CVSS: 4.7EPSS: 0%CPEs: 1EXPL: 0CVE-2024-23335 – Backups directory .htaccess deletion in. MyBB
https://notcve.org/view.php?id=CVE-2024-23335
MyBB is a free and open source forum software. The backup management module of the Admin CP may accept `.htaccess` as the name of the backup file to be deleted, which may expose the stored backup files over HTTP on Apache servers. MyBB 1.8.38 resolves this issue. Users are advised to upgrade. There are no known workarounds for this vulnerability MyBB es un software de foro gratuito y de código abierto. • https://github.com/mybb/mybb/commit/450259e501b94c9d483efb167cb2bf875605e111.patch https://github.com/mybb/mybb/security/advisories/GHSA-94xr-g4ww-j47r https://mybb.com/versions/1.8.38 • CWE-20: Improper Input Validation •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-23336 – Incomplete disallowed remote addresses list in MyBB
https://notcve.org/view.php?id=CVE-2024-23336
MyBB is a free and open source forum software. The default list of disallowed remote hosts does not contain the `127.0.0.0/8` block, which may result in a Server-Side Request Forgery (SSRF) vulnerability. The Configuration File's _Disallowed Remote Addresses_ list (`$config['disallowed_remote_addresses']`) contains the address `127.0.0.1`, but does not include the complete block `127.0.0.0/8`. MyBB 1.8.38 resolves this issue in default installations. Administrators of installed boards should update the existing configuration (`inc/config.php`) to include all addresses blocked by default. • https://docs.mybb.com/1.8/administration/configuration-file https://github.com/mybb/mybb/commit/d6a96019025de9149014e06b1df252e6122e5630 https://github.com/mybb/mybb/security/advisories/GHSA-qfrj-65mv-h75h https://mybb.com/versions/1.8.38 • CWE-184: Incomplete List of Disallowed Inputs CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-46251 – Visual editor persistent Cross-site Scripting (XSS) in MyBB
https://notcve.org/view.php?id=CVE-2023-46251
MyBB is a free and open source forum software. Custom MyCode (BBCode) for the visual editor (_SCEditor_) doesn't escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. This weakness can be exploited by pointing a victim to a page where the visual editor is active (e.g. as a post or Private Message) and operates on a maliciously crafted MyCode message. This may occur on pages where message content is pre-filled using a GET/POST parameter, or on reply pages where a previously saved malicious message is quoted. The impact is be mitigated when: 1. the visual editor is disabled globally (_Admin CP → Configuration → Settings → Clickable Smilies and BB Code: [Clickable MyCode Editor](https://github.com/mybb/mybb/blob/mybb_1836/install/resources/settings.xml#L2087-L2094)_ is set to _Off_), or 2. the visual editor is disabled for individual user accounts (_User CP → Your Profile → Edit Options_: _Show the MyCode formatting options on the posting pages_ checkbox is not checked). • https://github.com/mybb/mybb/commit/6dcaf0b4db6254f1833fe8dae295d9ddc2219276 https://github.com/mybb/mybb/security/advisories/GHSA-wj33-q7vj-9fr8 https://mybb.com/versions/1.8.37 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-45556
https://notcve.org/view.php?id=CVE-2023-45556
Cross Site Scripting vulnerability in Mybb Mybb Forums v.1.8.33 allows a local attacker to execute arbitrary code via the theme Name parameter in the theme management component. Vulnerabilidad de Cross-Site Scripting (XSS) en Mybb Mybb Forums v.1.8.33 permite a un atacante local ejecutar código arbitrario a través del parámetro Nombre del tema en el componente de administración de temas. • https://github.com/Or4ngm4n/Mybb/blob/main/MyBB%201.8.33%20Cross%20Site%20Scripting.txt https://github.com/mybb/mybb/security/advisories/GHSA-4xqm-3cm2-5xgf https://raw.githubusercontent.com/Or4ngm4n/Mybb/main/Screenshot%202023-10-08%20012112.png • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-22612
https://notcve.org/view.php?id=CVE-2020-22612
Installer RCE on settings file write in MyBB before 1.8.22. Instalador RCE en el archivo de configuración de escritura en MyBB antes de 1.8.22. • https://mybb.com/versions/1.8.22 • CWE-94: Improper Control of Generation of Code ('Code Injection') •