CVE-2006-4707

CVE-2006-4707 is an XSS vulnerability in MyBB 1.1.7, exploitable through the Admin CP login form (admin/global.php) by supplying malicious input in the query string ($_SERVER[PHP_SELF]). The NVD record notes a CVSS v2 base score of 6.8 (Medium) with impacts to confidentiality, integrity, and avai...

[KAPDA]MyBB 1.1.7~ htmlspeacialchar_uni(), fixjavascript(), functions_post.php ~[url]XSS attack

ORIGINAL ADVISORY: http://myimei.com/security/2006-08-15/mybb-117-htmlspeacialcharuni-fixjavascript-functionspostphp-urlxss-attack.html http://kapda.ir/page-advisory.html ——————-Summary—————- Software: MyBB Sowtware’s Web Site: http://www.mybboard.com Versions: 1.1.7 Class: Remote Status: Unpatch...

[KAPDA]MyBB 1.1.7 ~ admin/global.php ~ XSS Attack

ORIGINAL ADVISORY: http://myimei.com/security/2006-08-17/mybb-117-adminglobalphp-xss-attack.html http://kapda.ir/page-advisory.html ——————-Summary—————- Software: MyBB Sowtware’s Web Site: http://www.mybboard.com Versions: 1.1.7 Class: Remote Status: Unpatched Exploit: Available Solution: Availab...

CVE-2006-4449

CVE-2006-4449 describes a Cross-site Scripting (XSS) vulnerability in attachment.php of MyBulletinBoard (MyBB) 1.1.7 and possibly other versions. The issue allows remote attackers to inject arbitrary web script or HTML by abusing a GIF image that contains URL-encoded Javascript, which is rendered...

[SA21645] MyBB Avatar / Attachment Script Insertion Vulnerability

TITLE: MyBB Avatar / Attachment Script Insertion Vulnerability SECUNIA ADVISORY ID: SA21645 VERIFY ADVISORY: http://secunia.com/advisories/21645/ CRITICAL: Less critical IMPACT: Cross Site Scripting WHERE: From remote SOFTWARE: MyBB formerly MyBulletinBoard 1.x http://secunia.com/product/4479/...

MyBB Html Injection ( XSS )

Hi MyBB Have Xss In Avatar And Attachment.php HEX editor With GIF picture Open , JS code are writing. GIF89a
jscode Js Code:Hex:...

MyBB 1.1.7 - Multiple HTML Injection Vulnerabilities

MyBB 1.1.7 - Multiple HTML Injection Vulnerabilities source: https://www.securityfocus.com/bid/19718/info MyBB is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and...

MyBB 1.1.7 - Multiple HTML Injection Vulnerabilities

source: https://www.securityfocus.com/bid/19718/info MyBB is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code would execute in the context of the...

EV0132.txt

New eVuln Advisory: MyBB 'Avatar URL' XSS Vulnerability http://evuln.com/vulns/132/summary.html --------------------Summary---------------- eVuln ID: EV0132 Vendor: MyBB Group Vendor's Web Site: http://www.mybboard.com/ Software: MyBB Sowtware's Web Site: http://www.mybboard.com/ Versions: 1.1.6...

[eVuln] MyBB 'Avatar URL' XSS Vulnerability

New eVuln Advisory: MyBB 'Avatar URL' XSS Vulnerability http://evuln.com/vulns/132/summary.html --------------------Summary---------------- eVuln ID: EV0132 Vendor: MyBB Group Vendor's Web Site: http://www.mybboard.com/ Software: MyBB Sowtware's Web Site: http://www.mybboard.com/ Versions: 1.1.6...

[KAPDA::#53] MYBB XSS and Dir Traversal in usercp.php

Vulnerable products : MYBB 1.x Vendor: http://www.mybboard.net Risk: Low Vulnerabilities: MYBB XSS and Dir Traversal in usercp.php Date : -------------------- Found : Feb 22 2006 Vendor Contacted : N/A Release Date : N/A About : -------------------- MyBB is a powerful, efficient and free forum...

CVE-2006-3954

Directory traversal vulnerability in usercp.php in MyBB aka MyBulletinBoard 1.x allows remote attackers to read arbitrary files via a .. dot dot in the gallery parameter in a 1 avatar or 2 doavatar action...

CVE-2006-3953

Cross-site scripting XSS vulnerability in usercp.php in MyBB aka MyBulletinBoard 1.x allows remote attackers to inject arbitrary web script or HTML via the gallery parameter...

CVE-2006-3954

MyBB 1.x has a directory traversal vulnerability in usercp.php (gallery parameter) that allows remote attackers to read arbitrary files via .. in the avatar or do_avatar actions. The NVD entry assigns CVSSv2 base score 5.0 (Medium) with network access and no authentication; impact listed as parti...

CVE-2006-3953

CVE-2006-3953 is a cross-site scripting (XSS) vulnerability in MyBB (MyBulletinBoard) 1.x, exposed via the gallery parameter of the file usercp.php. The issue allows remote attackers to inject arbitrary web script or HTML, with the vulnerability rooted in improper handling of input. The NVD lists...

CVE-2006-3954

Directory traversal vulnerability in usercp.php in MyBB aka MyBulletinBoard 1.x allows remote attackers to read arbitrary files via a .. dot dot in the gallery parameter in a 1 avatar or 2 doavatar action...

CVE-2006-3953

Cross-site scripting XSS vulnerability in usercp.php in MyBB aka MyBulletinBoard 1.x allows remote attackers to inject arbitrary web script or HTML via the gallery parameter...

MyBulletinBoard (MyBB) 1.x - 'usercp.php' Directory Traversal

source: https://www.securityfocus.com/bid/19195/info MyBulletinBoard is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the...

MyBB < 1.1.6 HTTP Header CLIENT-IP Field SQL Injection

Binary data 3689.prm...

CVE-2006-3775

Summary: CVE-2006-3775 affects MyBB (MyBulletinBoard) via the init function in class_session.php, version 1.1.5, allowing remote attackers to execute arbitrary SQL commands through the CLIENT-IP HTTP header used by index.php. Related entries extend the issue to MyBB 1.2.3 and earlier (create_sess...