Description

member.php in MyBB (aka MyBulletinBoard) before 1.4.12 makes a certain superfluous call to the SQL COUNT function, which allows remote attackers to cause a denial of service (resource consumption) by making requests to member.php that trigger scans of the entire users table.

Remediation

References

CVE-2010-4628

Related Vulnerabilities

WordPress Plugin Jetpack-WP Security, Backup, Speed, & Growth Cross-Site Scripting (3.5.2)

PrestaShop Improper Neutralization of Formula Elements in a CSV File Vulnerability (CVE-2021-21302)

MediaWiki Session Fixation Vulnerability (CVE-2013-4572)

Apache Tomcat Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2015-5174)

WordPress Plugin SEO Plugin LiveOptim Multiple Vulnerabilities (1.1.8-free)

Severity

Medium

Classification

CVE-2010-4628

Tags

Missing Update Known Vulnerabilities