CVE-2006-1911

The CVE-2006-1911 entry concerns MyBB (MyBulletinBoard) version 1.1 with a Cross-site Scripting (XSS) vulnerability. The root cause is an issue in how attachment content disposition is handled in HTML attachments, allowing remote attackers to inject arbitrary web script or HTML. Practical impact:...

CVE-2006-1912

The CVE-2006-1912 issue affects MyBB 1.1.0 where the constant KILL_GLOBAL is not set in global.php and inc/init.php. This allows a remote attacker to initialize arbitrary variables processed by an @extract, which could be leveraged to perform cross-site scripting (XSS) or SQL injection. Multiple ...

MyBB 1.1 - Global Variable Overwrite

source: https://www.securityfocus.com/bid/17564/info MyBB is prone to a vulnerability that permits an attacker to overwrite global variables. This issue is due to a design flaw in handling HTTP GET and POST variables. An attacker can exploit this issue to overwrite the global variables with...

MyBB 1.1 - Global Variable Overwrite

MyBB 1.1 - Global Variable Overwrite source: https://www.securityfocus.com/bid/17564/info MyBB is prone to a vulnerability that permits an attacker to overwrite global variables. This issue is due to a design flaw in handling HTTP GET and POST variables. An attacker can exploit this issue to...

MyBB global.php 'KILL_GLOBAL' Overwrite SQL Injection

The version of MyBB installed on the remote host is affected by a global variable overwrite vulnerability due to a failure to properly initialize global variables in the global.php script. A remote, unauthenticated attacker can exploit this issue to overwrite global variables to launch a SQL...

[KAPDA]MyBB1.1.0~global.php~ParameterExtracting

ORIGINAL ADVISORY: http://myimei.com/security/2006-04-14/mybb110globalphpparameterextracting.html ——————-Summary—————- Software: MyBB Sowtware’s Web Site: http://www.mybboard.com Versions: 1.1.0 Class: Remote Status: Unpatched Exploit: Available Solution: Available Discovered by: imei...

MyBB 1.10 New CrossSiteScripting ' member.php '

//-- MyBB 1.10 New CrossSiteScripting ' member.php ' --// Webattack :- /mybb/member.php?action=dologin&username=usrname&password=pass&url="scriptalert1;/script //-- FixIT --// Open member.php GoTo Line :- 1030 .. if$mybb-input'url' redirect$mybb-input'url', $lang-redirectloggedin; Replace It With...

MyBB 1.10 New XSS ' member.php '

//-- MyBB 1.10 New XSS ' member.php ' --// Webattack :- 1- Logout 2- Open Firefox 3- Use Live HTTP Headers 4- Do Register 5- Agree It 6- Edit Cookies By Live HTTP Headers 7- Add This Cookies :D mybbreferrer="/inputbHTML/binput; //-- FixIT --// Open member.php GoTo Line :- 595 .. $referrername =...

MyBB 1.10 - member.php Cross-Site Scripting

MyBB 1.10 - member.php Cross-Site Scripting source: https://www.securityfocus.com/bid/17492/info MyBB is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code executed in the brows...

MyBB 1.10 - 'member.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/17492/info MyBB is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of...

Cross site scripting

Cross-site scripting XSS vulnerability in newthread.php in MyBB aka MyBulletinBoard 1.10, when configured to permit new threads by unregistered users, allows remote attackers to inject arbitrary web script or HTML via the username...

CVE-2006-1717

Cross-site scripting XSS vulnerability in newthread.php in MyBB aka MyBulletinBoard 1.10, when configured to permit new threads by unregistered users, allows remote attackers to inject arbitrary web script or HTML via the username...

Cross site scripting

Cross-site scripting XSS vulnerability in inc/functionspost.php in MyBB aka MyBulletinBoard 1.10 allows remote attackers to inject arbitrary web script or HTML via a JavaScript event in a BBCode img tag. NOTE: the email vector is already covered by CVE-2006-1625, although it might stem from the...

CVE-2006-1716

Cross-site scripting XSS vulnerability in inc/functionspost.php in MyBB aka MyBulletinBoard 1.10 allows remote attackers to inject arbitrary web script or HTML via a JavaScript event in a BBCode img tag. NOTE: the email vector is already covered by CVE-2006-1625, although it might stem from the...

CVE-2006-1717

CVE-2006-1717 is a documented XSS vulnerability in MyBB 1.10, occurring in newthread.php when unregistered users are allowed to create threads. The username field can be used to inject arbitrary script/HTML. Public references (NVD, CVE lists) align on the issue, with a CVSS v2 base score of 5.1 (...

CVE-2006-1716

Cross-site scripting XSS vulnerability in inc/functionspost.php in MyBB aka MyBulletinBoard 1.10 allows remote attackers to inject arbitrary web script or HTML via a JavaScript event in a BBCode img tag. NOTE: the email vector is already covered by CVE-2006-1625, although it might stem from the...

CVE-2006-1716

MyBB 1.10 contains a Cross-site Scripting (XSS) flaw in inc/functions_post.php, exploitable via a JavaScript event in a BBCode image tag (and related email-tag variant). This is documented as CVE-2006-1716 (with CVE-2006-1625 noting the email vector). The concrete affected component is the BBCode...

MyBB 1.10 'newthread.php' < CrossSiteScripting >

MyBB 1.10 'newthread.php' CrossSiteScripting Devil-00 | D3vil-0x1 Conditions 1- your unregisterd user 2- you have permissions to do newthread --------------- do newthread with this username :- scriptalertdocument.cookie;/scriptD3vil-0x1 Then Preview it ; ---------------...

[KAPDA::#38] - MyBB 1.1.0~functions_post.php~XSS Attack

ORIGINAL ADVISORY: http://myimei.com/security/2006-03-12/mybb-110functionspostphpxss-attack.html http://kapda.ir/advisory-305.html ---------- ——————-Summary—————- Software: MyBB Sowtware’s Web Site: http://www.mybboard.com Versions: 1.1.0 Class: Remote Status: Unpatched Exploit: Private Solution:...

Cross site scripting

Cross-site scripting XSS vulnerability in inc/functionspost.php in MyBB aka MyBulletinBoard 1.10 allows remote attackers to inject arbitrary web script or HTML via a JavaScript event in a BBCode email tag, as demonstrated using the onmousemove event...