Vulnerabilites related to mybb - merge_system
Vulnerability from fkie_nvd
Published
2017-01-31 22:59
Modified
2024-11-21 03:01
Severity ?
6.5 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Summary
The Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to conduct clickjacking attacks via unspecified vectors.
References
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/10/8Mailing List, Patch, Third Party Advisory
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Patch, Third Party Advisory
cve@mitre.orghttp://www.securityfocus.com/bid/94395Third Party Advisory, VDB Entry
cve@mitre.orghttps://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/Patch, Third Party Advisory, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/10/8Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/94395Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/Patch, Third Party Advisory, Vendor Advisory
Impacted products
Vendor Product Version
mybb merge_system *
mybb mybb *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:mybb:merge_system:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "716986AC-5E6D-4DDD-A553-B88981BDE788",
                     versionEndIncluding: "1.8.6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "2212E819-C064-4963-BCD2-214F09A46902",
                     versionEndIncluding: "1.8.6",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "The Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to conduct clickjacking attacks via unspecified vectors.",
      },
      {
         lang: "es",
         value: "El panel de control Admin en MyBB (también conocido como MyBulletinBoard) en versiones anteriores a 1.8.7 y MyBB Merge System en versiones anteriores a 1.8.7 permite a los atacantes remotos realizar ataques de secuestro de clic a través de vectores no especificados.",
      },
   ],
   id: "CVE-2016-9413",
   lastModified: "2024-11-21T03:01:08.927",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               confidentialityImpact: "NONE",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: true,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 6.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "NONE",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
               version: "3.0",
            },
            exploitabilityScore: 2.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2017-01-31T22:59:01.453",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94395",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Patch",
            "Third Party Advisory",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94395",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Third Party Advisory",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-284",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2017-01-31 22:59
Modified
2024-11-21 03:01
Severity ?
7.5 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows might allow remote attackers to obtain sensitive information from ACP backups via vectors involving a short name.
References
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/10/8Mailing List, Patch, Third Party Advisory
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Patch, Third Party Advisory
cve@mitre.orghttp://www.securityfocus.com/bid/94396Third Party Advisory, VDB Entry
cve@mitre.orghttps://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/Patch, Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/10/8Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/94396Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/Patch, Release Notes, Vendor Advisory
Impacted products
Vendor Product Version
mybb merge_system *
mybb mybb *
microsoft windows *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:mybb:merge_system:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FC4E25F3-7C9D-45E3-8330-961A56BC3C48",
                     versionEndIncluding: "1.8.7",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "78D16782-41C7-4001-8DD1-C7A09B347733",
                     versionEndIncluding: "1.8.7",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "2CF61F35-5905-4BA9-AD7E-7DB261D2F256",
                     vulnerable: false,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
         operator: "AND",
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows might allow remote attackers to obtain sensitive information from ACP backups via vectors involving a short name.",
      },
      {
         lang: "es",
         value: "MyBB (también conocido como MyBulletinBoard) en versiones anteriores a 1.8.8 en Windows y MyBB Merge System en versiones anteriores a 1.8.8 en Windows podrían permitir a atacantes remotos obtener información sensible de las copias de seguridad de ACP a través de vectores que implican un nombre corto.",
      },
   ],
   id: "CVE-2016-9418",
   lastModified: "2024-11-21T03:01:09.650",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 5,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:N",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 7.5,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 3.9,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2017-01-31T22:59:01.640",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94396",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Patch",
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94396",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-200",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2017-01-31 22:59
Modified
2024-11-21 03:01
Severity ?
6.1 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
Cross-site scripting (XSS) vulnerability in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors involving pruning logs.
References
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/10/8Mailing List, Patch, Third Party Advisory
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Patch, Third Party Advisory
cve@mitre.orghttp://www.securityfocus.com/bid/94395Third Party Advisory, VDB Entry
cve@mitre.orghttps://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/Patch, Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/10/8Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/94395Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/Patch, Release Notes, Vendor Advisory
Impacted products
Vendor Product Version
mybb merge_system *
mybb mybb *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:mybb:merge_system:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "716986AC-5E6D-4DDD-A553-B88981BDE788",
                     versionEndIncluding: "1.8.6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "2212E819-C064-4963-BCD2-214F09A46902",
                     versionEndIncluding: "1.8.6",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "Cross-site scripting (XSS) vulnerability in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors involving pruning logs.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de XSS en el panel de control de Admin en MyBB (aka MyBulletinBoard) en versiones anteriores a 1.8.7 y MyBB Merge System en versiones anteriores a 1.8.7 podrían permitir a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de vectores que implican registros de poda.",
      },
   ],
   id: "CVE-2016-9409",
   lastModified: "2024-11-21T03:01:08.303",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               confidentialityImpact: "NONE",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: true,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 6.1,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "LOW",
               integrityImpact: "LOW",
               privilegesRequired: "NONE",
               scope: "CHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
               version: "3.0",
            },
            exploitabilityScore: 2.8,
            impactScore: 2.7,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2017-01-31T22:59:01.297",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94395",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Patch",
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94395",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-79",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2017-01-31 22:59
Modified
2024-11-21 03:01
Severity ?
6.1 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
Cross-site scripting (XSS) vulnerability in the Mod control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors involving editing users.
References
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/10/8Mailing List, Patch, Third Party Advisory
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Patch, Third Party Advisory
cve@mitre.orghttp://www.securityfocus.com/bid/94395Third Party Advisory, VDB Entry
cve@mitre.orghttps://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/Patch, Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/10/8Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/94395Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/Patch, Release Notes, Vendor Advisory
Impacted products
Vendor Product Version
mybb merge_system *
mybb mybb *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:mybb:merge_system:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "716986AC-5E6D-4DDD-A553-B88981BDE788",
                     versionEndIncluding: "1.8.6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "2212E819-C064-4963-BCD2-214F09A46902",
                     versionEndIncluding: "1.8.6",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "Cross-site scripting (XSS) vulnerability in the Mod control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors involving editing users.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de XSS en el panel de control Mod en MyBB (también conocido como MyBulletinBoard) en versiones anteriores a 1.8.7 y MyBB Merge System en versiones anteriores a 1.8.7 podrían permitir a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de vectores que implican a usuarios de edición.",
      },
   ],
   id: "CVE-2016-9408",
   lastModified: "2024-11-21T03:01:08.153",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               confidentialityImpact: "NONE",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: true,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 6.1,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "LOW",
               integrityImpact: "LOW",
               privilegesRequired: "NONE",
               scope: "CHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
               version: "3.0",
            },
            exploitabilityScore: 2.8,
            impactScore: 2.7,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2017-01-31T22:59:01.267",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94395",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Patch",
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94395",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-79",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2017-01-31 22:59
Modified
2024-11-21 03:01
Severity ?
5.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Summary
The Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to obtain the installation path via vectors involving sending mails.
References
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/10/8Mailing List, Patch, Third Party Advisory
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Patch, Third Party Advisory
cve@mitre.orghttp://www.securityfocus.com/bid/94395Third Party Advisory, VDB Entry
cve@mitre.orghttps://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/Patch, Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/10/8Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/94395Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/Patch, Release Notes, Vendor Advisory
Impacted products
Vendor Product Version
mybb merge_system *
mybb mybb *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:mybb:merge_system:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "716986AC-5E6D-4DDD-A553-B88981BDE788",
                     versionEndIncluding: "1.8.6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "2212E819-C064-4963-BCD2-214F09A46902",
                     versionEndIncluding: "1.8.6",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "The Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to obtain the installation path via vectors involving sending mails.",
      },
      {
         lang: "es",
         value: "El panel de control Admin en MyBB (también conocido como MyBulletinBoard) en versiones anteriores a 1.8.7 y MyBB Merge System en versiones anteriores a 1.8.7 permite a los atacantes remotos obtener la ruta de instalación a través de vectores que implican el envío de correos.",
      },
   ],
   id: "CVE-2016-9411",
   lastModified: "2024-11-21T03:01:08.623",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 5,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:N",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 5.3,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "LOW",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 3.9,
            impactScore: 1.4,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2017-01-31T22:59:01.377",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94395",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Patch",
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94395",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-200",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2017-01-31 22:59
Modified
2024-11-21 02:39
Severity ?
10.0 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Summary
SQL injection vulnerability in the Group Promotions module in the admin control panel in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
References
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/10/8Third Party Advisory
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Third Party Advisory
cve@mitre.orghttp://www.securityfocus.com/bid/94397Third Party Advisory, VDB Entry
cve@mitre.orghttps://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/10/8Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/94397Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/Release Notes, Vendor Advisory
Impacted products
Vendor Product Version
mybb merge_system *
mybb mybb *
mybb mybb 1.8.0
mybb mybb 1.8.1
mybb mybb 1.8.2
mybb mybb 1.8.3
mybb mybb 1.8.4
mybb mybb 1.8.5


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:mybb:merge_system:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "22907EC0-5A2D-4DCF-B887-8FA311B3D4E2",
                     versionEndIncluding: "1.8.5",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "2FF6F484-A280-45A6-BB5E-B923339B7109",
                     versionEndIncluding: "1.6.17",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:1.8.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "E697D13C-5594-491B-B911-3B4BEA00AFCC",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:1.8.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "00724054-858F-4322-8BE5-F6929CC2CAD8",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:1.8.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "95998F68-1F16-4FEA-BDE3-957235D04881",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:1.8.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "927F9547-773B-4F2C-8870-AA3672EEC7CA",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:1.8.4:*:*:*:*:*:*:*",
                     matchCriteriaId: "6817FA9E-51B7-4ADE-86E2-E9F559A585EC",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:1.8.5:*:*:*:*:*:*:*",
                     matchCriteriaId: "667EFFF1-E5C1-4124-BD0B-D4244FAECE15",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "SQL injection vulnerability in the Group Promotions module in the admin control panel in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de inyección SQL en el módulo Group Promotions en el panel de control de administrador en MyBB (también conocido como MyBulletinBoard) en versiones anteriores a 1.6.18 y 1.8.x en versiones anteriores a 1.8.6 y MyBB Merge System en versiones anteriores a 1.8.6 permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de vectores no especificados.",
      },
   ],
   id: "CVE-2015-8974",
   lastModified: "2024-11-21T02:39:34.977",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: true,
            baseSeverity: "HIGH",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 7.5,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 6.4,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 10,
               baseSeverity: "CRITICAL",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "CHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 3.9,
            impactScore: 6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2017-01-31T22:59:00.187",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94397",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94397",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-89",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2017-01-31 22:59
Modified
2024-11-21 03:01
Severity ?
7.5 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow remote attackers to obtain sensitive information by leveraging missing directory listing protection in upload directories.
References
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/10/8Mailing List, Patch, Third Party Advisory
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Patch, Third Party Advisory
cve@mitre.orghttp://www.securityfocus.com/bid/94395Third Party Advisory, VDB Entry
cve@mitre.orghttps://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/Patch, Third Party Advisory, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/10/8Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/94395Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/Patch, Third Party Advisory, Vendor Advisory
Impacted products
Vendor Product Version
mybb merge_system *
mybb mybb *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:mybb:merge_system:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "716986AC-5E6D-4DDD-A553-B88981BDE788",
                     versionEndIncluding: "1.8.6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "2212E819-C064-4963-BCD2-214F09A46902",
                     versionEndIncluding: "1.8.6",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow remote attackers to obtain sensitive information by leveraging missing directory listing protection in upload directories.",
      },
      {
         lang: "es",
         value: "MyBB (también conocido como MyBulletinBoard) en versiones anteriores a 1.8.7 y MyBB Merge System en versiones anteriores a 1.8.7 permiten a atacantes remotos obtener información sensible aprovechando la protección de la lista de directorios ausentes en los directorios de subida.",
      },
   ],
   id: "CVE-2016-9414",
   lastModified: "2024-11-21T03:01:09.073",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 5,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:N",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 7.5,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 3.9,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2017-01-31T22:59:01.487",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94395",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Patch",
            "Third Party Advisory",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94395",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Third Party Advisory",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-200",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2017-01-31 22:59
Modified
2024-11-21 03:01
Severity ?
7.4 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Summary
The fetch_remote_file function in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors.
References
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/10/8Mailing List, Patch, Third Party Advisory
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Patch, Third Party Advisory
cve@mitre.orghttp://www.securityfocus.com/bid/94396Third Party Advisory, VDB Entry
cve@mitre.orghttps://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/Patch, Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/10/8Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/94396Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/Patch, Release Notes, Vendor Advisory
Impacted products
Vendor Product Version
mybb merge_system *
mybb mybb *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:mybb:merge_system:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FC4E25F3-7C9D-45E3-8330-961A56BC3C48",
                     versionEndIncluding: "1.8.7",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "78D16782-41C7-4001-8DD1-C7A09B347733",
                     versionEndIncluding: "1.8.7",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "The fetch_remote_file function in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors.",
      },
      {
         lang: "es",
         value: "La función fetch_remote_file en MyBB (también conocida como MyBulletinBoard) en versiones anteriores a 1.8.8 y MyBB Merge System en versiones anteriores a 1.8.8 permite a atacantes remotos llevar a cabo ataques de falsificación de solicitud del lado del servidor (SSRF) a través de vectores no especificados.",
      },
   ],
   id: "CVE-2016-9417",
   lastModified: "2024-11-21T03:01:09.497",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 5.8,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:M/Au:N/C:P/I:P/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 4.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: true,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 7.4,
               baseSeverity: "HIGH",
               confidentialityImpact: "NONE",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "CHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N",
               version: "3.0",
            },
            exploitabilityScore: 2.8,
            impactScore: 4,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2017-01-31T22:59:01.610",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94396",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Patch",
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94396",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-918",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2017-01-31 22:59
Modified
2024-11-21 03:01
Severity ?
6.1 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
Cross-site scripting (XSS) vulnerability in member validation in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/10/8Mailing List, Patch, Third Party Advisory
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Patch, Third Party Advisory
cve@mitre.orghttp://www.securityfocus.com/bid/94395Third Party Advisory, VDB Entry
cve@mitre.orghttps://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/Patch, Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/10/8Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/94395Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/Patch, Release Notes, Vendor Advisory
Impacted products
Vendor Product Version
mybb merge_system *
mybb mybb *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:mybb:merge_system:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "716986AC-5E6D-4DDD-A553-B88981BDE788",
                     versionEndIncluding: "1.8.6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "2212E819-C064-4963-BCD2-214F09A46902",
                     versionEndIncluding: "1.8.6",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "Cross-site scripting (XSS) vulnerability in member validation in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de XSS en la validación de miembros en MyBB (también conocido como MyBulletinBoard) en versiones anteriores a 1.8.7 y MyBB Merge System en versiones anteriores a 1.8.7 podrían permitir a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de vectores no especificados.",
      },
   ],
   id: "CVE-2016-9405",
   lastModified: "2024-11-21T03:01:07.707",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               confidentialityImpact: "NONE",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: true,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 6.1,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "LOW",
               integrityImpact: "LOW",
               privilegesRequired: "NONE",
               scope: "CHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
               version: "3.0",
            },
            exploitabilityScore: 2.8,
            impactScore: 2.7,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2017-01-31T22:59:01.140",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94395",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Patch",
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94395",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-79",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2017-01-31 22:59
Modified
2024-11-21 03:01
Severity ?
6.1 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
Cross-site scripting (XSS) vulnerability in the Users module in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/10/8Mailing List, Patch, Third Party Advisory
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Patch, Third Party Advisory
cve@mitre.orghttp://www.securityfocus.com/bid/94396Third Party Advisory, VDB Entry
cve@mitre.orghttps://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/Patch, Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/10/8Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/94396Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/Patch, Release Notes, Vendor Advisory
Impacted products
Vendor Product Version
mybb merge_system *
mybb mybb *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:mybb:merge_system:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FC4E25F3-7C9D-45E3-8330-961A56BC3C48",
                     versionEndIncluding: "1.8.7",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "78D16782-41C7-4001-8DD1-C7A09B347733",
                     versionEndIncluding: "1.8.7",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "Cross-site scripting (XSS) vulnerability in the Users module in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de XSS en el módulo Users en el panel de control de Admin en MyBB (también conocido como MyBulletinBoard) en versiones anteriores a 1.8.8 y MyBB Merge System en versiones anteriores a 1.8.8 podrían permitir a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de vectores no especificados.",
      },
   ],
   id: "CVE-2016-9421",
   lastModified: "2024-11-21T03:01:10.143",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               confidentialityImpact: "NONE",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: true,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 6.1,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "LOW",
               integrityImpact: "LOW",
               privilegesRequired: "NONE",
               scope: "CHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
               version: "3.0",
            },
            exploitabilityScore: 2.8,
            impactScore: 2.7,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2017-01-31T22:59:01.750",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94396",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Patch",
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94396",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-79",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2017-01-31 22:59
Modified
2024-11-21 03:01
Severity ?
6.1 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
Cross-site scripting (XSS) vulnerability in the User control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/10/8Mailing List, Patch, Third Party Advisory
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Patch, Third Party Advisory
cve@mitre.orghttp://www.securityfocus.com/bid/94395Third Party Advisory, VDB Entry
cve@mitre.orghttps://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/Patch, Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/10/8Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/94395Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/Patch, Release Notes, Vendor Advisory
Impacted products
Vendor Product Version
mybb merge_system *
mybb mybb *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:mybb:merge_system:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "716986AC-5E6D-4DDD-A553-B88981BDE788",
                     versionEndIncluding: "1.8.6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "2212E819-C064-4963-BCD2-214F09A46902",
                     versionEndIncluding: "1.8.6",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "Cross-site scripting (XSS) vulnerability in the User control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de XSS en el panel de control de User en MyBB (también conocido como MyBulletinBoard) en versiones anteriores a 1.8.7 y MyBB Merge System en versiones anteriores a 1.8.7 podrían permitir a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de vectores no especificados.",
      },
   ],
   id: "CVE-2016-9406",
   lastModified: "2024-11-21T03:01:07.857",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               confidentialityImpact: "NONE",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: true,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 6.1,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "LOW",
               integrityImpact: "LOW",
               privilegesRequired: "NONE",
               scope: "CHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
               version: "3.0",
            },
            exploitabilityScore: 2.8,
            impactScore: 2.7,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2017-01-31T22:59:01.173",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94395",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Patch",
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94395",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-79",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2017-01-31 22:59
Modified
2024-11-21 02:39
Severity ?
6.1 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 might allow remote attackers to inject arbitrary web script or HTML via vectors related to "old upgrade files."
References
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/10/8Third Party Advisory
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Third Party Advisory
cve@mitre.orghttp://www.securityfocus.com/bid/94397
cve@mitre.orghttps://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/10/8Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/94397
af854a3a-2127-422b-91ae-364da2661108https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/Release Notes, Vendor Advisory
Impacted products
Vendor Product Version
mybb merge_system 1.8.5
mybb mybb *
mybb mybb 1.8.0
mybb mybb 1.8.1
mybb mybb 1.8.2
mybb mybb 1.8.3
mybb mybb 1.8.4
mybb mybb 1.8.5


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:mybb:merge_system:1.8.5:*:*:*:*:*:*:*",
                     matchCriteriaId: "84DB6EE0-4972-434D-9C89-7BD9EB4896B7",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "2FF6F484-A280-45A6-BB5E-B923339B7109",
                     versionEndIncluding: "1.6.17",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:1.8.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "E697D13C-5594-491B-B911-3B4BEA00AFCC",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:1.8.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "00724054-858F-4322-8BE5-F6929CC2CAD8",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:1.8.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "95998F68-1F16-4FEA-BDE3-957235D04881",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:1.8.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "927F9547-773B-4F2C-8870-AA3672EEC7CA",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:1.8.4:*:*:*:*:*:*:*",
                     matchCriteriaId: "6817FA9E-51B7-4ADE-86E2-E9F559A585EC",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:1.8.5:*:*:*:*:*:*:*",
                     matchCriteriaId: "667EFFF1-E5C1-4124-BD0B-D4244FAECE15",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 might allow remote attackers to inject arbitrary web script or HTML via vectors related to \"old upgrade files.\"",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de XSS en MyBB (también conocido como MyBulletinBoard) en versiones anteriores a 1.6.18 y 1.8.x en versiones anteriores a 1.8.6 y MyBB Merge System en versiones anteriores a 1.8.6 podrían permitir a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de vectores relacionados con \"archivos antiguos de actualización\".",
      },
   ],
   id: "CVE-2015-8976",
   lastModified: "2024-11-21T02:39:35.277",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               confidentialityImpact: "NONE",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: true,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 6.1,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "LOW",
               integrityImpact: "LOW",
               privilegesRequired: "NONE",
               scope: "CHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
               version: "3.0",
            },
            exploitabilityScore: 2.8,
            impactScore: 2.7,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2017-01-31T22:59:00.267",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "cve@mitre.org",
         url: "http://www.securityfocus.com/bid/94397",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.securityfocus.com/bid/94397",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-79",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2017-01-31 22:59
Modified
2024-11-21 03:01
Severity ?
6.1 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors involving Mod control panel logs.
References
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/10/8Mailing List, Patch, Third Party Advisory
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Patch, Third Party Advisory
cve@mitre.orghttp://www.securityfocus.com/bid/94395Third Party Advisory, VDB Entry
cve@mitre.orghttps://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/Patch, Third Party Advisory, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/10/8Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/94395Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/Patch, Third Party Advisory, Vendor Advisory
Impacted products
Vendor Product Version
mybb merge_system *
mybb mybb *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:mybb:merge_system:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "716986AC-5E6D-4DDD-A553-B88981BDE788",
                     versionEndIncluding: "1.8.6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "2212E819-C064-4963-BCD2-214F09A46902",
                     versionEndIncluding: "1.8.6",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors involving Mod control panel logs.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de XSS en MyBB (también conocido como MyBulletinBoard) en versiones anteriores a 1.8.7 y MyBB Merge System en versiones anteriores a 1.8.7 podrían permitir a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de vectores que implican registros de panel de control Mod.",
      },
   ],
   id: "CVE-2016-9407",
   lastModified: "2024-11-21T03:01:08.010",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               confidentialityImpact: "NONE",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: true,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 6.1,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "LOW",
               integrityImpact: "LOW",
               privilegesRequired: "NONE",
               scope: "CHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
               version: "3.0",
            },
            exploitabilityScore: 2.8,
            impactScore: 2.7,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2017-01-31T22:59:01.220",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94395",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Patch",
            "Third Party Advisory",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94395",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Third Party Advisory",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-79",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2017-01-31 22:59
Modified
2024-11-21 03:01
Severity ?
9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow attackers to have unspecified impact via vectors related to low adminsid and sid entropy.
References
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/10/8Mailing List, Patch, Third Party Advisory
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Patch, Third Party Advisory
cve@mitre.orghttp://www.securityfocus.com/bid/94395Third Party Advisory, VDB Entry
cve@mitre.orghttps://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/Patch, Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/10/8Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/94395Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/Patch, Release Notes, Vendor Advisory
Impacted products
Vendor Product Version
mybb merge_system *
mybb mybb *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:mybb:merge_system:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "716986AC-5E6D-4DDD-A553-B88981BDE788",
                     versionEndIncluding: "1.8.6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "2212E819-C064-4963-BCD2-214F09A46902",
                     versionEndIncluding: "1.8.6",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow attackers to have unspecified impact via vectors related to low adminsid and sid entropy.",
      },
      {
         lang: "es",
         value: "MyBB (también conocido como MyBulletinBoard) en versiones anteriores a 1.8.7 y MyBB Merge System en versiones anteriores a 1.8.7 permiten a atacantes tener un impacto no especificado a través de vectores relacionados con la baja entropía adminsid y sid.",
      },
   ],
   id: "CVE-2016-9412",
   lastModified: "2024-11-21T03:01:08.773",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "HIGH",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 7.5,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 6.4,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 9.8,
               baseSeverity: "CRITICAL",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 3.9,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2017-01-31T22:59:01.423",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94395",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Patch",
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94395",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-284",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2017-01-31 22:59
Modified
2024-11-21 03:01
Severity ?
9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
SQL injection vulnerability in the moderation tool in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
References
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/10/8Mailing List, Patch, Third Party Advisory
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Patch, Third Party Advisory
cve@mitre.orghttp://www.securityfocus.com/bid/94395Third Party Advisory, VDB Entry
cve@mitre.orghttps://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/Patch, Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/10/8Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/94395Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/Patch, Release Notes, Vendor Advisory
Impacted products
Vendor Product Version
mybb merge_system *
mybb mybb *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:mybb:merge_system:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "716986AC-5E6D-4DDD-A553-B88981BDE788",
                     versionEndIncluding: "1.8.6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "2212E819-C064-4963-BCD2-214F09A46902",
                     versionEndIncluding: "1.8.6",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "SQL injection vulnerability in the moderation tool in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to execute arbitrary SQL commands via unspecified vectors.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de inyección SQL en la herramienta de moderación en MyBB (también conocido como MyBulletinBoard) en versiones anteriores a 1.8.7 y MyBB Merge System en versiones anteriores a 1.8.7 podrían permitir a atacantes remotos ejecutar comandos SQL arbitrarios a través de vectores no especificados.",
      },
   ],
   id: "CVE-2016-9402",
   lastModified: "2024-11-21T03:01:07.280",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "HIGH",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 7.5,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 6.4,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 9.8,
               baseSeverity: "CRITICAL",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 3.9,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2017-01-31T22:59:01.017",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94395",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Patch",
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94395",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-89",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2017-01-31 22:59
Modified
2024-11-21 03:01
Severity ?
6.1 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors related to login.
References
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/10/8Mailing List, Patch, Third Party Advisory
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Patch, Third Party Advisory
cve@mitre.orghttp://www.securityfocus.com/bid/94395Third Party Advisory, VDB Entry
cve@mitre.orghttps://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/Patch, Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/10/8Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/94395Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/Patch, Release Notes, Vendor Advisory
Impacted products
Vendor Product Version
mybb merge_system *
mybb mybb *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:mybb:merge_system:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "716986AC-5E6D-4DDD-A553-B88981BDE788",
                     versionEndIncluding: "1.8.6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "2212E819-C064-4963-BCD2-214F09A46902",
                     versionEndIncluding: "1.8.6",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors related to login.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de XSS en MyBB (también conocido como MyBulletinBoard) en versiones anteriores a 1.8.7 y MyBB Merge System en versiones anteriores a 1.8.7 podrían permitir a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de vectores relacionados con el inicio de sesión.",
      },
   ],
   id: "CVE-2016-9404",
   lastModified: "2024-11-21T03:01:07.570",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               confidentialityImpact: "NONE",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: true,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 6.1,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "LOW",
               integrityImpact: "LOW",
               privilegesRequired: "NONE",
               scope: "CHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
               version: "3.0",
            },
            exploitabilityScore: 2.8,
            impactScore: 2.7,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2017-01-31T22:59:01.093",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94395",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Patch",
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94395",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-79",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2017-01-31 22:59
Modified
2024-11-21 03:01
Severity ?
9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
newreply.php in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to have unspecified impact by leveraging a missing permission check.
References
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/10/8Mailing List, Patch, Third Party Advisory
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Patch, Third Party Advisory
cve@mitre.orghttp://www.securityfocus.com/bid/94395Third Party Advisory, VDB Entry
cve@mitre.orghttps://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/Patch, Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/10/8Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/94395Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/Patch, Release Notes, Vendor Advisory
Impacted products
Vendor Product Version
mybb merge_system *
mybb mybb *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:mybb:merge_system:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "716986AC-5E6D-4DDD-A553-B88981BDE788",
                     versionEndIncluding: "1.8.6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "2212E819-C064-4963-BCD2-214F09A46902",
                     versionEndIncluding: "1.8.6",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "newreply.php in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to have unspecified impact by leveraging a missing permission check.",
      },
      {
         lang: "es",
         value: "newreply.php en MyBB (también conocido como MyBulletinBoard) en versiones anteriores a 1.8.7 y MyBB Merge System en versiones anteriores a 1.8.7 permite a atacantes remotos tener un impacto no especificado al aprovechar una comprobación de permiso perdida.",
      },
   ],
   id: "CVE-2016-9403",
   lastModified: "2024-11-21T03:01:07.427",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: true,
            baseSeverity: "HIGH",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 7.5,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 6.4,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 9.8,
               baseSeverity: "CRITICAL",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 3.9,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2017-01-31T22:59:01.063",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94395",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Patch",
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94395",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-264",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2017-01-31 22:59
Modified
2024-11-21 02:39
Severity ?
7.5 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allow remote attackers to obtain the installation path via vectors involving error log files.
References
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/10/8Third Party Advisory
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Third Party Advisory
cve@mitre.orghttp://www.securityfocus.com/bid/94397Third Party Advisory, VDB Entry
cve@mitre.orghttps://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/10/8Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/94397Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/Release Notes, Vendor Advisory
Impacted products
Vendor Product Version
mybb merge_system *
mybb mybb *
mybb mybb 1.8.0
mybb mybb 1.8.1
mybb mybb 1.8.2
mybb mybb 1.8.3
mybb mybb 1.8.4
mybb mybb 1.8.5


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:mybb:merge_system:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "22907EC0-5A2D-4DCF-B887-8FA311B3D4E2",
                     versionEndIncluding: "1.8.5",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "2FF6F484-A280-45A6-BB5E-B923339B7109",
                     versionEndIncluding: "1.6.17",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:1.8.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "E697D13C-5594-491B-B911-3B4BEA00AFCC",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:1.8.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "00724054-858F-4322-8BE5-F6929CC2CAD8",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:1.8.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "95998F68-1F16-4FEA-BDE3-957235D04881",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:1.8.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "927F9547-773B-4F2C-8870-AA3672EEC7CA",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:1.8.4:*:*:*:*:*:*:*",
                     matchCriteriaId: "6817FA9E-51B7-4ADE-86E2-E9F559A585EC",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:1.8.5:*:*:*:*:*:*:*",
                     matchCriteriaId: "667EFFF1-E5C1-4124-BD0B-D4244FAECE15",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allow remote attackers to obtain the installation path via vectors involving error log files.",
      },
      {
         lang: "es",
         value: "MyBB (también conocido como MyBulletinBoard) en versiones anteriores a 1.6.18 y 1.8.x en versiones anteriores a 1.8.6 y MyBB Merge System en versiones anteriores a 1.8.6 permiten a atacantes remotos obtener la ruta de instalación a través de vectores que involucran archivos de registro de errores.",
      },
   ],
   id: "CVE-2015-8977",
   lastModified: "2024-11-21T02:39:35.440",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: true,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 5,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:N",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 7.5,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 3.9,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2017-01-31T22:59:00.297",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94397",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94397",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-532",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2017-01-31 22:59
Modified
2024-11-21 02:39
Severity ?
8.3 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Summary
xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to bypass intended access restrictions via vectors related to the forum password.
References
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/10/8Third Party Advisory
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Third Party Advisory
cve@mitre.orghttp://www.securityfocus.com/bid/94397Third Party Advisory, VDB Entry
cve@mitre.orghttps://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/10/8Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/94397Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/Release Notes, Vendor Advisory
Impacted products
Vendor Product Version
mybb merge_system *
mybb mybb *
mybb mybb 1.8.0
mybb mybb 1.8.1
mybb mybb 1.8.2
mybb mybb 1.8.3
mybb mybb 1.8.4
mybb mybb 1.8.5


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:mybb:merge_system:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "22907EC0-5A2D-4DCF-B887-8FA311B3D4E2",
                     versionEndIncluding: "1.8.5",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "2FF6F484-A280-45A6-BB5E-B923339B7109",
                     versionEndIncluding: "1.6.17",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:1.8.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "E697D13C-5594-491B-B911-3B4BEA00AFCC",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:1.8.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "00724054-858F-4322-8BE5-F6929CC2CAD8",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:1.8.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "95998F68-1F16-4FEA-BDE3-957235D04881",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:1.8.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "927F9547-773B-4F2C-8870-AA3672EEC7CA",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:1.8.4:*:*:*:*:*:*:*",
                     matchCriteriaId: "6817FA9E-51B7-4ADE-86E2-E9F559A585EC",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:1.8.5:*:*:*:*:*:*:*",
                     matchCriteriaId: "667EFFF1-E5C1-4124-BD0B-D4244FAECE15",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to bypass intended access restrictions via vectors related to the forum password.",
      },
      {
         lang: "es",
         value: "xmlhttp.php en MyBB (también conocido como MyBulletinBoard) en versiones anteriores a 1.6.18 y 1.8.x en versiones anteriores a 1.8.6 y MyBB Merge System en versiones anteriores a 1.8.6 permite a atacantes remotos eludir las restricciones de acceso previstas a través de vectores relacionados con la contraseña del foro.",
      },
   ],
   id: "CVE-2015-8973",
   lastModified: "2024-11-21T02:39:34.800",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: true,
            baseSeverity: "HIGH",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 7.5,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 6.4,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "LOW",
               baseScore: 8.3,
               baseSeverity: "HIGH",
               confidentialityImpact: "LOW",
               integrityImpact: "LOW",
               privilegesRequired: "NONE",
               scope: "CHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
               version: "3.0",
            },
            exploitabilityScore: 3.9,
            impactScore: 3.7,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2017-01-31T22:59:00.140",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94397",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94397",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-284",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2017-01-31 22:59
Modified
2024-11-21 03:01
Severity ?
7.5 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Summary
MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows allow remote attackers to overwrite arbitrary CSS files via vectors related to "style import."
References
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/10/8Mailing List, Patch, Third Party Advisory
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Patch, Third Party Advisory
cve@mitre.orghttp://www.securityfocus.com/bid/94396Third Party Advisory, VDB Entry
cve@mitre.orghttps://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/Patch, Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/10/8Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/94396Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/Patch, Release Notes, Vendor Advisory
Impacted products
Vendor Product Version
mybb merge_system *
mybb mybb *
microsoft windows *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:mybb:merge_system:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FC4E25F3-7C9D-45E3-8330-961A56BC3C48",
                     versionEndIncluding: "1.8.7",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "78D16782-41C7-4001-8DD1-C7A09B347733",
                     versionEndIncluding: "1.8.7",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "2CF61F35-5905-4BA9-AD7E-7DB261D2F256",
                     vulnerable: false,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
         operator: "AND",
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows allow remote attackers to overwrite arbitrary CSS files via vectors related to \"style import.\"",
      },
      {
         lang: "es",
         value: "MyBB (también conocido como MyBulletinBoard) en versiones anteriores a 1.8.8 en Windows y MyBB Merge System en versiones anteriores a 1.8.8 en Windows permiten a atacantes remotos sobrescribir archivos CSS arbitrarios a través de vectores relacionados con \"importar estilo\".",
      },
   ],
   id: "CVE-2016-9415",
   lastModified: "2024-11-21T03:01:09.220",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 5,
               confidentialityImpact: "NONE",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:L/Au:N/C:N/I:P/A:N",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 7.5,
               baseSeverity: "HIGH",
               confidentialityImpact: "NONE",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
               version: "3.0",
            },
            exploitabilityScore: 3.9,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2017-01-31T22:59:01.533",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94396",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Patch",
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94396",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-284",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2017-01-31 22:59
Modified
2024-11-21 03:01
Severity ?
9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allow remote attackers to have unspecified impact via vectors related to "loose comparison false positives."
References
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/10/8Mailing List, Patch, Third Party Advisory
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Patch, Third Party Advisory
cve@mitre.orghttp://www.securityfocus.com/bid/94396Third Party Advisory, VDB Entry
cve@mitre.orghttps://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/Patch, Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/10/8Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/94396Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/Patch, Release Notes, Vendor Advisory
Impacted products
Vendor Product Version
mybb merge_system *
mybb mybb *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:mybb:merge_system:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FC4E25F3-7C9D-45E3-8330-961A56BC3C48",
                     versionEndIncluding: "1.8.7",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "78D16782-41C7-4001-8DD1-C7A09B347733",
                     versionEndIncluding: "1.8.7",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allow remote attackers to have unspecified impact via vectors related to \"loose comparison false positives.\"",
      },
      {
         lang: "es",
         value: "MyBB (también conocido como MyBulletinBoard) en versiones anteriores a 1.8.8 y MyBB Merge System en versiones anteriores a 1.8.8 permiten a atacantes remotos tener un impacto no especificado a través de vectores relacionados con \"comparación suelta de falsos positivos\".",
      },
   ],
   id: "CVE-2016-9420",
   lastModified: "2024-11-21T03:01:09.967",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: true,
            baseSeverity: "HIGH",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 7.5,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 6.4,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 9.8,
               baseSeverity: "CRITICAL",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 3.9,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2017-01-31T22:59:01.720",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94396",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Patch",
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94396",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-20",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2017-01-31 22:59
Modified
2024-11-21 03:01
Severity ?
7.5 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to obtain sensitive database information via vectors involving templates.
References
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/10/8Mailing List, Patch, Third Party Advisory
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Patch, Third Party Advisory
cve@mitre.orghttp://www.securityfocus.com/bid/94395Third Party Advisory, VDB Entry
cve@mitre.orghttps://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/Patch, Third Party Advisory, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/10/8Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/94395Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/Patch, Third Party Advisory, Vendor Advisory
Impacted products
Vendor Product Version
mybb merge_system *
mybb mybb *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:mybb:merge_system:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "716986AC-5E6D-4DDD-A553-B88981BDE788",
                     versionEndIncluding: "1.8.6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "2212E819-C064-4963-BCD2-214F09A46902",
                     versionEndIncluding: "1.8.6",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to obtain sensitive database information via vectors involving templates.",
      },
      {
         lang: "es",
         value: "MyBB (también conocido como MyBulletinBoard) en versiones anteriores a 1.8.7 y MyBB Merge System en versiones anteriores a 1.8.7 pueden permitir a atacantes remotos obtener información sensible de la base de datos a través de vectores relacionados con plantillas.",
      },
   ],
   id: "CVE-2016-9410",
   lastModified: "2024-11-21T03:01:08.470",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 5,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:N",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 7.5,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 3.9,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2017-01-31T22:59:01.347",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94395",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Patch",
            "Third Party Advisory",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94395",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Third Party Advisory",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-200",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2017-01-31 22:59
Modified
2024-11-21 02:39
Severity ?
6.1 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
Cross-site scripting (XSS) vulnerability in the error handler in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/10/8Mailing List, Third Party Advisory
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Third Party Advisory
cve@mitre.orghttp://www.securityfocus.com/bid/94397Third Party Advisory, VDB Entry
cve@mitre.orghttps://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/10/8Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/94397Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/Release Notes, Vendor Advisory
Impacted products
Vendor Product Version
mybb merge_system 1.8.5
mybb mybb *
mybb mybb 1.8.0
mybb mybb 1.8.1
mybb mybb 1.8.2
mybb mybb 1.8.3
mybb mybb 1.8.4
mybb mybb 1.8.5


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:mybb:merge_system:1.8.5:*:*:*:*:*:*:*",
                     matchCriteriaId: "84DB6EE0-4972-434D-9C89-7BD9EB4896B7",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "2FF6F484-A280-45A6-BB5E-B923339B7109",
                     versionEndIncluding: "1.6.17",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:1.8.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "E697D13C-5594-491B-B911-3B4BEA00AFCC",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:1.8.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "00724054-858F-4322-8BE5-F6929CC2CAD8",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:1.8.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "95998F68-1F16-4FEA-BDE3-957235D04881",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:1.8.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "927F9547-773B-4F2C-8870-AA3672EEC7CA",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:1.8.4:*:*:*:*:*:*:*",
                     matchCriteriaId: "6817FA9E-51B7-4ADE-86E2-E9F559A585EC",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:1.8.5:*:*:*:*:*:*:*",
                     matchCriteriaId: "667EFFF1-E5C1-4124-BD0B-D4244FAECE15",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "Cross-site scripting (XSS) vulnerability in the error handler in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de XSS en el manejador de errores en MyBB (también conocido como MyBulletinBoard) en versiones anteriores a 1.6.18 y 1.8.x en versiones anteriores a 1.8.6 y MyBB Merge System en versiones anteriores a 1.8.6 podría permitir a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de vectores no especificados.",
      },
   ],
   id: "CVE-2015-8975",
   lastModified: "2024-11-21T02:39:35.127",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               confidentialityImpact: "NONE",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: true,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 6.1,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "LOW",
               integrityImpact: "LOW",
               privilegesRequired: "NONE",
               scope: "CHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
               version: "3.0",
            },
            exploitabilityScore: 2.8,
            impactScore: 2.7,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2017-01-31T22:59:00.237",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94397",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94397",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-79",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2017-01-31 22:59
Modified
2024-11-21 03:01
Severity ?
9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
SQL injection vulnerability in the users data handler in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
References
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/10/8Mailing List, Patch, Third Party Advisory
cve@mitre.orghttp://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Patch, Third Party Advisory
cve@mitre.orghttp://www.securityfocus.com/bid/94396Third Party Advisory, VDB Entry
cve@mitre.orghttps://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/Patch, Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/10/8Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.openwall.com/lists/oss-security/2016/11/18/1Mailing List, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/94396Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/Patch, Release Notes, Vendor Advisory
Impacted products
Vendor Product Version
mybb merge_system *
mybb mybb *


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:mybb:merge_system:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FC4E25F3-7C9D-45E3-8330-961A56BC3C48",
                     versionEndIncluding: "1.8.7",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:mybb:mybb:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "78D16782-41C7-4001-8DD1-C7A09B347733",
                     versionEndIncluding: "1.8.7",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "SQL injection vulnerability in the users data handler in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.",
      },
      {
         lang: "es",
         value: "Vulnerabilidad de inyección SQL en el manejador de datos de usuarios en MyBB (también conocido como MyBulletinBoard) en versiones anteriores a 1.8.8 y MyBB Merge System en versiones anteriores a 1.8.8 permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de vectores no especificados.",
      },
   ],
   id: "CVE-2016-9416",
   lastModified: "2024-11-21T03:01:09.363",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: true,
            baseSeverity: "HIGH",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 7.5,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 6.4,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 9.8,
               baseSeverity: "CRITICAL",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 3.9,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2017-01-31T22:59:01.580",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94396",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Patch",
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mailing List",
            "Patch",
            "Third Party Advisory",
         ],
         url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/94396",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Release Notes",
            "Vendor Advisory",
         ],
         url: "https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-89",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

cve-2016-9409
Vulnerability from cvelistv5
Published
2017-01-31 22:00
Modified
2024-08-06 02:50
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors involving pruning logs.
References
http://www.securityfocus.com/bid/94395vdb-entry, x_refsource_BID
http://www.openwall.com/lists/oss-security/2016/11/18/1mailing-list, x_refsource_MLIST
http://www.openwall.com/lists/oss-security/2016/11/10/8mailing-list, x_refsource_MLIST
https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/x_refsource_CONFIRM
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T02:50:37.974Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "94395",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/94395",
               },
               {
                  name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
               },
               {
                  name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2016-03-11T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "Cross-site scripting (XSS) vulnerability in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors involving pruning logs.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2017-02-01T10:57:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               name: "94395",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/94395",
            },
            {
               name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
            },
            {
               name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2016-9409",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Cross-site scripting (XSS) vulnerability in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors involving pruning logs.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "94395",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/94395",
                  },
                  {
                     name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
                  },
                  {
                     name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
                  },
                  {
                     name: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
                     refsource: "CONFIRM",
                     url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2016-9409",
      datePublished: "2017-01-31T22:00:00",
      dateReserved: "2016-11-17T00:00:00",
      dateUpdated: "2024-08-06T02:50:37.974Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2016-9411
Vulnerability from cvelistv5
Published
2017-01-31 22:00
Modified
2024-08-06 02:50
Severity ?
Summary
The Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to obtain the installation path via vectors involving sending mails.
References
http://www.securityfocus.com/bid/94395vdb-entry, x_refsource_BID
http://www.openwall.com/lists/oss-security/2016/11/18/1mailing-list, x_refsource_MLIST
http://www.openwall.com/lists/oss-security/2016/11/10/8mailing-list, x_refsource_MLIST
https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/x_refsource_CONFIRM
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T02:50:37.816Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "94395",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/94395",
               },
               {
                  name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
               },
               {
                  name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2016-03-11T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "The Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to obtain the installation path via vectors involving sending mails.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2017-02-01T10:57:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               name: "94395",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/94395",
            },
            {
               name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
            },
            {
               name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2016-9411",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "The Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to obtain the installation path via vectors involving sending mails.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "94395",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/94395",
                  },
                  {
                     name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
                  },
                  {
                     name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
                  },
                  {
                     name: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
                     refsource: "CONFIRM",
                     url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2016-9411",
      datePublished: "2017-01-31T22:00:00",
      dateReserved: "2016-11-17T00:00:00",
      dateUpdated: "2024-08-06T02:50:37.816Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2016-9410
Vulnerability from cvelistv5
Published
2017-01-31 22:00
Modified
2024-08-06 02:50
Severity ?
Summary
MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to obtain sensitive database information via vectors involving templates.
References
http://www.securityfocus.com/bid/94395vdb-entry, x_refsource_BID
http://www.openwall.com/lists/oss-security/2016/11/18/1mailing-list, x_refsource_MLIST
http://www.openwall.com/lists/oss-security/2016/11/10/8mailing-list, x_refsource_MLIST
https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/x_refsource_CONFIRM
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T02:50:37.938Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "94395",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/94395",
               },
               {
                  name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
               },
               {
                  name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2016-03-11T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to obtain sensitive database information via vectors involving templates.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2017-02-01T10:57:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               name: "94395",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/94395",
            },
            {
               name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
            },
            {
               name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2016-9410",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to obtain sensitive database information via vectors involving templates.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "94395",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/94395",
                  },
                  {
                     name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
                  },
                  {
                     name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
                  },
                  {
                     name: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
                     refsource: "CONFIRM",
                     url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2016-9410",
      datePublished: "2017-01-31T22:00:00",
      dateReserved: "2016-11-17T00:00:00",
      dateUpdated: "2024-08-06T02:50:37.938Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2015-8974
Vulnerability from cvelistv5
Published
2017-01-31 22:00
Modified
2024-08-06 08:36
Severity ?
Summary
SQL injection vulnerability in the Group Promotions module in the admin control panel in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
References
https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/x_refsource_CONFIRM
http://www.securityfocus.com/bid/94397vdb-entry, x_refsource_BID
http://www.openwall.com/lists/oss-security/2016/11/18/1mailing-list, x_refsource_MLIST
http://www.openwall.com/lists/oss-security/2016/11/10/8mailing-list, x_refsource_MLIST
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T08:36:30.884Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/",
               },
               {
                  name: "94397",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/94397",
               },
               {
                  name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
               },
               {
                  name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2015-09-07T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "SQL injection vulnerability in the Group Promotions module in the admin control panel in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2017-02-01T10:57:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/",
            },
            {
               name: "94397",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/94397",
            },
            {
               name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
            },
            {
               name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2015-8974",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "SQL injection vulnerability in the Group Promotions module in the admin control panel in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/",
                     refsource: "CONFIRM",
                     url: "https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/",
                  },
                  {
                     name: "94397",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/94397",
                  },
                  {
                     name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
                  },
                  {
                     name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2015-8974",
      datePublished: "2017-01-31T22:00:00",
      dateReserved: "2016-11-17T00:00:00",
      dateUpdated: "2024-08-06T08:36:30.884Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2016-9403
Vulnerability from cvelistv5
Published
2017-01-31 22:00
Modified
2024-08-06 02:50
Severity ?
Summary
newreply.php in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to have unspecified impact by leveraging a missing permission check.
References
http://www.securityfocus.com/bid/94395vdb-entry, x_refsource_BID
http://www.openwall.com/lists/oss-security/2016/11/18/1mailing-list, x_refsource_MLIST
http://www.openwall.com/lists/oss-security/2016/11/10/8mailing-list, x_refsource_MLIST
https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/x_refsource_CONFIRM
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T02:50:37.623Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "94395",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/94395",
               },
               {
                  name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
               },
               {
                  name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2016-03-11T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "newreply.php in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to have unspecified impact by leveraging a missing permission check.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2017-02-01T10:57:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               name: "94395",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/94395",
            },
            {
               name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
            },
            {
               name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2016-9403",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "newreply.php in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to have unspecified impact by leveraging a missing permission check.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "94395",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/94395",
                  },
                  {
                     name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
                  },
                  {
                     name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
                  },
                  {
                     name: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
                     refsource: "CONFIRM",
                     url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2016-9403",
      datePublished: "2017-01-31T22:00:00",
      dateReserved: "2016-11-17T00:00:00",
      dateUpdated: "2024-08-06T02:50:37.623Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2015-8977
Vulnerability from cvelistv5
Published
2017-01-31 22:00
Modified
2024-08-06 08:36
Severity ?
Summary
MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allow remote attackers to obtain the installation path via vectors involving error log files.
References
https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/x_refsource_CONFIRM
http://www.securityfocus.com/bid/94397vdb-entry, x_refsource_BID
http://www.openwall.com/lists/oss-security/2016/11/18/1mailing-list, x_refsource_MLIST
http://www.openwall.com/lists/oss-security/2016/11/10/8mailing-list, x_refsource_MLIST
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T08:36:30.817Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/",
               },
               {
                  name: "94397",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/94397",
               },
               {
                  name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
               },
               {
                  name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2015-09-07T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allow remote attackers to obtain the installation path via vectors involving error log files.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2017-02-02T12:57:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/",
            },
            {
               name: "94397",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/94397",
            },
            {
               name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
            },
            {
               name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2015-8977",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allow remote attackers to obtain the installation path via vectors involving error log files.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/",
                     refsource: "CONFIRM",
                     url: "https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/",
                  },
                  {
                     name: "94397",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/94397",
                  },
                  {
                     name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
                  },
                  {
                     name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2015-8977",
      datePublished: "2017-01-31T22:00:00",
      dateReserved: "2016-11-17T00:00:00",
      dateUpdated: "2024-08-06T08:36:30.817Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2015-8975
Vulnerability from cvelistv5
Published
2017-01-31 22:00
Modified
2024-08-06 08:36
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the error handler in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/x_refsource_CONFIRM
http://www.securityfocus.com/bid/94397vdb-entry, x_refsource_BID
http://www.openwall.com/lists/oss-security/2016/11/18/1mailing-list, x_refsource_MLIST
http://www.openwall.com/lists/oss-security/2016/11/10/8mailing-list, x_refsource_MLIST
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T08:36:30.559Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/",
               },
               {
                  name: "94397",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/94397",
               },
               {
                  name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
               },
               {
                  name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2015-09-07T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "Cross-site scripting (XSS) vulnerability in the error handler in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2017-02-01T10:57:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/",
            },
            {
               name: "94397",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/94397",
            },
            {
               name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
            },
            {
               name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2015-8975",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Cross-site scripting (XSS) vulnerability in the error handler in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/",
                     refsource: "CONFIRM",
                     url: "https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/",
                  },
                  {
                     name: "94397",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/94397",
                  },
                  {
                     name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
                  },
                  {
                     name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2015-8975",
      datePublished: "2017-01-31T22:00:00",
      dateReserved: "2016-11-17T00:00:00",
      dateUpdated: "2024-08-06T08:36:30.559Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2016-9406
Vulnerability from cvelistv5
Published
2017-01-31 22:00
Modified
2024-08-06 02:50
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the User control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
http://www.securityfocus.com/bid/94395vdb-entry, x_refsource_BID
http://www.openwall.com/lists/oss-security/2016/11/18/1mailing-list, x_refsource_MLIST
http://www.openwall.com/lists/oss-security/2016/11/10/8mailing-list, x_refsource_MLIST
https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/x_refsource_CONFIRM
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T02:50:37.700Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "94395",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/94395",
               },
               {
                  name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
               },
               {
                  name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2016-03-11T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "Cross-site scripting (XSS) vulnerability in the User control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2017-02-01T10:57:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               name: "94395",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/94395",
            },
            {
               name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
            },
            {
               name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2016-9406",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Cross-site scripting (XSS) vulnerability in the User control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "94395",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/94395",
                  },
                  {
                     name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
                  },
                  {
                     name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
                  },
                  {
                     name: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
                     refsource: "CONFIRM",
                     url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2016-9406",
      datePublished: "2017-01-31T22:00:00",
      dateReserved: "2016-11-17T00:00:00",
      dateUpdated: "2024-08-06T02:50:37.700Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2016-9417
Vulnerability from cvelistv5
Published
2017-01-31 22:00
Modified
2024-08-06 02:50
Severity ?
Summary
The fetch_remote_file function in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors.
References
https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2016/11/18/1mailing-list, x_refsource_MLIST
http://www.openwall.com/lists/oss-security/2016/11/10/8mailing-list, x_refsource_MLIST
http://www.securityfocus.com/bid/94396vdb-entry, x_refsource_BID
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T02:50:38.392Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/",
               },
               {
                  name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
               },
               {
                  name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
               },
               {
                  name: "94396",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/94396",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2016-10-17T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "The fetch_remote_file function in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2017-02-01T10:57:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/",
            },
            {
               name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
            },
            {
               name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
            },
            {
               name: "94396",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/94396",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2016-9417",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "The fetch_remote_file function in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/",
                     refsource: "CONFIRM",
                     url: "https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/",
                  },
                  {
                     name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
                  },
                  {
                     name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
                  },
                  {
                     name: "94396",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/94396",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2016-9417",
      datePublished: "2017-01-31T22:00:00",
      dateReserved: "2016-11-17T00:00:00",
      dateUpdated: "2024-08-06T02:50:38.392Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2016-9418
Vulnerability from cvelistv5
Published
2017-01-31 22:00
Modified
2024-08-06 02:50
Severity ?
Summary
MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows might allow remote attackers to obtain sensitive information from ACP backups via vectors involving a short name.
References
https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2016/11/18/1mailing-list, x_refsource_MLIST
http://www.openwall.com/lists/oss-security/2016/11/10/8mailing-list, x_refsource_MLIST
http://www.securityfocus.com/bid/94396vdb-entry, x_refsource_BID
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T02:50:38.333Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/",
               },
               {
                  name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
               },
               {
                  name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
               },
               {
                  name: "94396",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/94396",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2016-10-17T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows might allow remote attackers to obtain sensitive information from ACP backups via vectors involving a short name.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2017-02-01T10:57:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/",
            },
            {
               name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
            },
            {
               name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
            },
            {
               name: "94396",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/94396",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2016-9418",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows might allow remote attackers to obtain sensitive information from ACP backups via vectors involving a short name.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/",
                     refsource: "CONFIRM",
                     url: "https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/",
                  },
                  {
                     name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
                  },
                  {
                     name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
                  },
                  {
                     name: "94396",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/94396",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2016-9418",
      datePublished: "2017-01-31T22:00:00",
      dateReserved: "2016-11-17T00:00:00",
      dateUpdated: "2024-08-06T02:50:38.333Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2016-9420
Vulnerability from cvelistv5
Published
2017-01-31 22:00
Modified
2024-08-06 02:50
Severity ?
Summary
MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allow remote attackers to have unspecified impact via vectors related to "loose comparison false positives."
References
https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2016/11/18/1mailing-list, x_refsource_MLIST
http://www.openwall.com/lists/oss-security/2016/11/10/8mailing-list, x_refsource_MLIST
http://www.securityfocus.com/bid/94396vdb-entry, x_refsource_BID
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T02:50:38.327Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/",
               },
               {
                  name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
               },
               {
                  name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
               },
               {
                  name: "94396",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/94396",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2016-10-17T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allow remote attackers to have unspecified impact via vectors related to \"loose comparison false positives.\"",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2017-02-01T10:57:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/",
            },
            {
               name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
            },
            {
               name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
            },
            {
               name: "94396",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/94396",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2016-9420",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allow remote attackers to have unspecified impact via vectors related to \"loose comparison false positives.\"",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/",
                     refsource: "CONFIRM",
                     url: "https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/",
                  },
                  {
                     name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
                  },
                  {
                     name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
                  },
                  {
                     name: "94396",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/94396",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2016-9420",
      datePublished: "2017-01-31T22:00:00",
      dateReserved: "2016-11-17T00:00:00",
      dateUpdated: "2024-08-06T02:50:38.327Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2016-9404
Vulnerability from cvelistv5
Published
2017-01-31 22:00
Modified
2024-08-06 02:50
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors related to login.
References
http://www.securityfocus.com/bid/94395vdb-entry, x_refsource_BID
http://www.openwall.com/lists/oss-security/2016/11/18/1mailing-list, x_refsource_MLIST
http://www.openwall.com/lists/oss-security/2016/11/10/8mailing-list, x_refsource_MLIST
https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/x_refsource_CONFIRM
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T02:50:38.353Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "94395",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/94395",
               },
               {
                  name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
               },
               {
                  name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2016-03-11T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors related to login.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2017-02-01T10:57:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               name: "94395",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/94395",
            },
            {
               name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
            },
            {
               name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2016-9404",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors related to login.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "94395",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/94395",
                  },
                  {
                     name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
                  },
                  {
                     name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
                  },
                  {
                     name: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
                     refsource: "CONFIRM",
                     url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2016-9404",
      datePublished: "2017-01-31T22:00:00",
      dateReserved: "2016-11-17T00:00:00",
      dateUpdated: "2024-08-06T02:50:38.353Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2015-8976
Vulnerability from cvelistv5
Published
2017-01-31 22:00
Modified
2024-08-06 08:36
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 might allow remote attackers to inject arbitrary web script or HTML via vectors related to "old upgrade files."
References
https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/x_refsource_CONFIRM
http://www.securityfocus.com/bid/94397vdb-entry, x_refsource_BID
http://www.openwall.com/lists/oss-security/2016/11/18/1mailing-list, x_refsource_MLIST
http://www.openwall.com/lists/oss-security/2016/11/10/8mailing-list, x_refsource_MLIST
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T08:36:31.035Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/",
               },
               {
                  name: "94397",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/94397",
               },
               {
                  name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
               },
               {
                  name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2015-09-07T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 might allow remote attackers to inject arbitrary web script or HTML via vectors related to \"old upgrade files.\"",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2017-02-01T10:57:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/",
            },
            {
               name: "94397",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/94397",
            },
            {
               name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
            },
            {
               name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2015-8976",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 might allow remote attackers to inject arbitrary web script or HTML via vectors related to \"old upgrade files.\"",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/",
                     refsource: "CONFIRM",
                     url: "https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/",
                  },
                  {
                     name: "94397",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/94397",
                  },
                  {
                     name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
                  },
                  {
                     name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2015-8976",
      datePublished: "2017-01-31T22:00:00",
      dateReserved: "2016-11-17T00:00:00",
      dateUpdated: "2024-08-06T08:36:31.035Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2016-9402
Vulnerability from cvelistv5
Published
2017-01-31 22:00
Modified
2024-08-06 02:50
Severity ?
Summary
SQL injection vulnerability in the moderation tool in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to execute arbitrary SQL commands via unspecified vectors.
References
http://www.securityfocus.com/bid/94395vdb-entry, x_refsource_BID
http://www.openwall.com/lists/oss-security/2016/11/18/1mailing-list, x_refsource_MLIST
http://www.openwall.com/lists/oss-security/2016/11/10/8mailing-list, x_refsource_MLIST
https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/x_refsource_CONFIRM
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T02:50:38.224Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "94395",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/94395",
               },
               {
                  name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
               },
               {
                  name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2016-03-11T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "SQL injection vulnerability in the moderation tool in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to execute arbitrary SQL commands via unspecified vectors.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2017-02-01T10:57:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               name: "94395",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/94395",
            },
            {
               name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
            },
            {
               name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2016-9402",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "SQL injection vulnerability in the moderation tool in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to execute arbitrary SQL commands via unspecified vectors.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "94395",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/94395",
                  },
                  {
                     name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
                  },
                  {
                     name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
                  },
                  {
                     name: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
                     refsource: "CONFIRM",
                     url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2016-9402",
      datePublished: "2017-01-31T22:00:00",
      dateReserved: "2016-11-17T00:00:00",
      dateUpdated: "2024-08-06T02:50:38.224Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2016-9413
Vulnerability from cvelistv5
Published
2017-01-31 22:00
Modified
2024-08-06 02:50
Severity ?
Summary
The Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to conduct clickjacking attacks via unspecified vectors.
References
http://www.securityfocus.com/bid/94395vdb-entry, x_refsource_BID
http://www.openwall.com/lists/oss-security/2016/11/18/1mailing-list, x_refsource_MLIST
http://www.openwall.com/lists/oss-security/2016/11/10/8mailing-list, x_refsource_MLIST
https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/x_refsource_CONFIRM
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T02:50:37.728Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "94395",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/94395",
               },
               {
                  name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
               },
               {
                  name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2016-03-11T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "The Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to conduct clickjacking attacks via unspecified vectors.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2017-02-01T10:57:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               name: "94395",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/94395",
            },
            {
               name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
            },
            {
               name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2016-9413",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "The Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allows remote attackers to conduct clickjacking attacks via unspecified vectors.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "94395",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/94395",
                  },
                  {
                     name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
                  },
                  {
                     name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
                  },
                  {
                     name: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
                     refsource: "CONFIRM",
                     url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2016-9413",
      datePublished: "2017-01-31T22:00:00",
      dateReserved: "2016-11-17T00:00:00",
      dateUpdated: "2024-08-06T02:50:37.728Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2016-9405
Vulnerability from cvelistv5
Published
2017-01-31 22:00
Modified
2024-08-06 02:50
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in member validation in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
http://www.securityfocus.com/bid/94395vdb-entry, x_refsource_BID
http://www.openwall.com/lists/oss-security/2016/11/18/1mailing-list, x_refsource_MLIST
http://www.openwall.com/lists/oss-security/2016/11/10/8mailing-list, x_refsource_MLIST
https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/x_refsource_CONFIRM
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T02:50:37.882Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "94395",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/94395",
               },
               {
                  name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
               },
               {
                  name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2016-03-11T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "Cross-site scripting (XSS) vulnerability in member validation in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2017-02-01T10:57:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               name: "94395",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/94395",
            },
            {
               name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
            },
            {
               name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2016-9405",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Cross-site scripting (XSS) vulnerability in member validation in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "94395",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/94395",
                  },
                  {
                     name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
                  },
                  {
                     name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
                  },
                  {
                     name: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
                     refsource: "CONFIRM",
                     url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2016-9405",
      datePublished: "2017-01-31T22:00:00",
      dateReserved: "2016-11-17T00:00:00",
      dateUpdated: "2024-08-06T02:50:37.882Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2016-9407
Vulnerability from cvelistv5
Published
2017-01-31 22:00
Modified
2024-08-06 02:50
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors involving Mod control panel logs.
References
http://www.securityfocus.com/bid/94395vdb-entry, x_refsource_BID
http://www.openwall.com/lists/oss-security/2016/11/18/1mailing-list, x_refsource_MLIST
http://www.openwall.com/lists/oss-security/2016/11/10/8mailing-list, x_refsource_MLIST
https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/x_refsource_CONFIRM
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T02:50:37.683Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "94395",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/94395",
               },
               {
                  name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
               },
               {
                  name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2016-03-11T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors involving Mod control panel logs.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2017-02-01T10:57:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               name: "94395",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/94395",
            },
            {
               name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
            },
            {
               name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2016-9407",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Cross-site scripting (XSS) vulnerability in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors involving Mod control panel logs.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "94395",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/94395",
                  },
                  {
                     name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
                  },
                  {
                     name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
                  },
                  {
                     name: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
                     refsource: "CONFIRM",
                     url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2016-9407",
      datePublished: "2017-01-31T22:00:00",
      dateReserved: "2016-11-17T00:00:00",
      dateUpdated: "2024-08-06T02:50:37.683Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2016-9412
Vulnerability from cvelistv5
Published
2017-01-31 22:00
Modified
2024-08-06 02:50
Severity ?
Summary
MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow attackers to have unspecified impact via vectors related to low adminsid and sid entropy.
References
http://www.securityfocus.com/bid/94395vdb-entry, x_refsource_BID
http://www.openwall.com/lists/oss-security/2016/11/18/1mailing-list, x_refsource_MLIST
http://www.openwall.com/lists/oss-security/2016/11/10/8mailing-list, x_refsource_MLIST
https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/x_refsource_CONFIRM
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T02:50:37.943Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "94395",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/94395",
               },
               {
                  name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
               },
               {
                  name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2016-03-11T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow attackers to have unspecified impact via vectors related to low adminsid and sid entropy.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2017-02-01T10:57:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               name: "94395",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/94395",
            },
            {
               name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
            },
            {
               name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2016-9412",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow attackers to have unspecified impact via vectors related to low adminsid and sid entropy.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "94395",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/94395",
                  },
                  {
                     name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
                  },
                  {
                     name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
                  },
                  {
                     name: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
                     refsource: "CONFIRM",
                     url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2016-9412",
      datePublished: "2017-01-31T22:00:00",
      dateReserved: "2016-11-17T00:00:00",
      dateUpdated: "2024-08-06T02:50:37.943Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2016-9408
Vulnerability from cvelistv5
Published
2017-01-31 22:00
Modified
2024-08-06 02:50
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the Mod control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors involving editing users.
References
http://www.securityfocus.com/bid/94395vdb-entry, x_refsource_BID
http://www.openwall.com/lists/oss-security/2016/11/18/1mailing-list, x_refsource_MLIST
http://www.openwall.com/lists/oss-security/2016/11/10/8mailing-list, x_refsource_MLIST
https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/x_refsource_CONFIRM
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T02:50:37.699Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "94395",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/94395",
               },
               {
                  name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
               },
               {
                  name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2016-03-11T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "Cross-site scripting (XSS) vulnerability in the Mod control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors involving editing users.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2017-02-01T10:57:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               name: "94395",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/94395",
            },
            {
               name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
            },
            {
               name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2016-9408",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Cross-site scripting (XSS) vulnerability in the Mod control panel in MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors involving editing users.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "94395",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/94395",
                  },
                  {
                     name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
                  },
                  {
                     name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
                  },
                  {
                     name: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
                     refsource: "CONFIRM",
                     url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2016-9408",
      datePublished: "2017-01-31T22:00:00",
      dateReserved: "2016-11-17T00:00:00",
      dateUpdated: "2024-08-06T02:50:37.699Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2016-9414
Vulnerability from cvelistv5
Published
2017-01-31 22:00
Modified
2024-08-06 02:50
Severity ?
Summary
MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow remote attackers to obtain sensitive information by leveraging missing directory listing protection in upload directories.
References
http://www.securityfocus.com/bid/94395vdb-entry, x_refsource_BID
http://www.openwall.com/lists/oss-security/2016/11/18/1mailing-list, x_refsource_MLIST
http://www.openwall.com/lists/oss-security/2016/11/10/8mailing-list, x_refsource_MLIST
https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/x_refsource_CONFIRM
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T02:50:37.918Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "94395",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/94395",
               },
               {
                  name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
               },
               {
                  name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2016-03-11T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow remote attackers to obtain sensitive information by leveraging missing directory listing protection in upload directories.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2017-02-01T10:57:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               name: "94395",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/94395",
            },
            {
               name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
            },
            {
               name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2016-9414",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "MyBB (aka MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 allow remote attackers to obtain sensitive information by leveraging missing directory listing protection in upload directories.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "94395",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/94395",
                  },
                  {
                     name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
                  },
                  {
                     name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
                  },
                  {
                     name: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
                     refsource: "CONFIRM",
                     url: "https://blog.mybb.com/2016/03/11/mybb-1-8-7-merge-system-1-8-7-release/",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2016-9414",
      datePublished: "2017-01-31T22:00:00",
      dateReserved: "2016-11-17T00:00:00",
      dateUpdated: "2024-08-06T02:50:37.918Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2016-9421
Vulnerability from cvelistv5
Published
2017-01-31 22:00
Modified
2024-08-06 02:50
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in the Users module in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2016/11/18/1mailing-list, x_refsource_MLIST
http://www.openwall.com/lists/oss-security/2016/11/10/8mailing-list, x_refsource_MLIST
http://www.securityfocus.com/bid/94396vdb-entry, x_refsource_BID
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T02:50:38.427Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/",
               },
               {
                  name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
               },
               {
                  name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
               },
               {
                  name: "94396",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/94396",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2016-10-17T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "Cross-site scripting (XSS) vulnerability in the Users module in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2017-02-01T10:57:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/",
            },
            {
               name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
            },
            {
               name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
            },
            {
               name: "94396",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/94396",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2016-9421",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Cross-site scripting (XSS) vulnerability in the Users module in the Admin control panel in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 might allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/",
                     refsource: "CONFIRM",
                     url: "https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/",
                  },
                  {
                     name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
                  },
                  {
                     name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
                  },
                  {
                     name: "94396",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/94396",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2016-9421",
      datePublished: "2017-01-31T22:00:00",
      dateReserved: "2016-11-17T00:00:00",
      dateUpdated: "2024-08-06T02:50:38.427Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2016-9416
Vulnerability from cvelistv5
Published
2017-01-31 22:00
Modified
2024-08-06 02:50
Severity ?
Summary
SQL injection vulnerability in the users data handler in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
References
https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2016/11/18/1mailing-list, x_refsource_MLIST
http://www.openwall.com/lists/oss-security/2016/11/10/8mailing-list, x_refsource_MLIST
http://www.securityfocus.com/bid/94396vdb-entry, x_refsource_BID
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T02:50:37.707Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/",
               },
               {
                  name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
               },
               {
                  name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
               },
               {
                  name: "94396",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/94396",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2016-10-17T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "SQL injection vulnerability in the users data handler in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2017-02-01T10:57:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/",
            },
            {
               name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
            },
            {
               name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
            },
            {
               name: "94396",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/94396",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2016-9416",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "SQL injection vulnerability in the users data handler in MyBB (aka MyBulletinBoard) before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/",
                     refsource: "CONFIRM",
                     url: "https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/",
                  },
                  {
                     name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
                  },
                  {
                     name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
                  },
                  {
                     name: "94396",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/94396",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2016-9416",
      datePublished: "2017-01-31T22:00:00",
      dateReserved: "2016-11-17T00:00:00",
      dateUpdated: "2024-08-06T02:50:37.707Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2016-9415
Vulnerability from cvelistv5
Published
2017-01-31 22:00
Modified
2024-08-06 02:50
Severity ?
Summary
MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows allow remote attackers to overwrite arbitrary CSS files via vectors related to "style import."
References
https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2016/11/18/1mailing-list, x_refsource_MLIST
http://www.openwall.com/lists/oss-security/2016/11/10/8mailing-list, x_refsource_MLIST
http://www.securityfocus.com/bid/94396vdb-entry, x_refsource_BID
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T02:50:38.036Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/",
               },
               {
                  name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
               },
               {
                  name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
               },
               {
                  name: "94396",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/94396",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2016-10-17T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows allow remote attackers to overwrite arbitrary CSS files via vectors related to \"style import.\"",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2017-02-01T10:57:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/",
            },
            {
               name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
            },
            {
               name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
            },
            {
               name: "94396",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/94396",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2016-9415",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "MyBB (aka MyBulletinBoard) before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows allow remote attackers to overwrite arbitrary CSS files via vectors related to \"style import.\"",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/",
                     refsource: "CONFIRM",
                     url: "https://blog.mybb.com/2016/10/17/mybb-1-8-8-merge-system-1-8-8-release/",
                  },
                  {
                     name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
                  },
                  {
                     name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
                  },
                  {
                     name: "94396",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/94396",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2016-9415",
      datePublished: "2017-01-31T22:00:00",
      dateReserved: "2016-11-17T00:00:00",
      dateUpdated: "2024-08-06T02:50:38.036Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2015-8973
Vulnerability from cvelistv5
Published
2017-01-31 22:00
Modified
2024-08-06 08:36
Severity ?
Summary
xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to bypass intended access restrictions via vectors related to the forum password.
References
https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/x_refsource_CONFIRM
http://www.securityfocus.com/bid/94397vdb-entry, x_refsource_BID
http://www.openwall.com/lists/oss-security/2016/11/18/1mailing-list, x_refsource_MLIST
http://www.openwall.com/lists/oss-security/2016/11/10/8mailing-list, x_refsource_MLIST
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T08:36:30.417Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/",
               },
               {
                  name: "94397",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/94397",
               },
               {
                  name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
               },
               {
                  name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2015-09-07T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to bypass intended access restrictions via vectors related to the forum password.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2017-02-01T10:57:01",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/",
            },
            {
               name: "94397",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/94397",
            },
            {
               name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
            },
            {
               name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2015-8973",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "xmlhttp.php in MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allows remote attackers to bypass intended access restrictions via vectors related to the forum password.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/",
                     refsource: "CONFIRM",
                     url: "https://blog.mybb.com/2015/09/07/mybb-1-8-6-1-6-18-merge-system-1-8-6-release/",
                  },
                  {
                     name: "94397",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/94397",
                  },
                  {
                     name: "[oss-security] 20161117 Re: CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/18/1",
                  },
                  {
                     name: "[oss-security] 20161110 CVE request: MyBB multiple vulnerabilities",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2016/11/10/8",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2015-8973",
      datePublished: "2017-01-31T22:00:00",
      dateReserved: "2016-11-17T00:00:00",
      dateUpdated: "2024-08-06T08:36:30.417Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}