CVE-2016-9410

CVE-2016-9410 relates to information disclosure in MyBB (MyBulletinBoard) prior to 1.8.7 and MyBB Merge System prior to 1.8.7. The issue allows remote attackers to obtain sensitive database information through vectors involving templates. This entry is supported by multiple sources (NVD/NVD-deriv...

CVE-2015-8977

CVE-2015-8977 affects MyBB (MyBulletinBoard) versions prior to 1.6.18 and 1.8.x prior to 1.8.6, plus the MyBB Merge System before 1.8.6. The issue allows remote attackers to disclose the installation path via vectors involving error log files, resulting in information disclosure. Root cause, as s...

CVE-2016-9403

The CVE-2016-9403 issue affects MyBB (MyBulletinBoard) releases prior to 1.8.7 and the MyBB Merge System prior to 1.8.7. The root cause is a missing permission check in newreply.php, allowing remote attackers to impact the system in an unspecified way. The vulnerability is described with a high/c...

CVE-2015-8973

xmlhttp.php in MyBB aka MyBulletinBoard before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to bypass intended access restrictions via vectors related to the forum password...

CVE-2016-9403

newreply.php in MyBB aka MyBulletinBoard before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to have unspecified impact by leveraging a missing permission check...

CVE-2016-9410

MyBB aka MyBulletinBoard before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to obtain sensitive database information via vectors involving templates...

CVE-2016-9407

Cross-site scripting XSS vulnerability in MyBB aka MyBulletinBoard before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors involving Mod control panel logs...

CVE-2015-8977: Insertion of Sensitive Information into Log File

MyBB aka MyBulletinBoard before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allow remote attackers to obtain the installation path via vectors involving error log files...

CVE-2016-9413: Improper Access Control

The Admin control panel in MyBB aka MyBulletinBoard before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to conduct clickjacking attacks via unspecified vectors...

CVE-2016-9405: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in member validation in MyBB aka MyBulletinBoard before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2017-10118

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.7 MyBB Merge System versions prior to 1.8.7 Description The issue allows remote attackers to execute arbitrary SQL commands. Recommendations For MyBB versions prior to 1.8.7, update to version 1.8.7 or later. For MyB...

PT-2017-10119

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.7 MyBB Merge System versions prior to 1.8.7 Description The issue is related to a missing permission check in the newreply.php file, which can be leveraged by remote attackers to have an unspecified impact...

PT-2017-10124

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.7 MyBB Merge System versions prior to 1.8.7 Description A cross-site scripting XSS issue exists in the Mod control panel, potentially allowing remote attackers to inject arbitrary web script or HTML through editing...

PT-2017-10130

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.7 MyBB Merge System versions prior to 1.8.7 Description The issue allows remote attackers to obtain sensitive information by leveraging missing directory listing protection in upload directories. Recommendations For...

CVE-2016-9406: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the User control panel in MyBB aka MyBulletinBoard before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-9414: Exposure of Sensitive Information to an Unauthorized Actor

MyBB aka MyBulletinBoard before 1.8.7 and MyBB Merge System before 1.8.7 allow remote attackers to obtain sensitive information by leveraging missing directory listing protection in upload directories...

PT-2017-10126

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.7 MyBB Merge System versions prior to 1.8.7 Description The issue might allow remote attackers to obtain sensitive database information via vectors involving templates. Recommendations For MyBB versions prior to 1.8....

PT-2017-7510

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.6.18 MyBB versions 1.8.x prior to 1.8.6 MyBB Merge System versions prior to 1.8.6 Description The issue allows remote attackers to bypass intended access restrictions. This is related to the forum password...

PT-2017-10123

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.7 MyBB Merge System versions prior to 1.8.7 Description A cross-site scripting XSS issue might allow remote attackers to inject arbitrary web script or HTML via vectors involving Mod control panel logs. Recommendatio...

PT-2017-10127

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.7 MyBB Merge System versions prior to 1.8.7 Description The issue allows remote attackers to obtain the installation path by sending mails, specifically targeting the Admin control panel. Recommendations For MyBB...