CVSS: 9.8EPSS: 0%CPEs: 30EXPL: 0CVE-2008-3967
https://notcve.org/view.php?id=CVE-2008-3967
10 Sep 2008 — moderation.php in MyBB (aka MyBulletinBoard) before 1.4.1 does not properly check for moderator privileges, which has unknown impact and remote attack vectors. moderation.php en MyBB (también conocido como MyBulletinBoard) versiones anteriores a 1.4.1 no comprueba adecuadamente los privilegios del moderados, lo cual tiene un impacto y vectores de ataque desconocidos. • http://community.mybboard.net/attachment.php?aid=10579 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.1EPSS: 0%CPEs: 28EXPL: 0CVE-2008-3334
https://notcve.org/view.php?id=CVE-2008-3334
27 Jul 2008 — Cross-site scripting (XSS) vulnerability in MyBB 1.2.x before 1.2.14 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly involving search.php. Una vulnerabilidad de tipo cross-site scripting (XSS) en MyBB versiones 1.2.x anteriores a 1.2.14, permite a los atacantes remotos inyectar script web o HTML arbitrario por medio de vectores no especificados, posiblemente involucrando el archivo search.php. • http://community.mybboard.net/thread-33865.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2008-3070
https://notcve.org/view.php?id=CVE-2008-3070
08 Jul 2008 — Unspecified vulnerability in inc/datahandler/user.php in MyBB before 1.2.13 has unknown impact and attack vectors related to the $user['language'] variable, probably related to SQL injection. Vulnerabilidad sin especificar en inc/datahandler/user.php en MyBB anterior a 1.2.13, tiene un impacto y vectores de ataque desconocidos en relación con la variable $user['language'], probablemente relacionado con la inyección SQL. • http://community.mybboard.net/attachment.php?aid=9272 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2008-3069
https://notcve.org/view.php?id=CVE-2008-3069
08 Jul 2008 — Multiple cross-site scripting (XSS) vulnerabilities in MyBB before 1.2.13 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters to (1) portal.php and (2) inc/functions_post.php. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en MyBB anterior a 1.2.13, permite a atacantes remotos inyectar secuencias de comandos Web o HTML mediante parámetros no especificados en (1) portal.php y (2) inc/functions_post.php. • http://community.mybboard.net/attachment.php?aid=9272 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2008-3071
https://notcve.org/view.php?id=CVE-2008-3071
08 Jul 2008 — Directory traversal vulnerability in inc/class_language.php in MyBB before 1.2.13 has unknown impact and attack vectors related to the $language variable. Vulnerabilidad de salto de directorio en inc/class_language.php de MyBB anterior a 1.2.13, tiene un impacto y vectores de ataque desconocidos relacionados con la variable $language. • http://community.mybboard.net/attachment.php?aid=9272 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 1CVE-2008-0788
https://notcve.org/view.php?id=CVE-2008-0788
15 Feb 2008 — Multiple cross-site request forgery (CSRF) vulnerabilities in MyBB 1.2.11 and earlier allow remote attackers to (1) hijack the authentication of moderators or administrators for requests that delete threads via a do_multideletethreads action to moderation.php and (2) hijack the authentication of arbitrary users for requests that delete private messages (PM) via a delete action to private.php. Múltiples vulnerabilidades de tipo cross-site request forgery (CSRF) en MyBB versión 1.2.11 y anteriores, permiten a... • http://community.mybboard.net/showthread.php?tid=27675 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 3CVE-2008-0383 – MyBB 1.2.10 - 'moderation.php' Multiple SQL Injections
https://notcve.org/view.php?id=CVE-2008-0383
22 Jan 2008 — Multiple SQL injection vulnerabilities in MyBB 1.2.10 and earlier allow remote moderators and administrators to execute arbitrary SQL commands via (1) the mergepost parameter in a do_mergeposts action, (2) rid parameter in an allreports action, or (3) threads parameter in a do_multimovethreads action to (a) moderation.php; or (4) gid parameter to (b) admin/usergroups.php. Múltiples vulnerabilidades de inyección SQL en MyBB 1.2.10 y anteriores permite a moderadores remotos y administradores ejecutar comnando... • https://www.exploit-db.com/exploits/31034 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 2CVE-2007-0689
https://notcve.org/view.php?id=CVE-2007-0689
14 May 2007 — MyBB 1.2.4 allows remote attackers to obtain sensitive information via the (1) action[] parameter to member.php, (2) imagehash[] parameter to captcha.php, and (3) a direct request to inc/datahandlers/event.php, which reveal the installation path in the resulting error message. MyBB 1.2.4 permite a atacantes remotos obtener información sensible a través del parámetro (1) action[] en member.php, el parámetro (2)imagehash[] en captcha.php, and (3) una respuesta directa en inc/datahandlers/event.php, el cual re... • http://marc.info/?l=full-disclosure&m=117909973216181&w=2 •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2007-2212 – MyBulletinBoard (MyBB) 1.2.5 - 'calendar.php' Blind SQL Injection
https://notcve.org/view.php?id=CVE-2007-2212
24 Apr 2007 — Multiple SQL injection vulnerabilities in calendar.php in MyBB (aka MyBulletinBoard) 1.2.5 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) year or (2) month parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. Múltiples vulnerabilidades de inyección SQL en calendar.php en MyBB (también conocido como MyBulletinBoard) 1.2.5 y anteriores permite a atacantes remotos ejecutar comandos SQL de su elección a tr... • https://www.exploit-db.com/exploits/3780 •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 1CVE-2007-1963 – MyBulletinBoard (MyBB) 1.2.3 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2007-1963
11 Apr 2007 — SQL injection vulnerability in the create_session function in class_session.php in MyBB (aka MyBulletinBoard) 1.2.3 and earlier allows remote attackers to execute arbitrary SQL commands via the Client-IP HTTP header, as utilized by index.php, a related issue to CVE-2006-3775. Vulnerabilidad de inyección SQL en la función create_session en class_session.php de MyBB (también conocido como MyBulletinBoard) 1.2.3 y anteriores permite a atacantes remotos ejecutar comandos sql de su elección mediante la cabecera ... • https://www.exploit-db.com/exploits/3653 •