CVE-2019-12831

CVE-2019-12831 affects MyBB up to version 1.8.20. A crafted XML import can exploit MySQL’s string truncation during imports, enabling an attacker to write a PHP shell into the forum’s cache directory (demonstrated by truncating aaaaaaaaaaaaaaaaaaaaaaaaaa.php.css to aaaaaaaaaaaaaaaaaaaaaaaaaa.php ...

CVE-2019-12830

In MyBB before 1.8.21, an attacker can exploit a parsing flaw in the Private Message / Post renderer that leads to video BBCode persistent XSS to take over any forum account, aka a nested video MyCode issue...

CVE-2019-12830

CVE-2019-12830 affects MyBB releases before 1.8.21. A parsing flaw in the Private Message / Post renderer allows a crafted [video] BBCode to cause persistent XSS, enabling an attacker to take over a user’s forum account. The issue is described across multiple sources (NVD entry and Red Hat/CNVD v...

FreeBSD : mybb -- vulnerabilities (13960f55-8d35-11e9-9ba0-4c72b94353b5)

mybb Team reports : High risk: Theme import stylesheet name RCE High risk: Nested video MyCode persistent XSS Medium risk: Find Orphaned Attachments reflected XSS Medium risk: Post edit reflected XSS Medium risk: Private Messaging folders SQL injection Low risk: Potential phar deserialization...

MyBB <= 1.8.19 Multiple Vulnerabilities

MyBB is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mybb:mybb"; ifdescription...

MyBB <= 1.8.20: From Stored XSS to RCE

Impact Your browser does not support the video tag. We discovered a Stored XSS vulnerability that occured due to a parsing error in posts and private messages in MyBB 1.8.20 and prior versions, as well as an authenticated Remote Code Execution vulnerability that can be exploited by administrators...

MyBB Cross-Site Scripting Vulnerability (CNVD-2019-16947)

MyBB MyBulletinBoard is a free and Web-based forum software developed by MyBB team using PHP and MySQL. The software is characterized by its simplicity, multi-language support and extensibility. A cross-site scripting vulnerability exists in MyBB version 1.8.19, which can be exploited by attacker...

mybb -- vulnerabilities

mybb Team reports: High risk: Theme import stylesheet name RCE High risk: Nested video MyCode persistent XSS Medium risk: Find Orphaned Attachments reflected XSS Medium risk: Post edit reflected XSS Medium risk: Private Messaging folders SQL injection Low risk: Potential phar deserialization...

Cross site scripting

MyBB 1.8.19 has XSS in the resetpassword function...

CVE-2019-3579

MyBB 1.8.19 allows remote attackers to obtain sensitive information because it discloses the username upon receiving a password-reset request that lacks the code parameter...

Cross site request forgery (csrf)

MyBB 1.8.19 allows remote attackers to obtain sensitive information because it discloses the username upon receiving a password-reset request that lacks the code parameter...

CVE-2019-3578

MyBB 1.8.19 has XSS in the resetpassword function...

CVE-2019-3578

MyBB 1.8.19 has XSS in the resetpassword function...

CVE-2019-3579

MyBB 1.8.19 allows remote attackers to obtain sensitive information because it discloses the username upon receiving a password-reset request that lacks the code parameter...

CVE-2019-3578

CVE-2019-3578 affects MyBB 1.8.19 and is a Cross-Site Scripting (XSS) vulnerability in the resetpassword function. The available connected documents indicate the issue is an XSS in the resetpassword flow, enabling potential execution of client-side code. Details do not specify attack vectors beyo...

CVE-2019-3578

MyBB 1.8.19 has XSS in the resetpassword function...

CVE-2019-3579

Summary : CVE-2019-3579 affects MyBB 1.8.19, where a password-reset request that omits the code parameter discloses the username, enabling information disclosure. This is a server-side information leak in the password-reset flow that does not require authentication. The vulnerability is documente...

CVE-2019-3579

MyBB 1.8.19 allows remote attackers to obtain sensitive information because it discloses the username upon receiving a password-reset request that lacks the code parameter...

PT-2019-16627 · Mybb · Mybb

Name of the Vulnerable Software and Affected Versions: MyBB version 1.8.19 Description: The issue allows remote attackers to obtain sensitive information. This occurs because the software discloses the username when it receives a password-reset request that lacks the code parameter...

PT-2019-16626 · Mybb · Mybb

Name of the Vulnerable Software and Affected Versions: MyBB version 1.8.19 Description: The issue is related to a problem in the resetpassword function, which has XSS. Recommendations: For MyBB version 1.8.19, update to a newer version that contains a fix for this issue...