CVSS: 7.5EPSS: 1%CPEs: 37EXPL: 0CVE-2010-4629
https://notcve.org/view.php?id=CVE-2010-4629
30 Dec 2010 — MyBB (aka MyBulletinBoard) before 1.4.12 does not properly restrict uid values for group join requests, which allows remote attackers to cause a denial of service (resource consumption) by using guest access to submit join request forms for moderated groups, related to usercp.php and managegroup.php. MyBB (MyBulletinBoard) en versiones anteriores a la 1.4.12 no restringe apropiadamente los valores uid para peticiones de unión de grupo; lo que permite, a atacantes remotos, provocar una denegación de servicio... • http://blog.mybb.com/2010/04/13/mybb-1-4-12-released-security-maintenance-update • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.1EPSS: 1%CPEs: 1EXPL: 3CVE-2009-4813 – MyBB 1.4.10 - 'myps.php' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2009-4813
27 Apr 2010 — Cross-site scripting (XSS) vulnerability in myps.php in MyBB (aka MyBulletinBoard) 1.4.10 allows remote attackers to inject arbitrary web script or HTML via the username parameter in a donate action. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en myps.php en MyBB (también conocido como MyBulletinBoard) 1.4.10 permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través del parámetro "username" en una acción "donate". • https://www.exploit-db.com/exploits/33439 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 0CVE-2009-4448
https://notcve.org/view.php?id=CVE-2009-4448
29 Dec 2009 — inc/functions_time.php in MyBB (aka MyBulletinBoard) 1.4.10, and possibly earlier versions, allows remote attackers to cause a denial of service (CPU consumption) via a crafted request with a large year value, which triggers a long loop, as reachable through member.php and possibly other vectors. inc/functions_time.php en MyBB (alias MyBulletinBoard) v1.4.10, y posiblemente versiones anteriores, permite a atacantes remotos provocar una denegación de servicio (consumo de CPU) mediante una solicitud elaborada... • http://blog.mybboard.net/2009/12/29/mybb-1-4-11-released-minor-patch-security-update • CWE-399: Resource Management Errors •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 2CVE-2009-4449
https://notcve.org/view.php?id=CVE-2009-4449
29 Dec 2009 — Directory traversal vulnerability in MyBB (aka MyBulletinBoard) 1.4.10, and possibly earlier versions, when changing the user avatar from the gallery, allows remote authenticated users to determine the existence of files via directory traversal sequences in the avatar and possibly the gallery parameters, related to (1) admin/modules/user/users.php and (2) usercp.php. Vulnerabilidad de salto de directorio en MyBB (MyBulletinBoard) v1.4.10, y posiblemente versiones anteriores. Cuando se cambia el avatar de us... • http://blog.mybboard.net/2009/12/29/mybb-1-4-11-released-minor-patch-security-update • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2008-7082
https://notcve.org/view.php?id=CVE-2008-7082
25 Aug 2009 — MyBB (aka MyBulletinBoard) 1.4.3 includes the sensitive my_post_key parameter in URLs to moderation.php with the (1) mergeposts, (2) split, and (3) deleteposts actions, which allows remote attackers to steal the token and bypass the cross-site request forgery (CSRF) protection mechanism to hijack the authentication of moderators by reading the token from the HTTP Referer header. MyBB (también conocido como MyBulletinBoard) v1.4.3 incluye el parámetro "my_post_key" en URLs en moderation.php con las acciones ... • http://osvdb.org/50275 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2008-4928
https://notcve.org/view.php?id=CVE-2008-4928
04 Nov 2008 — Cross-site scripting (XSS) vulnerability in the redirect function in functions.php in MyBB (aka MyBulletinBoard) 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the url parameter in a removesubscriptions action to moderation.php, related to use of the ajax option to request a JavaScript redirect. NOTE: this can be leveraged to execute PHP code and bypass cross-site request forgery (CSRF) protection. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la función "red... • http://archives.neohapsis.com/archives/bugtraq/2008-10/0203.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 3CVE-2008-4929
https://notcve.org/view.php?id=CVE-2008-4929
04 Nov 2008 — MyBB (aka MyBulletinBoard) 1.4.2 uses insufficient randomness to compose filenames of uploaded files used as attachments, which makes it easier for remote attackers to read these files by guessing filenames. MyBB (también conocido como MyBulletinBoard) v1.4.2 no emplea suficiente aleatoriedad para componer los nombres de los ficheros que se hayan subido como adjuntos; esto facilita a los atacantes remotos leer estos ficheros deduciendo su nombre. • http://archives.neohapsis.com/archives/bugtraq/2008-10/0203.html • CWE-330: Use of Insufficiently Random Values •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2008-4930
https://notcve.org/view.php?id=CVE-2008-4930
04 Nov 2008 — MyBB (aka MyBulletinBoard) 1.4.2 does not properly handle an uploaded file with a nonstandard file type that contains HTML sequences, which allows remote attackers to cause that file to be processed as HTML by Internet Explorer's content inspection, aka "Incomplete protection against MIME-sniffing." NOTE: this could be leveraged for XSS and other attacks. MyBB (también conocido como MyBulletinBoard) v1.4.2 no maneja de forma adecuada un fichero que se haya subido y que sea de un tipo no estándar que conteng... • http://archives.neohapsis.com/archives/bugtraq/2008-10/0203.html • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 30EXPL: 0CVE-2008-3965
https://notcve.org/view.php?id=CVE-2008-3965
10 Sep 2008 — SQL injection vulnerability in misc.php in MyBB (aka MyBulletinBoard) before 1.4.1 allows remote attackers to execute arbitrary SQL commands via a certain editor field. Vulnerabilidad de inyección SQL en misc.php de MyBB (también conocido como MyBulletinBoard) anterior a 1.4.1 permite a atacantes remotos ejecutar comandos SQL de su elección mediante cierto editor de campos. • http://community.mybboard.net/attachment.php?aid=10579 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 30EXPL: 1CVE-2008-3966
https://notcve.org/view.php?id=CVE-2008-3966
10 Sep 2008 — Multiple cross-site scripting (XSS) vulnerabilities in MyBB (aka MyBulletinBoard) before 1.4.1 allow remote attackers to inject arbitrary web script or HTML via (1) a certain referrer field in usercp2.php, (2) a certain location field in inc/functions_online.php, and certain (3) tsubject and (4) psubject fields in moderation.php. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en MyBB (alias MyBulletinBoard) en versiones anteriores a 1.4.1 que permite a los atacantes remotos inyectar una s... • http://community.mybboard.net/attachment.php?aid=10579 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •