CVSS: 5.0EPSS: 2%CPEs: 37EXPL: 0CVE-2010-4628
https://notcve.org/view.php?id=CVE-2010-4628
member.php in MyBB (aka MyBulletinBoard) before 1.4.12 makes a certain superfluous call to the SQL COUNT function, which allows remote attackers to cause a denial of service (resource consumption) by making requests to member.php that trigger scans of the entire users table. member.php de MyBB (MyBulletinBoard) en versiones anteriores a la 1.4.12 hace una llamada superflua a la función SQL COUNT; lo que permite, a atacantes remotos, provocar una denegación de servició (consumo de todos los recursos) haciendo peticiones a member.php que generan la lectura de toda la tabla de usuarios. • http://blog.mybb.com/2010/04/13/mybb-1-4-12-released-security-maintenance-update http://dev.mybboard.net/issues/662 http://openwall.com/lists/oss-security/2010/10/08/7 http://openwall.com/lists/oss-security/2010/10/11/8 http://openwall.com/lists/oss-security/2010/12/06/2 https://exchange.xforce.ibmcloud.com/vulnerabilities/64514 •
CVSS: 5.0EPSS: 2%CPEs: 37EXPL: 0CVE-2010-4629
https://notcve.org/view.php?id=CVE-2010-4629
MyBB (aka MyBulletinBoard) before 1.4.12 does not properly restrict uid values for group join requests, which allows remote attackers to cause a denial of service (resource consumption) by using guest access to submit join request forms for moderated groups, related to usercp.php and managegroup.php. MyBB (MyBulletinBoard) en versiones anteriores a la 1.4.12 no restringe apropiadamente los valores uid para peticiones de unión de grupo; lo que permite, a atacantes remotos, provocar una denegación de servicio (consumo de todos los recursos) usando un acceso de invitado para enviar formularios de peticiones de unión para grupos moderados. Vulnerabilidad relacionada con usercp.php y managegroup.php. • http://blog.mybb.com/2010/04/13/mybb-1-4-12-released-security-maintenance-update http://dev.mybboard.net/issues/722 http://dev.mybboard.net/projects/mybb/repository/revisions/4856 http://openwall.com/lists/oss-security/2010/10/08/7 http://openwall.com/lists/oss-security/2010/10/11/8 http://openwall.com/lists/oss-security/2010/12/06/2 https://exchange.xforce.ibmcloud.com/vulnerabilities/64513 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 3.5EPSS: 0%CPEs: 37EXPL: 0CVE-2010-4624
https://notcve.org/view.php?id=CVE-2010-4624
MyBB (aka MyBulletinBoard) before 1.4.12 allows remote authenticated users to bypass intended restrictions on the number of [img] MyCodes by editing a post after it has been created. MyBB (MyBulletinBoard) en versiones anteriores a la 1.4.12 permite a usuarios autenticados remotos evitar las restricciones previstas en el número de [img] MyCodes editando un post después de que haya sido creado. • http://blog.mybb.com/2010/04/13/mybb-1-4-12-released-security-maintenance-update http://dev.mybboard.net/issues/728 http://openwall.com/lists/oss-security/2010/10/08/7 http://openwall.com/lists/oss-security/2010/10/11/8 http://openwall.com/lists/oss-security/2010/12/06/2 https://exchange.xforce.ibmcloud.com/vulnerabilities/64518 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2008-4930
https://notcve.org/view.php?id=CVE-2008-4930
MyBB (aka MyBulletinBoard) 1.4.2 does not properly handle an uploaded file with a nonstandard file type that contains HTML sequences, which allows remote attackers to cause that file to be processed as HTML by Internet Explorer's content inspection, aka "Incomplete protection against MIME-sniffing." NOTE: this could be leveraged for XSS and other attacks. MyBB (también conocido como MyBulletinBoard) v1.4.2 no maneja de forma adecuada un fichero que se haya subido y que sea de un tipo no estándar que contenga secuencias HTML; esto permite a atacantes remotos provocar que el fichero sea procesado como un HTML por las inspecciones de contenidos de Internet Explorer. También se conoce como "Protección incompleta contra MIME-sniffing". NOTA: Esto podría ser utilizado para XSS y otro tipo de ataques. • http://archives.neohapsis.com/archives/bugtraq/2008-10/0203.html http://archives.neohapsis.com/archives/fulldisclosure/2008-10/0472.html http://www.openwall.com/lists/oss-security/2008/11/01/2 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 3CVE-2008-4929
https://notcve.org/view.php?id=CVE-2008-4929
MyBB (aka MyBulletinBoard) 1.4.2 uses insufficient randomness to compose filenames of uploaded files used as attachments, which makes it easier for remote attackers to read these files by guessing filenames. MyBB (también conocido como MyBulletinBoard) v1.4.2 no emplea suficiente aleatoriedad para componer los nombres de los ficheros que se hayan subido como adjuntos; esto facilita a los atacantes remotos leer estos ficheros deduciendo su nombre. • http://archives.neohapsis.com/archives/bugtraq/2008-10/0203.html http://archives.neohapsis.com/archives/fulldisclosure/2008-10/0472.html http://www.openwall.com/lists/oss-security/2008/11/01/2 http://www.securityfocus.com/bid/31936 http://www.vupen.com/english/advisories/2008/2967 • CWE-330: Use of Insufficiently Random Values •