CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1000503
https://notcve.org/view.php?id=CVE-2018-1000503
26 Jun 2018 — MyBB Group MyBB contains a Incorrect Access Control vulnerability in Private forums that can result in Users can view posts from private forums without having the password. This attack appear to be exploitable via Subscribe to a forum through IDOR. This vulnerability appears to have been fixed in 1.8.15. MyBB Group MyBB contiene una vulnerabilidad de control de acceso incorrecto en los foros privados que puede resultar en que los usuarios puedan ver foros privados sin tener la contraseña. Este ataque parece... • http://www.batterystapl.es/2018/03/local-file-inclusion-and-reading.html • CWE-269: Improper Privilege Management •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-10678
https://notcve.org/view.php?id=CVE-2018-10678
13 May 2018 — MyBB 1.8.15, when accessed with Microsoft Edge, mishandles 'target="_blank" rel="noopener"' in A elements, which makes it easier for remote attackers to conduct redirection attacks. MyBB 1.8.15, cuando se accede a él mediante Microsoft Edge, gestiona de manera incorrecta 'target="_blank" rel="noopener"' en elementos A, lo que facilita que atacantes remotos lleven a cabo ataques de redirección. • https://github.com/hbranco/CVE-2018-10678 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 1CVE-2018-7305
https://notcve.org/view.php?id=CVE-2018-7305
21 Feb 2018 — MyBB 1.8.14 is not checking for a valid CSRF token, leading to arbitrary deletion of user accounts. MyBB 1.8.14 no comprueba un token CSRF válido, lo que conduce al borrado arbitrario de cuentas de usuario. • https://websecnerd.blogspot.in/2018/02/mybb-forum-1_21.html • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2018-6844
https://notcve.org/view.php?id=CVE-2018-6844
08 Feb 2018 — MyBB 1.8.14 has XSS via the Title or Description field on the Edit Forum screen. MyBB 1.8.14 tiene XSS mediante los campos Title o Description en la pantalla Edit Forum. • https://websecnerd.blogspot.com/2018/02/mybb-forum-1.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 1CVE-2017-16780 – MyBB 1.8.13 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2017-16780
10 Nov 2017 — The installer in MyBB before 1.8.13 allows remote attackers to execute arbitrary code by writing to the configuration file. El instalador en MyBB en versiones anteriores a la 1.8.13 permite que atacantes remotos ejecuten código arbitrario escribiendo en el archivo de configuración. • https://www.exploit-db.com/exploits/43136 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2017-16781 – MyBB 1.8.13 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2017-16781
10 Nov 2017 — The installer in MyBB before 1.8.13 has XSS. El instalador en MyBB en versiones anteriores a la 1.8.13 tiene Cross-Site Scripting (XSS). • https://www.exploit-db.com/exploits/43137 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-8103
https://notcve.org/view.php?id=CVE-2017-8103
24 Apr 2017 — In MyBB before 1.8.11, the Email MyCode component allows XSS, as demonstrated by an onmouseover event. En MyBB en versiones anteriores a 1.8.11, el componente Email MyCode permite XSS, como lo demuestra un evento onmouseover. • http://seclists.org/fulldisclosure/2017/Apr/53 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 1%CPEs: 1EXPL: 1CVE-2017-8104
https://notcve.org/view.php?id=CVE-2017-8104
24 Apr 2017 — In MyBB before 1.8.11, the smilie module allows Directory Traversal via the pathfolder parameter. En MyBB en versiones anteriores a 1.8.11, el módulo smilie permite Salto de Directorio a través del parámetro pathfolder. • http://seclists.org/fulldisclosure/2017/Apr/55 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.7EPSS: 0%CPEs: 1EXPL: 2CVE-2017-7566 – MyBB 1.8.10 Server-Side Request Forgery
https://notcve.org/view.php?id=CVE-2017-7566
06 Apr 2017 — MyBB before 1.8.11 allows remote attackers to bypass an SSRF protection mechanism. MyBB en versiones anteriores a 1.8.11 permite a atacantes remotos evitar un mecanismo de protección SSRF. MyBB version 1.8.10 suffers from a server-side request forgery vulnerability. • https://packetstorm.news/files/id/142051 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 8.3EPSS: 0%CPEs: 8EXPL: 0CVE-2015-8973
https://notcve.org/view.php?id=CVE-2015-8973
31 Jan 2017 — xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to bypass intended access restrictions via vectors related to the forum password. xmlhttp.php en MyBB (también conocido como MyBulletinBoard) en versiones anteriores a 1.6.18 y 1.8.x en versiones anteriores a 1.8.6 y MyBB Merge System en versiones anteriores a 1.8.6 permite a atacantes remotos eludir las restricciones de acceso previstas a través de vectores relacionados ... • http://www.openwall.com/lists/oss-security/2016/11/10/8 • CWE-284: Improper Access Control •