Page 5 of 128 results (0.003 seconds)

CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0

CVE-2018-6844

https://notcve.org/view.php?id=CVE-2018-6844

08 Feb 2018 — MyBB 1.8.14 has XSS via the Title or Description field on the Edit Forum screen. MyBB 1.8.14 tiene XSS mediante los campos Title o Description en la pantalla Edit Forum. • https://websecnerd.blogspot.com/2018/02/mybb-forum-1.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1

CVE-2017-16781 – MyBB 1.8.13 - Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2017-16781

10 Nov 2017 — The installer in MyBB before 1.8.13 has XSS. El instalador en MyBB en versiones anteriores a la 1.8.13 tiene Cross-Site Scripting (XSS). • https://www.exploit-db.com/exploits/43137 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 1

CVE-2017-16780 – MyBB 1.8.13 - Remote Code Execution

https://notcve.org/view.php?id=CVE-2017-16780

10 Nov 2017 — The installer in MyBB before 1.8.13 allows remote attackers to execute arbitrary code by writing to the configuration file. El instalador en MyBB en versiones anteriores a la 1.8.13 permite que atacantes remotos ejecuten código arbitrario escribiendo en el archivo de configuración. • https://www.exploit-db.com/exploits/43136 • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 5.3EPSS: 1%CPEs: 1EXPL: 1

CVE-2017-8104

https://notcve.org/view.php?id=CVE-2017-8104

24 Apr 2017 — In MyBB before 1.8.11, the smilie module allows Directory Traversal via the pathfolder parameter. En MyBB en versiones anteriores a 1.8.11, el módulo smilie permite Salto de Directorio a través del parámetro pathfolder. • http://seclists.org/fulldisclosure/2017/Apr/55 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0

CVE-2017-8103

https://notcve.org/view.php?id=CVE-2017-8103

24 Apr 2017 — In MyBB before 1.8.11, the Email MyCode component allows XSS, as demonstrated by an onmouseover event. En MyBB en versiones anteriores a 1.8.11, el componente Email MyCode permite XSS, como lo demuestra un evento onmouseover. • http://seclists.org/fulldisclosure/2017/Apr/53 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 7.7EPSS: 0%CPEs: 1EXPL: 2

CVE-2017-7566 – MyBB 1.8.10 Server-Side Request Forgery

https://notcve.org/view.php?id=CVE-2017-7566

06 Apr 2017 — MyBB before 1.8.11 allows remote attackers to bypass an SSRF protection mechanism. MyBB en versiones anteriores a 1.8.11 permite a atacantes remotos evitar un mecanismo de protección SSRF. MyBB version 1.8.10 suffers from a server-side request forgery vulnerability. • https://packetstorm.news/files/id/142051 • CWE-918: Server-Side Request Forgery (SSRF) •

CVSS: 7.4EPSS: 0%CPEs: 2EXPL: 0

CVE-2016-9417

https://notcve.org/view.php?id=CVE-2016-9417

31 Jan 2017 — The fetch_remote_file function in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors. La función fetch_remote_file en MyBB (también conocida como MyBulletinBoard) en versiones anteriores a 1.8.8 y MyBB Merge System en versiones anteriores a 1.8.8 permite a atacantes remotos llevar a cabo ataques de falsificación de solicitud del lado del servidor (SSRF) a través de vectores no especi... • http://www.openwall.com/lists/oss-security/2016/11/10/8 • CWE-918: Server-Side Request Forgery (SSRF) •

CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0

CVE-2016-9405

https://notcve.org/view.php?id=CVE-2016-9405

31 Jan 2017 — Cross-site scripting (XSS) vulnerability in member validation in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de XSS en la validación de miembros en MyBB (también conocido como MyBulletinBoard) en versiones anteriores a 1.8.7 y MyBB Merge System en versiones anteriores a 1.8.7 podrían permitir a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a tr... • http://www.openwall.com/lists/oss-security/2016/11/10/8 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0

CVE-2016-9409

https://notcve.org/view.php?id=CVE-2016-9409

31 Jan 2017 — Cross-site scripting (XSS) vulnerability in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors involving pruning logs. Vulnerabilidad de XSS en el panel de control de Admin en MyBB (aka MyBulletinBoard) en versiones anteriores a 1.8.7 y MyBB Merge System en versiones anteriores a 1.8.7 podrían permitir a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a ... • http://www.openwall.com/lists/oss-security/2016/11/10/8 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0

CVE-2016-9411

https://notcve.org/view.php?id=CVE-2016-9411

31 Jan 2017 — The Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to obtain the installation path via vectors involving sending mails. El panel de control Admin en MyBB (también conocido como MyBulletinBoard) en versiones anteriores a 1.8.7 y MyBB Merge System en versiones anteriores a 1.8.7 permite a los atacantes remotos obtener la ruta de instalación a través de vectores que implican el envío de correos. • http://www.openwall.com/lists/oss-security/2016/11/10/8 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •