MyBB Moderator Log Notes Plugin Cross-Site Request Forgery Vulnerability

MyBB aka MyBulletinBoard is a free and Web-based forum software developed by the MyBB team using PHP and MySQL.Moderator Log Notes plugin is used in one of the plug-ins used to manage log records. A cross-site request forgery vulnerability exists in version 1.1 of the MyBB Moderator Log Notes...

CVE-2018-11502

The CVE-2018-11502 issue affects the MyBB Moderator Log Notes plugin (version 1.1) for MyBB. The vulnerability is a CSRF flaw that lets an attacker remotely delete all moderator notes and moderator-note logs stored in modCP and ACP. Root cause is cross-site request forgery in the plugin’s note ma...

MyBB Moderator Log Notes Plugin 1.1 - Cross-Site Request Forgery Vulnerability

Exploit for php platform in category web applications Exploit Title: MyBB Moderator Log Notes Plugin 1.1 - Cross-Site Request Forgery Author: 0xB9 Twitter: @0xB9Sec Software Link: https://community.mybb.com/mods.php?action=view&pid=1105 Version: 1.1 Tested on: Ubuntu 18.04 1. Description: The...

MyBB Moderator Log Notes Plugin 1.1 - Cross-Site Request Forgery

MyBB Moderator Log Notes Plugin 1.1 - Cross-Site Request Forgery Exploit Title: MyBB Moderator Log Notes Plugin 1.1 - Cross-Site Request Forgery Date: 2018-05-17 Author: 0xB9 Twitter: @0xB9Sec Software Link: https://community.mybb.com/mods.php?action=view&pid=1105 Version: 1.1 Tested on: Ubuntu...

MyBB Moderator Log Notes 1.1 Cross Site Request Forgery

Exploit Title: MyBB Moderator Log Notes Plugin 1.1 - Cross-Site Request Forgery Date: 2018-05-17 Author: 0xB9 Twitter: @0xB9Sec Software Link: https://community.mybb.com/mods.php?action=view&pid=1105 Version: 1.1 Tested on: Ubuntu 18.04 1. Description: The plugin allows moderators to save notes a...

MyBB Moderator Log Notes Plugin 1.1 - Cross-Site Request Forgery

Exploit Title: MyBB Moderator Log Notes Plugin 1.1 - Cross-Site Request Forgery Date: 2018-05-17 Author: 0xB9 Twitter: @0xB9Sec Software Link: https://community.mybb.com/mods.php?action=view&pid=1105 Version: 1.1 Tested on: Ubuntu 18.04 1. Description: The plugin allows moderators to save notes a...

Chaturbate: Add non-existent room moderator

Description A broadcaster can add or remove a non-existent user as a moderator. This is submitted using the testbed as it wasn't possible to initiate a broadcast on the production site. Steps 1. As a broadcaster add a moderator to the broadcast attachment 1. 2. Observe the request sent to the...

Vanilla: Unsanitized input in email field

Users are able to inject javascript payloads in the email field which leads to stored XSS Steps to produce : 1. Go to profile and add "alert1"@example.com as your email . 2. We can see the popup at https://discuss.paytm.com/profile/preferences/profilename Impact Users can store malicious payloads...

MyBB Moderator Log Notes Plugin Cross-Site Scripting Vulnerability

MyBB aka MyBulletinBoard is MyBB team developed a set of PHP and MySQL development of free and Web-based forum software . Moderator Log Notes plugin is used in which a management log records plugin . A cross-site scripting vulnerability exists in version 1.1 of the MyBB Moderator Log Notes plugin...

CVE-2018-11430

An issue was discovered in the Moderator Log Notes plugin 1.1 for MyBB. It allows moderators to save notes and display them in a list in the modCP. The XSS is located in the mod notes textarea...

Design/Logic Flaw

An issue was discovered in the Moderator Log Notes plugin 1.1 for MyBB. It allows moderators to save notes and display them in a list in the modCP. The XSS is located in the mod notes textarea...

CVE-2018-11430

The CVE-2018-11430 entry involves the MyBB Moderator Log Notes plugin (version 1.1) for MyBB. A cross-site scripting (XSS) vulnerability exists in the mod notes textarea used by moderators in the Moderator Control Panel, allowing arbitrary script injection when notes are saved/displayed. Connecte...

CVE-2018-11430

An issue was discovered in the Moderator Log Notes plugin 1.1 for MyBB. It allows moderators to save notes and display them in a list in the modCP. The XSS is located in the mod notes textarea...

MyBB Moderator Log Notes Plugin 1.1 - Cross-Site Scripting

MyBB Moderator Log Notes Plugin 1.1 - Cross-Site Scripting Exploit Title: MyBB Moderator Log Notes Plugin 1.1 - Cross-Site Scripting Date: 2018-05-17 Author: 0xB9 Software Link: https://community.mybb.com/mods.php?action=view&pid=1105 Version: 1.1 Tested on: Ubuntu 18.04 CVE: N/A 1. Description:...

MyBB Moderator Log Notes 1.1 Cross Site Scripting

Exploit Title: MyBB Moderator Log Notes Plugin 1.1 - Cross-Site Scripting Date: 2018-05-17 Author: 0xB9 Software Link: https://community.mybb.com/mods.php?action=view&pid=1105 Version: 1.1 Tested on: Ubuntu 18.04 CVE: N/A 1. Description: The plugin allows moderators to save notes and display them...

MyBB Moderator Log Notes Plugin 1.1 - Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: MyBB Moderator Log Notes Plugin 1.1 - Cross-Site Scripting Author: 0xB9 Software Link: https://community.mybb.com/mods.php?action=view&pid=1105 Version: 1.1 Tested on: Ubuntu 18.04 CVE: N/A 1. Description: The plugin allows...

MyBB Moderator Log Notes Plugin 1.1 - Cross-Site Scripting

Exploit Title: MyBB Moderator Log Notes Plugin 1.1 - Cross-Site Scripting Date: 2018-05-17 Author: 0xB9 Software Link: https://community.mybb.com/mods.php?action=view&pid=1105 Version: 1.1 Tested on: Ubuntu 18.04 CVE: N/A 1. Description: The plugin allows moderators to save notes and display them...

mybb -- multiple vulnerabilities

mybb Team reports: Medium risk: Tasks Local File Inclusion Medium risk: Forum Password Check Bypass Low risk: Admin Permissions Group Title XSS Low risk: Attachment types file extension XSS Low risk: Moderator Tools XSS Low risk: Security Questions XSS Low risk: Settings Management XSS Low risk:...

mybb -- multiple vulnerabilities

myBB Team reports: High risk: Installer RCE on configuration file write High risk: Language file headers RCE Medium risk: Installer XSS Medium risk: Mod CP Edit Profile XSS Low risk: Insufficient moderator permission check in delayed moderation tools Low risk: Announcements HTML filter bypass Low...

Towards a Safer Internet for All: Winners of New Brunswick Video Contest Announced

Today more than ever, society needs to come together to work towards a better and safer future for all our children. This doesn’t just mean members of the public: companies can and should play a key role in helping to support worthy causes. Global citizenship and cyber security are two issues tha...