CVE

Id
35045  
CVE No.
CVE-2008-4928  
Status
Candidate  
Description
Cross-site scripting (XSS) vulnerability in the redirect function in functions.php in MyBB (aka MyBulletinBoard) 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the url parameter in a removesubscriptions action to moderation.php, related to use of the ajax option to request a JavaScript redirect. NOTE: this can be leveraged to execute PHP code and bypass cross-site request forgery (CSRF) protection.  
Phase
Assigned (20081104)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
383485 35045 CVE-2008-4928 BUGTRAQ:20081027 MyBB 1.4.2: Multiple Vulnerabilties  View
383486 35045 CVE-2008-4928 URL:http://archives.neohapsis.com/archives/bugtraq/2008-10/0203.html  View
383487 35045 CVE-2008-4928 BUGTRAQ:20081027 Re: MyBB 1.4.2: Multiple Vulnerabilties  View
383488 35045 CVE-2008-4928 URL:http://archives.neohapsis.com/archives/bugtraq/2008-10/0212.html  View
383489 35045 CVE-2008-4928 FULLDISC:20081027 MyBB 1.4.2: Multiple Vulnerabilties  View
383490 35045 CVE-2008-4928 URL:http://archives.neohapsis.com/archives/fulldisclosure/2008-10/0472.html  View
383491 35045 CVE-2008-4928 MLIST:[oss-security] 20081101 CVE request (Fwd: MyBB 1.4.2: Multiple Vulnerabilties)  View
383492 35045 CVE-2008-4928 URL:http://www.openwall.com/lists/oss-security/2008/11/01/2  View
383493 35045 CVE-2008-4928 BID:31935  View
383494 35045 CVE-2008-4928 URL:http://www.securityfocus.com/bid/31935  View
383495 35045 CVE-2008-4928 VUPEN:ADV-2008-2967  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
48293 JVNDB-2008-003603 U-Mail Webmail サーバの webmail/modules/filesystem/edit.php における任意のファイルを上書きされる脆弱性 U-Mail Webmail サーバの webmail/modules/filesystem/edit.php には、任意のファイルを上書きされる脆弱性が存在します。 CVE-2008-4932 35045 9 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-003603.html  View