CVE-2006-3761

Cross-site scripting (XSS) vulnerability in inc/functions_post.php in MyBB (aka MyBulletinBoard) 1.0 RC2 through 1.1.4 allows remote attackers to inject arbitrary web script or HTML via a javascript URI with an SGML numeric character reference in the url BBCode tag, as demonstrated using "javascript".
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:mybulletinboard:mybulletinboard:1.0.1:*:*:*:*:*:*:*
cpe:2.3:a:mybulletinboard:mybulletinboard:1.0.2:*:*:*:*:*:*:*
cpe:2.3:a:mybulletinboard:mybulletinboard:1.0.3:*:*:*:*:*:*:*
cpe:2.3:a:mybulletinboard:mybulletinboard:1.0.4:*:*:*:*:*:*:*
cpe:2.3:a:mybulletinboard:mybulletinboard:1.0_final:*:*:*:*:*:*:*
cpe:2.3:a:mybulletinboard:mybulletinboard:1.0_pr2:*:*:*:*:*:*:*
cpe:2.3:a:mybulletinboard:mybulletinboard:1.0_preview_release_2:*:*:*:*:*:*:*
cpe:2.3:a:mybulletinboard:mybulletinboard:1.00_rc1:*:*:*:*:*:*:*
cpe:2.3:a:mybulletinboard:mybulletinboard:1.00_rc2:*:*:*:*:*:*:*
cpe:2.3:a:mybulletinboard:mybulletinboard:1.0_rc2:*:*:*:*:*:*:*
cpe:2.3:a:mybulletinboard:mybulletinboard:1.00_rc3:*:*:*:*:*:*:*
cpe:2.3:a:mybulletinboard:mybulletinboard:1.0_rc4:*:*:*:*:*:*:*
cpe:2.3:a:mybulletinboard:mybulletinboard:1.00_rc4:*:*:*:*:*:*:*
cpe:2.3:a:mybulletinboard:mybulletinboard:1.00_rc4_security_patch:*:*:*:*:*:*:*
cpe:2.3:a:mybulletinboard:mybulletinboard:1.01:*:*:*:*:*:*:*
cpe:2.3:a:mybulletinboard:mybulletinboard:1.1:*:*:*:*:*:*:*
cpe:2.3:a:mybulletinboard:mybulletinboard:1.1.1:*:*:*:*:*:*:*
cpe:2.3:a:mybulletinboard:mybulletinboard:1.1.2:*:*:*:*:*:*:*
cpe:2.3:a:mybulletinboard:mybulletinboard:1.1.3:*:*:*:*:*:*:*
cpe:2.3:a:mybulletinboard:mybulletinboard:1.1.4:*:*:*:*:*:*:*
cpe:2.3:a:mybulletinboard:mybulletinboard:1.04:*:*:*:*:*:*:*

History

21 Nov 2024, 00:14

Type Values Removed Values Added
References () http://community.mybboard.net/showthread.php?tid=10115 - Patch () http://community.mybboard.net/showthread.php?tid=10115 - Patch
References () http://myimei.com/security/2006-06-22/mybb-114-function_postphpxss-attack-in-url-tag.html - Exploit () http://myimei.com/security/2006-06-22/mybb-114-function_postphpxss-attack-in-url-tag.html - Exploit
References () http://secunia.com/advisories/20873 - Patch, Vendor Advisory () http://secunia.com/advisories/20873 - Patch, Vendor Advisory
References () http://securityreason.com/securityalert/1257 - () http://securityreason.com/securityalert/1257 -
References () http://www.mybboard.com/archive.php?nid=15 - Patch () http://www.mybboard.com/archive.php?nid=15 - Patch
References () http://www.osvdb.org/26808 - Exploit, Patch () http://www.osvdb.org/26808 - Exploit, Patch
References () http://www.securityfocus.com/archive/1/438588/100/200/threaded - () http://www.securityfocus.com/archive/1/438588/100/200/threaded -
References () http://www.securityfocus.com/bid/18702 - Exploit, Patch () http://www.securityfocus.com/bid/18702 - Exploit, Patch
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/27444 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/27444 -

Information

Published : 2006-07-21 14:03

Updated : 2024-11-21 00:14


NVD link : CVE-2006-3761

Mitre link : CVE-2006-3761

CVE.ORG link : CVE-2006-3761


JSON object : View

Products Affected

mybulletinboard

  • mybulletinboard
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')