CVE-2010-4626

The myrand function in functions.php in MyBB aka MyBulletinBoard before 1.4.12 does not properly use the PHP mtrand function, which makes it easier for remote attackers to obtain access to an arbitrary account by requesting a reset of the account's password, and then conducting a brute-force atta...

Design/Logic Flaw

MyBB aka MyBulletinBoard before 1.4.12 does not properly restrict uid values for group join requests, which allows remote attackers to cause a denial of service resource consumption by using guest access to submit join request forms for moderated groups, related to usercp.php and managegroup.php...

Default credentials

The myrand function in functions.php in MyBB aka MyBulletinBoard before 1.4.12 does not properly use the PHP mtrand function, which makes it easier for remote attackers to obtain access to an arbitrary account by requesting a reset of the account's password, and then conducting a brute-force atta...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in MyBB aka MyBulletinBoard 1.4.14, and 1.6.x before 1.6.1, allow remote attackers to inject arbitrary web script or HTML via vectors related to 1 editpost.php, 2 member.php, and 3 newreply.php...

Design/Logic Flaw

MyBB aka MyBulletinBoard before 1.4.12 does not properly handle a configuration with a visible forum that contains hidden threads, which allows remote attackers to obtain sensitive information by reading the Latest Threads block of the Portal Page...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in usercp2.php in MyBB aka MyBulletinBoard before 1.4.12 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

Code injection

member.php in MyBB aka MyBulletinBoard before 1.4.12 makes a certain superfluous call to the SQL COUNT function, which allows remote attackers to cause a denial of service resource consumption by making requests to member.php that trigger scans of the entire users table...

Design/Logic Flaw

MyBB aka MyBulletinBoard before 1.4.12 allows remote authenticated users to bypass intended restrictions on the number of img MyCodes by editing a post after it has been created...

CVE-2010-4625

MyBB aka MyBulletinBoard before 1.4.12 does not properly handle a configuration with a visible forum that contains hidden threads, which allows remote attackers to obtain sensitive information by reading the Latest Threads block of the Portal Page...

CVE-2010-4624

MyBB aka MyBulletinBoard before 1.4.12 allows remote authenticated users to bypass intended restrictions on the number of img MyCodes by editing a post after it has been created...

CVE-2010-4629

CVE-2010-4629 affects MyBB (MyBulletinBoard) up to version 1.4.12. The issue arises because the application does not properly restrict uid values for group join requests, enabling remote attackers with guest access to submit join forms for moderated groups via the pages related to usercp.php and ...

CVE-2010-4628

member.php in MyBB aka MyBulletinBoard before 1.4.12 makes a certain superfluous call to the SQL COUNT function, which allows remote attackers to cause a denial of service resource consumption by making requests to member.php that trigger scans of the entire users table...

CVE-2010-4626

The myrand function in functions.php in MyBB aka MyBulletinBoard before 1.4.12 does not properly use the PHP mtrand function, which makes it easier for remote attackers to obtain access to an arbitrary account by requesting a reset of the account's password, and then conducting a brute-force atta...

CVE-2010-4626

CVE-2010-4626 affects MyBB up to version 1.4.11 where the my_rand function in functions.php does not properly use PHP’s mt_rand, enabling remote attackers to subvert password reset flows and perform brute-force account access. The root cause is inadequate randomness in the reset mechanism. The pu...

CVE-2010-4627

Cross-site request forgery CSRF vulnerability in usercp2.php in MyBB aka MyBulletinBoard before 1.4.12 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors...

CVE-2010-4624

CVE-2010-4624 affects MyBB (MyBulletinBoard) up to version 1.4.12. Remote authenticated users can bypass restrictions on the number of [img] MyCodes by editing a post after creation. Root cause details are not elaborated in the provided documents beyond the basic description. Impact is limited to...

CVE-2010-4522

MyBB versions 1.4.14 and 1.6.x before 1.6.1 contain multiple XSS vulnerabilities that allow remote attackers to inject arbitrary script/HTML via editpost.php, member.php, and newreply.php. Root cause is improper input handling in those endpoints leading to stored/reflected input being executed in...

CVE-2010-4625

Affected software: MyBB (MyBulletinBoard) prior to version 1.4.12. Vulnerable component: portal page Latest Threads block that may read hidden threads. Root cause: mis-handling of a configuration where a visible forum contains hidden threads, enabling information disclosure. Impact: remote attack...

CVE-2010-4627

The CVE-2010-4627 issue affects MyBB (MyBulletinBoard) prior to 1.4.12, where a CSRF in usercp2.php could allow remote attackers to hijack user authentication via unknown vectors. Documented impact is authenticated session hijack; no concrete exploit details are provided in the sources. Acknowled...

CVE-2010-4628

CVE-2010-4628 affects MyBB (MyBulletinBoard) prior to 1.4.12. A superfluous SQL COUNT call in member.php allows remote attackers to cause resource consumption by triggering scans of the entire users table, leading to DoS. The referenced sources indicate the vulnerability, with no explicit exploit...