CVE-2015-8977
HighSummary
MyBB before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allow remote attackers to obtain the installation path via vectors involving error log files.
Risk Assessment
Attackers may exploit this vulnerability to gain information about the system's structure, potentially leading to further attacks on the server.
Recommendation
It is recommended to update MyBB to the latest version to mitigate the risks associated with this vulnerability.
Other vulnerabilities in MyBB, MyBB Merge System
See all- CVE-2016-9418High
MyBB before 1.8.8 on Windows and MyBB Merge System before 1.8.8 on Windows might allow remote attackers to obtain sensitive information from ACP backups via vectors involving a short name.
- CVE-2016-9417High
The fetch_remote_file function in MyBB before 1.8.8 and MyBB Merge System before 1.8.8 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors.
- CVE-2016-9415High
MyBB before version 1.8.8 on Windows and MyBB Merge System before version 1.8.8 on Windows allow remote attackers to overwrite arbitrary CSS files via vectors related to 'style import.'
- CVE-2016-9414High
MyBB before version 1.8.7 and MyBB Merge System before version 1.8.7 allow remote attackers to obtain sensitive information by leveraging missing directory listing protection in upload directories.
- CVE-2016-9410High
MyBB (also known as MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to obtain sensitive database information via vectors involving templates.
- CVE-2016-9420Critical
MyBB before version 1.8.8 and MyBB Merge System before version 1.8.8 have a vulnerability that allows remote attackers to achieve unspecified impact via vectors related to 'loose comparison false positives'.
- CVE-2016-9412Critical
MyBB before version 1.8.7 and MyBB Merge System before version 1.8.7 have a vulnerability that allows attackers to achieve unspecified impact via vectors related to low adminsid and sid entropy.
Original NVD description (English source)
MyBB (aka MyBulletinBoard) before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allow remote attackers to obtain the installation path via vectors involving error log files.