issue...

CVE-2017-16781: Improper Neutralization of Input During Web Page Generation

The installer in MyBB before 1.8.13 has XSS...

CVE-2017-16780: Cross-Site Request Forgery (CSRF)

The installer in MyBB before 1.8.13 allows remote attackers to execute arbitrary code by writing to the configuration file...

Installer of HYPER SBI may insecurely load Dynamic Link Libraries

Overview HYPER SBI provided by SBI SECURITIES Co.,Ltd. is a trading tool. Installer of HYPER SBI contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Yuto Iso of NTT Security Japan KK reported this vulnerability to IPA. JPCERT/CC...

JVN#71284826: Installer of HYPER SBI may insecurely load Dynamic Link Libraries

HYPER SBI provided by SBI SECURITIES Co.,Ltd. is a trading tool. Installer of HYPER SBI contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Impact Arbitrary code may be executed with the privilege of the user invoking the installer...

mybb -- multiple vulnerabilities

myBB Team reports: High risk: Installer RCE on configuration file write High risk: Language file headers RCE Medium risk: Installer XSS Medium risk: Mod CP Edit Profile XSS Low risk: Insufficient moderator permission check in delayed moderation tools Low risk: Announcements HTML filter bypass Low...

CVE-2017-10825

Untrusted search path vulnerability in Installer of Flets Easy Setup Tool Ver1.2.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2017-10825

Untrusted search path vulnerability in Installer of Flets Easy Setup Tool Ver1.2.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

Design/Logic Flaw

Untrusted search path vulnerability in Installer of Flets Easy Setup Tool Ver1.2.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2017-10825

Untrusted search path vulnerability in Installer of Flets Easy Setup Tool Ver1.2.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2017-10825

CVE-2017-10825 affects the Installer of Flets Easy Setup Tool (Ver 1.2.0 and earlier). The underlying issue is an insecure DLL search path (untrusted search path) that allows arbitrary code execution with the privileges of the user invoking the installer when a Trojan horse DLL is present in an u...

Installer of "Flets Easy Setup Tool" may insecurely load Dynamic Link Libraries

Overview Installer of "Flets Easy Setup Tool" provided by NIPPON TELEGRAPH AND TELEPHONE WEST CORPORATION contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Eili Masami of Tachibana Lab. reported this vulnerability to IPA. JPCERT/CC...

PT-2017-11533

Name of the Vulnerable Software and Affected Versions Flets Easy Setup Tool versions 1.2.0 and earlier Description The issue concerns an untrusted search path vulnerability in the Installer of the Flets Easy Setup Tool. This vulnerability allows an attacker to gain privileges via a Trojan horse D...

CVE-2017-10825: Untrusted Search Path

Untrusted search path vulnerability in Installer of Flets Easy Setup Tool Ver1.2.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

Bad Rabbit Linked to ExPetr/Not Petya Attacks

A link has been confirmed between the Bad Rabbit ransomware outbreak detected yesterday in major organizations in Russia and Ukraine and this summer’s ExPetr/Not Petya attacks. Researchers at Kaspersky Lab said there are “clear ties” between the two attacks though one major piece of the puzzle is...