CVE-2008-4929

MyBB 1.4.2 stores attachments with filenames generated using insufficient randomness, allowing remote attackers to read files by guessing names. Affected component: attachment filename generation. Impact: partial confidentiality of attachment contents. Root cause: weak randomness in filename cons...

PT-2008-6105 · Mybb · Mybb

Name of the Vulnerable Software and Affected Versions: MyBB versions 1.4.2 Description: The issue is related to insufficient randomness used to compose filenames of uploaded files used as attachments. This makes it easier for remote attackers to read these files by guessing filenames...

MyBB消息附件可预测文件名漏洞

BUGTRAQ ID: 31936 MyBB是一款流行的Web论坛程序。 在某些运行MyBB的服务器上，攻击者可以较容易的猜测到上传文件的文件名。有漏洞的代码段为： $filename = "post".$mybb-user'uid'."".time.".attach"; 这段代码创建以下形式的文件名：post1234unix timestamp.attach. 如果知道了用户ID和张贴时间，就可以轻易的猜测到文件名，并绕过任何类型的MIME嗅探保护；此外这还可能导致权限提升，因为无论用户权限如何都可以读取附件。 MyBB 1.4.2 MyBB ----...

MyBB 1.4.2: Multiple Vulnerabilties

====================================================================== Advisory: MyBB 1.4.2 - Multiple Vulnerabilities Release Date: October 27 2008 Application: MyBB Version: MyBB 1.4.2 Platform: PHP Vendor URL: http://www.mybboard.net/ Authors: Kellanved, NeoThermic, Techie-Micheal...

MyBB moderation.php跨站脚本执行漏洞

BUGTRAQ ID: 31935 MyBB是一款流行的Web论坛程序。 MyBB moderation.php文件中的redirect函数使用AJAX开关允许JavaScript重新定向，如果用户在请求中包含有htmlspecialchars无法转义的单引号的话，就可以执行跨站脚本攻击，导致以提升的权限执行任意操作，包括PHP和SQL注入。 MyBB 1.4.2 MyBB ---- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://www.mybboard.com/...

MyBB 1.4.2 - moderation.php Cross-Site Scripting

MyBB 1.4.2 - moderation.php Cross-Site Scripting source: https://www.securityfocus.com/bid/31935/info MyBB is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data. An attacker may leverage this issue to execute arbitrary script code in t...

MyBB 1.4.2 - 'moderation.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/31935/info MyBB is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context...

MyBB 1.4.2存在多个安全漏洞

BUGTRAQ ID: 31295 CNCAN ID：CNCAN-2008092311 MyBB是一款基于PHP的论坛程序。 MyBB不正确处理用户提交的输入，远程攻击者可以利用漏洞进行跨站脚本等攻击。 -通过URL传递的输入在返回给用户前缺少过滤，可导致在目标用户浏览器上执行任意HTML和脚本代码。 -文件global.php, announcements.php, admin/inc/classpage.php, inc/functions.php, inc/datahandlers/post.php, inc/classerror.php, polls.php,...

MyBB < 1.4.1 Multiple Vulnerabilities

Binary data 4688.prm...

MyBB < 1.4.1 Multiple Vulnerabilities

Binary data 4655.prm...

MyBB 1.41版本之前多个未明漏洞

BUGTRAQ ID: 31104 CVE ID：CVE-2008-3965 CVE-2008-3966 CVE-2008-3967 CNCVE ID：CNCVE-20083965 CNCVE-20083966 CNCVE-20083967 MyBB是一款基于PHP的论坛程序。 MyBB存在多个安全问题，远程攻击者可以利用漏洞获得敏感信息等攻击。 目前没有详细漏洞细节提供。 MyBulletinBoard MyBulletinBoard 1.4 MyBulletinBoard MyBulletinBoard 1.2.12 MyBulletinBoard MyBulletinBoard...

CVE-2008-3967

moderation.php in MyBB aka MyBulletinBoard before 1.4.1 does not properly check for moderator privileges, which has unknown impact and remote attack vectors...

CVE-2008-3966

Multiple cross-site scripting XSS vulnerabilities in MyBB aka MyBulletinBoard before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via 1 a certain referrer field in usercp2.php, 2 a certain location field in inc/functionsonline.php, and certain 3 tsubject and 4 psubject fiel...

CVE-2008-3965

SQL injection vulnerability in misc.php in MyBB aka MyBulletinBoard before 1.4.1 allows remote attackers to execute arbitrary SQL commands via a certain editor field...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in MyBB aka MyBulletinBoard before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via 1 a certain referrer field in usercp2.php, 2 a certain location field in inc/functionsonline.php, and certain 3 tsubject and 4 psubject fiel...

Design/Logic Flaw

moderation.php in MyBB aka MyBulletinBoard before 1.4.1 does not properly check for moderator privileges, which has unknown impact and remote attack vectors...

Sql injection

SQL injection vulnerability in misc.php in MyBB aka MyBulletinBoard before 1.4.1 allows remote attackers to execute arbitrary SQL commands via a certain editor field...

CVE-2008-3967

The CVE-2008-3967 entry concerns MyBB (MyBulletinBoard) moderation.php prior to version 1.4.1, where moderator privilege checks are not performed correctly. The description notes unknown impact and remote attack vectors. Public references corroborate the version boundary (before 1.4.1) but do not...

CVE-2008-3966

CVE-2008-3966 affects MyBB (MyBulletinBoard) up to version 1.4.1. It enables remote XSS via (1) a referrer field in usercp2.php, (2) a location field in inc/functions_online.php, and (3) tsubject and (4) psubject fields in moderation.php. The vulnerability allows injection of arbitrary web script...

CVE-2008-3966

Multiple cross-site scripting XSS vulnerabilities in MyBB aka MyBulletinBoard before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via 1 a certain referrer field in usercp2.php, 2 a certain location field in inc/functionsonline.php, and certain 3 tsubject and 4 psubject fiel...