2280 matches found
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in the Admin Control Panel ACP login in MyBB aka MyBulletinBoard before 1.8.4 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...
CVE-2015-2149
Multiple cross-site scripting XSS vulnerabilities in the administrative backend in MyBB aka MyBulletinBoard before 1.8.4 allow remote authenticated users to inject arbitrary web script or HTML via the 1 MIME-type field in an add action in the config-attachmenttypes module to admin/index.php; 2...
CVE-2015-2334
Cross-site request forgery CSRF vulnerability in the Admin Control Panel ACP login in MyBB aka MyBulletinBoard before 1.8.4 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...
CVE-2015-2333
CVE-2015-2333 affects MyBB (MyBulletinBoard) via the MyCode editor, with an XSS vulnerability in versions before 1.8.4. The issue allows remote attackers to inject arbitrary web script or HTML through unspecified vectors. Affected product/version: MyBB
CVE-2015-2333
Cross-site scripting XSS vulnerability in the MyCode editor in MyBB aka MyBulletinBoard before 1.8.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...
CVE-2015-2335
A JSON library in MyBB aka MyBulletinBoard before 1.8.4 allows remote attackers to obtain the installation path via unknown vectors...
CVE-2015-2149
MyBB prior to version 1.8.4 contains multiple XSS vulnerabilities in the administrative backend (admin/index.php) that allow remote authenticated users to inject arbitrary script/HTML via various fields across modules (config-attachment_types, config-mycode, user-groups, forum-management, tool-ta...
CVE-2015-2334
CVE-2015-2334 describes a CSRF vulnerability in the Admin Control Panel (ACP) login of MyBB (pre-1.8.4) that allows remote attackers to hijack user authentication. The root cause is CSRF in the ACP login flow; victims’ sessions could be manipulated via unspecified vectors. The publicly documented...
CVE-2015-2332
The CVE-2015-2332 issue affects MyBB before 1.8.4, where member.php is vulnerable to cross-site scripting (XSS). The root cause is an XSS flaw that allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Practical impact is limited to affected installations that pr...
CVE-2015-2335
MyBB before 1.8.4 contains a JSON library information-disclosure vulnerability (CVE-2015-2335). The issue allows remote attackers to obtain the installation path via unknown vectors, impacting MyBB’s JSON handling. Affected product: MyBB (MyBulletinBoard) versions prior to 1.8.4; root cause is in...
KLA10465 Multiple vulnerabilities in MyBB
Multiple serious vulnerabilities have been found in MyBB. Malicious users can exploit these vulnerabilities to obtain sensitive information or conduct cross site scrtipting. Below is a complete list of vulnerabilities 1. An unknown vulnerability can be exploited remotely via vectors related to...
MyBB < 1.6.15 Video MyCode XSS
According to its version number, the MyBB application hosted on the remote web server is prior to 1.6.15. It is, therefore, potentially affected by a cross-site scripting vulnerability in video MyCode due to improper validation of user-supplied input. A remote attacker can exploit this to execute...
Multiple HTML Injection Vulnerabilities in MyBB
MyBB is a popular forum program. MyBB suffers from multiple HTML injection vulnerabilities because it fails to properly sanitize user-supplied input. An attacker can execute the provided HTML and script code in the context of the affected site...
MyBB 1.8.3 Cross Site Scripting
Advisory: Stored XSS-Vulnerabilities in MyBB v. 1.8.3 Advisory ID: SROEADV-2015-15 Author: Steffen Rösemann Affected Software: MyBB v. 1.8.3 Vendor URL: http://www.mybb.com Vendor Status: patched CVE-ID: - ========================== Vulnerability Description: ========================== MyBB v...
MyBB 1.8.1 /report.php 跨站脚本漏洞
No description provided by source. !/usr/bin/env python coding: utf-8 import re from pocsuite.net import req from pocsuite.poc import POCBase, Output from pocsuite.utils import register This poc requires a valid username and it's password to work Users can register one manually. class...
MyBB 1.8.1 /admin/modules/config/language.php 跨站脚本漏洞
No description provided by source. !/usr/bin/env python coding: utf-8 import re from pocsuite.net import req from pocsuite.poc import POCBase, Output from pocsuite.utils import register This poc requires a valid credentialcookie to the ACPAdmin Control Panel to work. class TestPOCPOCBase: vulID =...
MyBB < 1.6.14 DoS
Binary data 8630.prm...
MyBB < 1.6.13 Multiple Vulnerabilities
Binary data 8629.prm...