CVE-2017-16781

The installer in MyBB before 1.8.13 has XSS...

Cross site scripting

The installer in MyBB before 1.8.13 has XSS...

CVE-2017-16781

The installer in MyBB before 1.8.13 has XSS...

CVE-2017-16780

The installer in MyBB before 1.8.13 allows remote attackers to execute arbitrary code by writing to the configuration file...

CVE-2017-16780

The installer in MyBB before 1.8.13 allows remote attackers to execute arbitrary code by writing to the configuration file...

CVE-2017-16781

The installer in MyBB before 1.8.13 has XSS...

CVE-2017-16781

The installer in MyBB before 1.8.13 has XSS...

CVE-2017-16780

The installer in MyBB before 1.8.13 allows remote attackers to execute arbitrary code by writing to the configuration file...

CVE-2017-16780

MyBB 1.8.x is affected by CVE-2017-16780: the installer before 1.8.13 allows an unauthenticated remote attacker to write to the configuration file, enabling remote code execution. The root cause is improper handling during installation that permits arbitrary code execution via the config file. Im...

CVE-2017-16781

MyBB before 1.8.13 is vulnerable to a cross-site scripting (XSS) flaw in the installer. The issue arises from missing HTML escaping of the $error variable in /install/index.php (POST path), enabling an attacker-controlled payload to execute in the victim’s browser. A PoC demonstrates injecting HT...

PT-2017-14554

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.13 Description The issue is related to the installer in MyBB, which has a cross-site scripting XSS problem. Recommendations For versions prior to 1.8.13, update to version 1.8.13 or later to resolve the issue...

CVE-2017-16780: Cross-Site Request Forgery (CSRF)

The installer in MyBB before 1.8.13 allows remote attackers to execute arbitrary code by writing to the configuration file...

CVE-2017-16781: Improper Neutralization of Input During Web Page Generation

The installer in MyBB before 1.8.13 has XSS...

Installer of HYPER SBI may insecurely load Dynamic Link Libraries

Overview HYPER SBI provided by SBI SECURITIES Co.,Ltd. is a trading tool. Installer of HYPER SBI contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Yuto Iso of NTT Security Japan KK reported this vulnerability to IPA. JPCERT/CC...

JVN#71284826: Installer of HYPER SBI may insecurely load Dynamic Link Libraries

HYPER SBI provided by SBI SECURITIES Co.,Ltd. is a trading tool. Installer of HYPER SBI contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Impact Arbitrary code may be executed with the privilege of the user invoking the installer...

mybb -- multiple vulnerabilities

myBB Team reports: High risk: Installer RCE on configuration file write High risk: Language file headers RCE Medium risk: Installer XSS Medium risk: Mod CP Edit Profile XSS Low risk: Insufficient moderator permission check in delayed moderation tools Low risk: Announcements HTML filter bypass Low...

CVE-2017-10825

Untrusted search path vulnerability in Installer of Flets Easy Setup Tool Ver1.2.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

Design/Logic Flaw

Untrusted search path vulnerability in Installer of Flets Easy Setup Tool Ver1.2.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2017-10825

Untrusted search path vulnerability in Installer of Flets Easy Setup Tool Ver1.2.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2017-10825

CVE-2017-10825 affects the Installer of Flets Easy Setup Tool (Ver 1.2.0 and earlier). The underlying issue is an insecure DLL search path (untrusted search path) that allows arbitrary code execution with the privileges of the user invoking the installer when a Trojan horse DLL is present in an u...