[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.51.0807081317020.16947@faron.mitre.org>
Date: Tue, 8 Jul 2008 13:18:37 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
cc: coley@...re.org
Subject: Re: CVE request: mybb
On Sun, 6 Jul 2008, Hanno [utf-8] Böck wrote:
> MyBB 1.2.13 release announcement:
> "MyBB 1.2.13 is a security update to the MyBB 1.2 series. It fixes 1 HIGH risk
> and 1 Medium risk security vulnerability."
>
> http://community.mybboard.net/showthread.php?tid=31666
>
> No further details though...
The forum post linked to a security-only patch that provides some pretty
good hints.
======================================================
Name: CVE-2008-3069
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3069
Reference: CONFIRM:http://community.mybboard.net/attachment.php?aid=9272
Reference: CONFIRM:http://community.mybboard.net/showthread.php?tid=31666
Multiple cross-site scripting (XSS) vulnerabilities in MyBB before
1.2.13 allow remote attackers to inject arbitrary web script or HTML
via unspecified parameters to (1) portal.php and (2)
inc/functions_post.php.
======================================================
Name: CVE-2008-3070
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3070
Reference: CONFIRM:http://community.mybboard.net/attachment.php?aid=9272
Reference: CONFIRM:http://community.mybboard.net/showthread.php?tid=31666
Unspecified vulnerability in inc/datahandler/user.php in MyBB before
1.2.13 has unknown impact and attack vectors related to the
$user['language'] variable, probably related to SQL injection.
======================================================
Name: CVE-2008-3071
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3071
Reference: CONFIRM:http://community.mybboard.net/attachment.php?aid=9272
Reference: CONFIRM:http://community.mybboard.net/showthread.php?tid=31666
Directory traversal vulnerability in inc/class_language.php in MyBB
before 1.2.13 has unknown impact and attack vectors related to the
$language variable.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
