MyBB 1.2 usercp2.php [ $url ] CrossSiteScripting ( XSS )

Invalid characters removed from From: [email protected], |@securityfocus.com, MyBB 1.02 usercp2.php XSS ------------------------------ Devil-00 D3vil-0x1 - Attacking MyBB : [email protected] ----------------------------- File :- usercp2.php Var :- $url Line's :- - 39 - 58 - 84 - 108 - 130 - 149 - 1...

MyBB-search.txt

http://127.0.0.1/mybb/search.php?action=dosearch&keywords=&postthread=1&author=imei&matchusername=1&forums=all&findthreadst=1&numreplies=&postdate=0&pddir=1&sortby="alertdocument.cookie&sorder=1&showresults=threads&submit=Search --------------------Summary---------------- Software: MyBB Sowtware'...

kapda-25.txt

KAPDA::25 - MyBB 1.x CrossSiteScripting KAPDA New advisory Vulnerable products : MYBB 1.x Vendor: www.mybboard.net/ Risk: medium Vulnerabilities: CrossSiteScripting Discoverd by Roozbeh Afrasiabi www.persiax.com Date : -------------------- Found : Jan 21 2006 Vendor Contacted : N/A Release Date :...

CVE-2006-0442

Technical details about CVE-2006-0442 are not publicly provided in the supplied connected documents. The initial listing mentions XSS in MyBB 1.02 via notepad and signature parameters, but lacks concrete product/version/Vendor data beyond that. Monitor for updates.

[KAPDA::#25] - MyBB 1.x Cross_Site_Scripting

KAPDA::25 - MyBB 1.x CrossSiteScripting KAPDA New advisory Vulnerable products : MYBB 1.x Vendor: www.mybboard.net/ Risk: medium Vulnerabilities: CrossSiteScripting Discoverd by Roozbeh Afrasiabi www.persiax.com Date : -------------------- Found : Jan 21 2006 Vendor Contacted : N/A Release Date :...

MyBB 1.0.2 XSS attack in search.php redirection

http://127.0.0.1/mybb/search.php?action=dosearch&keywords=&postthread=1&author=imei&matchusername=1&forums=all&findthreadst=1&numreplies=&postdate=0&pddir=1&sortby="script language=javascriptalertdocument.cookie/script&sorder=1&showresults=threads&submit=Search...

CVE-2006-0406

search.php in MyBB 1.0.2 allows remote attackers to obtain sensitive information via a certain search request that reveals the table prefix in a SQL error message, possibly due to invalid parameters...

Cross site request forgery (csrf)

search.php in MyBB 1.0.2 allows remote attackers to obtain sensitive information via a certain search request that reveals the table prefix in a SQL error message, possibly due to invalid parameters...

CVE-2006-0406

search.php in MyBB 1.0.2 allows remote attackers to obtain sensitive information via a certain search request that reveals the table prefix in a SQL error message, possibly due to invalid parameters...

CVE-2006-0406

CVE-2006-0406 affects MyBB 1.0.2: the search.php component can leak schema details by returning a SQL error message that reveals the database table prefix, due to certain search parameters. This is a remote-information-disclosure risk without explicit exploitation details in the provided document...

[SA18603] MyBB User Control Panel Cross-Site Request Forgery

TITLE: MyBB User Control Panel Cross-Site Request Forgery SECUNIA ADVISORY ID: SA18603 VERIFY ADVISORY: http://secunia.com/advisories/18603/ CRITICAL: Less critical IMPACT: Hijacking WHERE: From remote SOFTWARE: MyBB formerly MyBulletinBoard 1.x http://secunia.com/product/4479/ DESCRIPTION: Roozb...

MyBB-sig.txt

NightWarrior nightwarrior771athotmail.com MyBB Signature HTML Code Injection http://www.mybboard.com/ example: Contact :nightwarrior771athotmail.com NightWarrior...

MyBB 1.0.1/1.0.2 Notepad - 'usercp.php' HTML Injection

source: https://www.securityfocus.com/bid/16361/info MyBB is prone to an HTML-injection vulnerability. This issue is due to a lack of proper sanitization of user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code would be executed in the contex...

MyBB 1.0.11.0.2 Notepad - usercp.php HTML Injection

MyBB 1.0.11.0.2 Notepad - usercp.php HTML Injection source: https://www.securityfocus.com/bid/16361/info MyBB is prone to an HTML-injection vulnerability. This issue is due to a lack of proper sanitization of user-supplied input before using it in dynamically generated content. Attacker-supplied...

Cross site scripting

Cross-site scripting XSS vulnerability in MyBulletinBoard MyBB allows remote attackers to inject arbitrary web script or HTML via a signature containing a JavaScript URI in the SRC attribute of an IMG element, in which the URI uses SGML numeric character references without trailing semicolons, as...

CVE-2006-0364

This entry concerns CVE-2006-0364, a cross-site scripting (XSS) vulnerability in MyBulletinBoard (MyBB). The issue arises when an attacker can inject arbitrary script/HTML via a signature that contains a JavaScript URI in the SRC attribute of an IMG element, where the URI uses SGML numeric charac...

MyBB 1.0.2 Sniffing table perfix bug in search.php

--------------------Summary---------------- Software: mybb Sowtware's Web Site: http://mybboard.com Versions: 1.0.2 Class: Remote Status: Unpatched Exploit: Available Solution: Not Available Discovered by: imei Risk: low -----------------Description--------------- mybb has a security bug that...

MyBB Signature HTML Code Injection

NightWarriorKurdish Hacker nightwarrior771athotmail.com MyBB Signature HTML Code Injection http://www.mybboard.com/ example: img src=&106&97&118&97&115&99&114&105&112&116&58&97&108&101&114&116&40&39&88&83&83&39&41 Contact :nightwarrior771athotmail.com NightWarriorKurdihs Hacker...

[SA18544] MyBB "Allow HTML in Signatures" Script Insertion Security Issue

TITLE: MyBB "Allow HTML in Signatures" Script Insertion Security Issue SECUNIA ADVISORY ID: SA18544 VERIFY ADVISORY: http://secunia.com/advisories/18544/ CRITICAL: Less critical IMPACT: Cross Site Scripting WHERE: From remote SOFTWARE: MyBB formerly MyBulletinBoard 1.x...

CVE-2006-0218

Multiple unspecified vulnerabilities in MyBulletinBoard MyBB before 1.0.2 have unspecified impact and attack vectors, related to 1 admin/moderate.php, 2 admin/themes.php, 3 inc/functions.php, 4 inc/functionsupload.php, 5 printthread.php, and 6 usercp.php, and probably related to SQL injection...