MyBB Full path and Cross site scripting vulnerabilities

Hello Title : MyBB Full path and Cross site scripting vulnerabilities Discovered by : HACKERS PAL Copyrights : HACKERS PAL Website : WwW.SoQoR.NeT Email : [email protected] xss archive/index.php/forum-4.html?GLOBALS=1&navbitsname=33&navbitsname=scriptalertdocument.cookie;/script full path...

mybbxss.txt

Hello Title : MyBB Full path and Cross site scripting vulnerabilities Discovered by : HACKERS PAL Copyrights : HACKERS PAL Website : WwW.SoQoR.NeT Email : [email protected] xss archive/index.php/forum-4.html?GLOBALS=1&navbitsname=33&navbitsname=alertdocument.cookie; full path inc/plugins/hello.p...

CVE-2006-4706

Cross-site scripting XSS vulnerability in inc/functionspost.php in MyBB aka MyBulletinBoard 1.1.7 allows remote attackers to inject arbitrary web script or HTML via a url BBCode tag that contains a javascript URI with an SGML numeric character reference and an embedded space, as demonstrated usin...

CVE-2006-4707

Cross-site scripting XSS vulnerability in admin/global.php aka the Admin CP login form in MyBB aka MyBulletinBoard 1.1.7 allows remote attackers to inject arbitrary web script or HTML via the query string $SERVERPHPSELF...

CVE-2006-4706

Cross-site scripting XSS vulnerability in inc/functionspost.php in MyBB aka MyBulletinBoard 1.1.7 allows remote attackers to inject arbitrary web script or HTML via a url BBCode tag that contains a javascript URI with an SGML numeric character reference and an embedded space, as demonstrated usin...

CVE-2006-4706

The CVE-2006-4706 entry describes a Cross-site Scripting (XSS) flaw in MyBB (MyBulletinBoard) 1.1.7, specifically in inc/functions_post.php. An attacker can inject arbitrary script/HTML through the url BBCode tag that carries a javascript URI using an SGML numeric character reference with an embe...

CVE-2006-4707

CVE-2006-4707 is an XSS vulnerability in MyBB 1.1.7, exploitable through the Admin CP login form (admin/global.php) by supplying malicious input in the query string ($_SERVER[PHP_SELF]). The NVD record notes a CVSS v2 base score of 6.8 (Medium) with impacts to confidentiality, integrity, and avai...

[KAPDA]MyBB 1.1.7~ htmlspeacialchar_uni(), fixjavascript(), functions_post.php ~[url]XSS attack

ORIGINAL ADVISORY: http://myimei.com/security/2006-08-15/mybb-117-htmlspeacialcharuni-fixjavascript-functionspostphp-urlxss-attack.html http://kapda.ir/page-advisory.html ——————-Summary—————- Software: MyBB Sowtware’s Web Site: http://www.mybboard.com Versions: 1.1.7 Class: Remote Status: Unpatch...

[KAPDA]MyBB 1.1.7 ~ admin/global.php ~ XSS Attack

ORIGINAL ADVISORY: http://myimei.com/security/2006-08-17/mybb-117-adminglobalphp-xss-attack.html http://kapda.ir/page-advisory.html ——————-Summary—————- Software: MyBB Sowtware’s Web Site: http://www.mybboard.com Versions: 1.1.7 Class: Remote Status: Unpatched Exploit: Available Solution: Availab...

CVE-2006-4449

CVE-2006-4449 describes a Cross-site Scripting (XSS) vulnerability in attachment.php of MyBulletinBoard (MyBB) 1.1.7 and possibly other versions. The issue allows remote attackers to inject arbitrary web script or HTML by abusing a GIF image that contains URL-encoded Javascript, which is rendered...

[SA21645] MyBB Avatar / Attachment Script Insertion Vulnerability

TITLE: MyBB Avatar / Attachment Script Insertion Vulnerability SECUNIA ADVISORY ID: SA21645 VERIFY ADVISORY: http://secunia.com/advisories/21645/ CRITICAL: Less critical IMPACT: Cross Site Scripting WHERE: From remote SOFTWARE: MyBB formerly MyBulletinBoard 1.x http://secunia.com/product/4479/...

MyBB Html Injection ( XSS )

Hi MyBB Have Xss In Avatar And Attachment.php HEX editor With GIF picture Open , JS code are writing. GIF89a
jscode Js Code:Hex:...

MyBB 1.1.7 - Multiple HTML Injection Vulnerabilities

MyBB 1.1.7 - Multiple HTML Injection Vulnerabilities source: https://www.securityfocus.com/bid/19718/info MyBB is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and...

MyBB 1.1.7 - Multiple HTML Injection Vulnerabilities

source: https://www.securityfocus.com/bid/19718/info MyBB is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content. Attacker-supplied HTML and script code would execute in the context of the...

EV0132.txt

New eVuln Advisory: MyBB 'Avatar URL' XSS Vulnerability http://evuln.com/vulns/132/summary.html --------------------Summary---------------- eVuln ID: EV0132 Vendor: MyBB Group Vendor's Web Site: http://www.mybboard.com/ Software: MyBB Sowtware's Web Site: http://www.mybboard.com/ Versions: 1.1.6...

[eVuln] MyBB 'Avatar URL' XSS Vulnerability

New eVuln Advisory: MyBB 'Avatar URL' XSS Vulnerability http://evuln.com/vulns/132/summary.html --------------------Summary---------------- eVuln ID: EV0132 Vendor: MyBB Group Vendor's Web Site: http://www.mybboard.com/ Software: MyBB Sowtware's Web Site: http://www.mybboard.com/ Versions: 1.1.6...

[KAPDA::#53] MYBB XSS and Dir Traversal in usercp.php

Vulnerable products : MYBB 1.x Vendor: http://www.mybboard.net Risk: Low Vulnerabilities: MYBB XSS and Dir Traversal in usercp.php Date : -------------------- Found : Feb 22 2006 Vendor Contacted : N/A Release Date : N/A About : -------------------- MyBB is a powerful, efficient and free forum...

CVE-2006-3954

Directory traversal vulnerability in usercp.php in MyBB aka MyBulletinBoard 1.x allows remote attackers to read arbitrary files via a .. dot dot in the gallery parameter in a 1 avatar or 2 doavatar action...

CVE-2006-3953

Cross-site scripting XSS vulnerability in usercp.php in MyBB aka MyBulletinBoard 1.x allows remote attackers to inject arbitrary web script or HTML via the gallery parameter...

CVE-2006-3954

MyBB 1.x has a directory traversal vulnerability in usercp.php (gallery parameter) that allows remote attackers to read arbitrary files via .. in the avatar or do_avatar actions. The NVD entry assigns CVSSv2 base score 5.0 (Medium) with network access and no authentication; impact listed as parti...