Page 8 of 120 results (0.002 seconds)

CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0

CVE-2015-2335

https://notcve.org/view.php?id=CVE-2015-2335

18 Mar 2015 — A JSON library in MyBB (aka MyBulletinBoard) before 1.8.4 allows remote attackers to obtain the installation path via unknown vectors. Una libraría JSON en MyBB (también conocido como MyBulletinBoard) anterior a 1.8.4 permite a atacantes remotos obtener la ruta de instalación a través de vectores desconocidos. • http://blog.mybb.com/2015/02/15/mybb-1-8-4-released-feature-update-security-maintenance-release • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 9.8EPSS: 1%CPEs: 2EXPL: 2

CVE-2014-9240 – MyBB 1.8.x - Multiple Vulnerabilities

https://notcve.org/view.php?id=CVE-2014-9240

03 Dec 2014 — SQL injection vulnerability in member.php in MyBB (aka MyBulletinBoard) 1.8.x before 1.8.2 allows remote attackers to execute arbitrary SQL commands via the question_id parameter in a do_register action. Vulnerabilidad de inyección SQL en member.php en MyBB (también conocido como MyBulletinBoard) 1.8.x anterior a 1.8.2 permite a atacantes remotos ejecutar comandos SQL arbitrarios a través del parámetro question_id en una acción do_register. • https://www.exploit-db.com/exploits/35224 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 6.1EPSS: 1%CPEs: 2EXPL: 2

CVE-2014-9241 – MyBB 1.8.x - Multiple Vulnerabilities

https://notcve.org/view.php?id=CVE-2014-9241

03 Dec 2014 — Multiple cross-site scripting (XSS) vulnerabilities in MyBB (aka MyBulletinBoard) 1.8.x before 1.8.2 allow remote attackers to inject arbitrary web script or HTML via the (1) type parameter to report.php, (2) signature parameter in a do_editsig action to usercp.php, or (3) title parameter in the style-templates module in an edit_template action or (4) file parameter in the config-languages module in an edit action to admin/index.php. Múltiples vulnerabilidades de XSS en MyBB (también conocido como MyBulleti... • https://www.exploit-db.com/exploits/35224 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 15EXPL: 0

CVE-2014-5248

https://notcve.org/view.php?id=CVE-2014-5248

14 Aug 2014 — Cross-site scripting (XSS) vulnerability in MyBB before 1.6.15 allows remote attackers to inject arbitrary web script or HTML via vectors related to video MyCode. Vulnerabilidad de XSS en MyBB anterior a 1.6.15 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a traves de vectores relacionados con video MyCode. • http://blog.mybb.com/2014/08/04/mybb-1-6-15-released-security-maintenance-release • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 13EXPL: 3

CVE-2014-1840 – MyBB 1.6.12 POST Cross Site Scripting

https://notcve.org/view.php?id=CVE-2014-1840

03 Feb 2014 — Cross-site scripting (XSS) vulnerability in Upload/search.php in MyBB 1.6.12 and earlier allows remote attackers to inject arbitrary web script or HTML via the keywords parameter in a do_search action, which is not properly handled in a forced SQL error message. Vulnerabilidad de XSS en Upload/search.php en MyBB 1.6.12 y anteriores permite a atacantes remotos inyectar script Web o HTML arbitrarios a través del parámetro keywords en una acción do_search, que no es manejado debidamente en un mensaje de error ... • https://packetstorm.news/files/id/125038 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 69EXPL: 0

CVE-2013-7288

https://notcve.org/view.php?id=CVE-2013-7288

10 Jan 2014 — Cross-site scripting (XSS) vulnerability in the mycode_parse_video function in inc/class_parser.php in MyBB (aka MyBulletinBoard) before 1.6.12 allows remote attackers to inject arbitrary web script or HTML via vectors related to Yahoo video URLs. Vulnerabilidad cross-site scripting (XSS) en la función mycode_parse_video de inc/class_parser.php de MyBB (MyBulletinBoard) anteriores a 1.6.12 permite a atacantes remotos inyectar script web o HTML de forma arbitraria a través de vectores relacionados con URLs d... • http://blog.mybb.com/2013/12/16/mybb-1-6-12-released-security-maintenance-release • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 69EXPL: 1

CVE-2013-7275

https://notcve.org/view.php?id=CVE-2013-7275

08 Jan 2014 — Cross-site scripting (XSS) vulnerability in misc.php in MyBB (aka MyBulletinBoard) before 1.6.12 allows remote attackers to inject arbitrary web script or HTML via the editor parameter in a smilie list popup. Vulnerabilidad cross-site scripting (XSS) en misc.php de MyBB (tambien conocido como MyBulletinBoard) anteriores a 1.6.12 permite a atacantes remotos inyectar script web o HTML de forma arbitraria a través del parámetro editor en un listado de smileis. • http://blog.mybb.com/2013/12/16/mybb-1-6-12-released-security-maintenance-release • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 3%CPEs: 1EXPL: 2

CVE-2012-5908 – MyBB 1.6.6 - 'index.php?conditions[usergroup][]' Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2012-5908

17 Nov 2012 — Cross-site scripting (XSS) vulnerability in admin/modules/user/users.php in MyBB (aka MyBulletinBoard) 1.6.6 allows remote attackers to inject arbitrary web script or HTML via the conditions[usergroup][] parameter in a search action to admin/index.php. Una vulnerabilidad de ejecución de comandos en sitios cruzados (XSS) en admin/modules/user/users.php en MyBB (alias MyBulletinBoard) v1.6.6 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro conditions[usergroup][] e... • https://www.exploit-db.com/exploits/37019 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 3

CVE-2012-5909 – MyBB 1.6.6 - 'index.php?conditions[usergroup][]' SQL Injection

https://notcve.org/view.php?id=CVE-2012-5909

17 Nov 2012 — SQL injection vulnerability in admin/modules/user/users.php in MyBB (aka MyBulletinBoard) 1.6.6 allows remote attackers to execute arbitrary SQL commands via the conditions[usergroup][] parameter in a search action to admin/index.php. Una vulnerabilidad de inyección SQL en admin/modules/user/users.php en MyBB (alias MyBulletinBoard) v1.6.6 permite a atacantes remotos ejecutar comandos SQL a través del parámetro conditions[usergroup][] en una acción de búsqueda a admin/index.php. • https://www.exploit-db.com/exploits/37018 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 8.8EPSS: 0%CPEs: 50EXPL: 0

CVE-2011-5131

https://notcve.org/view.php?id=CVE-2011-5131

30 Aug 2012 — Cross-site request forgery (CSRF) vulnerability in global.php in MyBB before 1.6.5 allows remote attackers to hijack the authentication of a user for requests that change the user's language via the language parameter. Vulnerabilidad de solicitudes falsificadas en sitios cruzados (CSRF) en global.php en MyBB anterior a v1.6.5 permite a atacantes remotos secuestrar la autenticación de un usuario para solicitar un cambio de lenguaje del usuario a través del parámetro de lenguaje. • http://blog.mybb.com/2011/11/25/mybb-1-6-5-released-feature-update-security-maintenance-release • CWE-352: Cross-Site Request Forgery (CSRF) •