CVE Vulnerability Catalog

MyBB before version 1.8.7 and MyBB Merge System before version 1.8.7 allow remote attackers to obtain sensitive information by leveraging missing directory listing protection in upload directories.

MyBB before version 1.8.7 and MyBB Merge System before version 1.8.7 have a vulnerability that allows attackers to achieve unspecified impact via vectors related to low adminsid and sid entropy.

MyBB (also known as MyBulletinBoard) before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to obtain sensitive database information via vectors involving templates.

The newreply.php file in MyBB (MyBulletinBoard) before version 1.8.7 and MyBB Merge System before version 1.8.7 has a vulnerability that allows remote attackers to exploit a missing permission check.

There is an SQL injection vulnerability in the moderation tool in MyBB before version 1.8.7 and in the MyBB Merge System before version 1.8.7 that may allow remote attackers to execute arbitrary SQL commands.

Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to have unspecified impact via a crafted BMP image.

A heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before version 1.13 allows remote attackers to exploit it via a crafted BMP image.

A heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before version 1.13 allows remote attackers to exploit it via a crafted BMP image.

Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to exploit a crafted BMP image.

Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to exploit this via a crafted BMP image.

Heap-based buffer overflow in the bm_readbody_bmp function in bitmap_io.c in potrace before 1.13 allows remote attackers to exploit it via a crafted BMP image.

The bm_new function in bitmap.h in potrace 1.13 allows remote attackers to have unspecified impact via a crafted image, which triggers a memory allocation failure.

MyBB before 1.6.18 and 1.8.x before 1.8.6 and MyBB Merge System before 1.8.6 allow remote attackers to obtain the installation path via vectors involving error log files.

SQL injection vulnerability in the Group Promotions module in the admin control panel in MyBB before 1.6.18 and 1.8.x before 1.8.6 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

The xmlhttp.php file in MyBB before version 1.6.18 and 1.8.x before 1.8.6, as well as MyBB Merge System before 1.8.6, contains a vulnerability that allows remote attackers to bypass intended access restrictions related to the forum password.

The setup script for phpMyAdmin before 4.0.10.19, 4.4.x before 4.4.15.10, and 4.6.x before 4.6.6 allows remote attackers to conduct server-side request forgery (SSRF) attacks via unspecified vectors.

An issue was discovered in Radisys MRF Web Panel (SWMS) version 9.0.1, where the MSM_MACRO_NAME POST parameter in /swms/ms.cgi is vulnerable to OS command injection attacks. This allows attackers to inject arbitrary OS commands and retrieve their output in the application's responses.

An undisclosed traffic pattern received by a BIG-IP Virtual Server with TCP Fast Open enabled may cause the Traffic Management Microkernel (TMM) to restart, resulting in a Denial-of-Service (DoS).

In Botan versions 1.8.0 through 1.11.33, an integer overflow could occur when decoding BER data, leading to an incorrect length field being computed. Some API callers may use the returned (incorrect and attacker controlled) length field in a way that later causes memory corruption or other failures.

The openssl gem for Ruby uses the same initialization vector (IV) in GCM Mode (aes-*-gcm) when the IV is set before the key, which makes it easier for context-dependent attackers to bypass the encryption protection mechanism.