CVE-2006-3954

MyBB 1.x has a directory traversal vulnerability in usercp.php (gallery parameter) that allows remote attackers to read arbitrary files via .. in the avatar or do_avatar actions. The NVD entry assigns CVSSv2 base score 5.0 (Medium) with network access and no authentication; impact listed as parti...

CVE-2006-3954: Undefined Security Weakness

Directory traversal vulnerability in usercp.php in MyBB aka MyBulletinBoard 1.x allows remote attackers to read arbitrary files via a .. dot dot in the gallery parameter in a 1 avatar or 2 doavatar action...

CVE-2006-3953: Undefined Security Weakness

Cross-site scripting XSS vulnerability in usercp.php in MyBB aka MyBulletinBoard 1.x allows remote attackers to inject arbitrary web script or HTML via the gallery parameter...

MyBulletinBoard (MyBB) 1.x - 'usercp.php' Directory Traversal

source: https://www.securityfocus.com/bid/19195/info MyBulletinBoard is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the...

MyBB < 1.1.6 HTTP Header CLIENT-IP Field SQL Injection

Binary data 3689.prm...

CVE-2006-3775

SQL injection vulnerability in the init function in classsession.php in MyBB aka MyBulletinBoard 1.1.5 allows remote attackers to execute arbitrary SQL commands via the CLIENT-IP HTTP header $SERVER'HTTPCLIENTIP' variable, as utilized by index.php...

CVE-2006-3775

Summary: CVE-2006-3775 affects MyBB (MyBulletinBoard) via the init function in class_session.php, version 1.1.5, allowing remote attackers to execute arbitrary SQL commands through the CLIENT-IP HTTP header used by index.php. Related entries extend the issue to MyBB 1.2.3 and earlier (create_sess...

CVE-2006-3761

Cross-site scripting XSS vulnerability in inc/functionspost.php in MyBB aka MyBulletinBoard 1.0 RC2 through 1.1.4 allows remote attackers to inject arbitrary web script or HTML via a javascript URI with an SGML numeric character reference in the url BBCode tag, as demonstrated using "javacript"...

CVE-2006-3759

Unspecified vulnerability in MyBB aka MyBulletinBoard 1.1.4, related has unspecified impact and attack vectors related to "user group manipulation."...

CVE-2006-3760

Multiple SQL injection vulnerabilities in MyBB aka MyBulletinBoard 1.1.4 allow remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2006-3758

inc/init.php in Archive Mode Light in MyBB aka MyBulletinBoard 1.1.4 calls the extract function with EXTROVERWRITE on HTTP POST and GET variables, which allows remote attackers to overwrite arbitrary variables, as demonstrated via an SQL injection using the SERVERHTTPCLIENTIP parameter in...

CVE-2006-3758

inc/init.php in Archive Mode Light in MyBB aka MyBulletinBoard 1.1.4 calls the extract function with EXTROVERWRITE on HTTP POST and GET variables, which allows remote attackers to overwrite arbitrary variables, as demonstrated via an SQL injection using the SERVERHTTPCLIENTIP parameter in...

CVE-2006-3760

CVE-2006-3760 affects MyBB (MyBulletinBoard) 1.1.4 with multiple SQL injection vulnerabilities allowing remote execution of arbitrary SQL commands via unspecified vectors. Connected documents confirm the issue but do not provide concrete exploit vectors, affected components beyond the product/ver...

CVE-2006-3775: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the init function in classsession.php in MyBB aka MyBulletinBoard 1.1.5 allows remote attackers to execute arbitrary SQL commands via the CLIENT-IP HTTP header $SERVER'HTTPCLIENTIP' variable, as utilized by index.php...

CVE-2006-3759: Undefined Security Weakness

Unspecified vulnerability in MyBB aka MyBulletinBoard 1.1.4, related has unspecified impact and attack vectors related to "user group manipulation."...

CVE-2006-3758

CVE-2006-3758 pertains to MyBB (aka MyBulletinBoard) 1.1.4 where inc/init.php in Archive Mode (Light) calls PHP’s extract with EXTR_OVERWRITE on HTTP POST/GET variables, allowing a remote attacker to overwrite arbitrary variables. The vulnerability is demonstrated via an SQL injection using the _...

CVE-2006-3760: Undefined Security Weakness

Multiple SQL injection vulnerabilities in MyBB aka MyBulletinBoard 1.1.4 allow remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2006-3759

Technical details, affected product versions, root cause, and exploitation specifics are not provided in the supplied documents. Monitor for updates from NVD/CVE listings for CVE-2006-3759.

CVE-2006-3761

Cross-site scripting XSS vulnerability in inc/functionspost.php in MyBB aka MyBulletinBoard 1.0 RC2 through 1.1.4 allows remote attackers to inject arbitrary web script or HTML via a javascript URI with an SGML numeric character reference in the url BBCode tag, as demonstrated using "javacript"...

CVE-2006-3761

CVE-2006-3761 is a cross-site scripting (XSS) vulnerability in MyBB (MyBulletinBoard) affecting versions 1.0 RC2 through 1.1.4, reported as an issue in inc/functions_post.php. The vulnerability allows remote attackers to inject arbitrary web script or HTML by crafting a javascript URI containing ...