Path disclosure in MyBB

Vulnerability ID: HTB22654 Reference: http://www.htbridge.ch/advisory/pathdisclosureinmybb.html Product: MyBB Vendor: MyBB http://www.mybb.com Vulnerable Version: 1.6 Vendor Notification: 13 October 2010 Vulnerability Type: Path disclosure Status: Not Fixed, Vendor Alerted, Awaiting Vendor Respon...

MyBB 1.6 Path Disclosure

Vulnerability ID: HTB22654 Reference: http://www.htbridge.ch/advisory/pathdisclosureinmybb.html Product: MyBB Vendor: MyBB http://www.mybb.com Vulnerable Version: 1.6 Vendor Notification: 13 October 2010 Vulnerability Type: Path disclosure Status: Not Fixed, Vendor Alerted, Awaiting Vendor Respon...

MyBB 1.6 - Full Path Disclosure

Vulnerability ID: HTB22654 Reference: http://www.htbridge.ch/advisory/pathdisclosureinmybb.html Product: MyBB Vendor: MyBB http://www.mybb.com Vulnerable Version: 1.6 Vendor Notification: 13 October 2010 Vulnerability Type: Path disclosure Status: Not Fixed, Vendor Alerted, Awaiting Vendor Respon...

MyBB 1.6 - Full Path Disclosure

MyBB 1.6 - Full Path Disclosure Vulnerability ID: HTB22654 Reference: http://www.htbridge.ch/advisory/pathdisclosureinmybb.html Product: MyBB Vendor: MyBB http://www.mybb.com Vulnerable Version: 1.6 Vendor Notification: 13 October 2010 Vulnerability Type: Path disclosure Status: Not Fixed, Vendor...

Installation Path Disclosure Weakness in MyBB

High-Tech Bridge SA Security Research Lab has discovered a weakness in MyBB which could be exploited to gain access to potentially sensitive information. 1 Installation path disclosure weakness in MyBB The weakness exists due to application reveals the full path to installation directory in an...

MYBB 1.6 (admin/index.php) XSS Vulnerabilities

Exploit for php platform in category web applications ============================================== MYBB 1.6 admin/index.php XSS Vulnerabilities ============================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 1 1 /' \ /'\ /\ \ /'\ 0 0 /, ...

MyBB TagCloud 2.0 Cross Site Scripting

==================================================== MYBB TagCloud 2.0 cross site scripting vulnerability ==================================================== Author: http://www.3ethicalhackers.com Discovered by: http://www.3ethicalhackers.com Original post: http://www.3ethicalhackers.com...

Advanced Stats On Indexing Portal 3.1 Cross Site Scripting

+--------------------------+-------------------------------+ | 3 Ethical Hackers . com | +--------------------------+-------------------------------+ irc.smashthestack.org 3ethical Affected software: Advanced Stats On Indexing plugin for mybb php bbs Versions: ".$thread'subject'." ".$lang-asoiby....

CVE-2009-4813

Cross-site scripting XSS vulnerability in myps.php in MyBB aka MyBulletinBoard 1.4.10 allows remote attackers to inject arbitrary web script or HTML via the username parameter in a donate action...

Cross site scripting

Cross-site scripting XSS vulnerability in myps.php in MyBB aka MyBulletinBoard 1.4.10 allows remote attackers to inject arbitrary web script or HTML via the username parameter in a donate action...

CVE-2009-4813

CVE-2009-4813 describes a cross-site scripting (XSS) vulnerability in MyBB (MyBulletinBoard) version 1.4.10, specifically in the script file myps.php. The issue arises when processing the donate action where the username parameter is not properly sanitized, allowing a remote attacker to inject ar...

CVE-2009-4813

Cross-site scripting XSS vulnerability in myps.php in MyBB aka MyBulletinBoard 1.4.10 allows remote attackers to inject arbitrary web script or HTML via the username parameter in a donate action...

MyBB 1.4.12 <= Full Path Disclosure

Exploit for php platform in category web applications =================================== MyBB 1.4.12 = Full Path Disclosure =================================== Exploit Title: MyBB 1.4.12 = Full Path Disclosure Software MyBB 1.4.X Date: 2010-04-19 Author: GLOBUS Software Link: http://mybboard.net...

MyBB &lt;= 1.4.11 论坛口令重置功能弱随机数漏洞

BUGTRAQ ID: 39404 MyBB是一款流行的Web论坛程序。 MyBB的口令重置实现在生成口令重置令牌和随机口令时使用了弱随机数，如果Web服务器重新使用了PHP进程的话攻击者就可以破解口令入侵任意账号。 MyBB在多处使用了mtsrand函数对随机数生成器提供种子： // Setup a unique posthash for attachment management if!$mybb-input'posthash' && $mybb-input'action' != "editdraft" mtsranddouble microtime 1000000; $postha...

MyBB < 1.4.12 Multiple Vulnerabilities

Binary data 5513.prm...

MyBB set_common_header()邮件BCC头注入漏洞

BUGTRAQ ID: 39400 MyBB是一款流行的Web论坛程序。 MyBB的口令重置实现中存在邮件注入漏洞，远程攻击者可以通过简单的URL控制就可以向BCC:邮件头中注入代码，将保密的口令重置邮件发送到BCC: 头所指向的邮箱。 在MailHandler类的setcommonheader方式中，以下代码负责向所有发出的邮件（包括口令重置邮件）中添加一些常用的头： $this-headers .= "Message-ID: $msgid$this-delimiter"; $this-headers .= "Content-Transfer-Encoding:...

Advisory 01/2010: MyBB Password Reset Email BCC: Injection Vulnerability

SektionEins GmbH www.sektioneins.de -= Security Advisory =- Advisory: MyBB Password Reset Email BCC: Injection Vulnerability Release Date: 2010/04/13 Last Modified: 2010/04/13 Author: Stefan Esser stefan.esseratsektioneins.de Application: MyBB = 1.4.11 Severity: An email injection vulnerability i...

Advisory 02/2010: MyBB Password Reset Weak Random Numbers Vulnerability

SektionEins GmbH www.sektioneins.de -= Security Advisory =- Advisory: MyBB Password Reset Weak Random Numbers Vulnerability Release Date: 2010/04/13 Last Modified: 2010/04/13 Author: Stefan Esser stefan.esseratsektioneins.de Application: MyBB = 1.4.11 Severity: Usage of weak random number...

GUI MyBB 2002-2010 exploit

Exploit for php platform in category web applications ========================== GUI MyBB 2002-2010 exploit ========================== !/usr/local/bin/ruby GUI MyBB 2002-2010 04/04/10 Whivack Contact Me = email protected Dork Google : "Moteur MyBB, 2002-2010 MyBB Group." No Security : No Captcha...

MyBB 2002-2010 exploit

Exploit for php platform in category web applications ====================== MyBB 2002-2010 exploit ====================== !/usr/local/bin/ruby MyBB Owned 30/03/10 Ruby Code By, Whivack Gsk Win32 and Ruby Interpreter 1.8.6 Dork Google : "Moteur MyBB, 2002-2010 MyBB Group." Sensitive URL :...