CVE-2018-10678

MyBB 1.8.15, when accessed with Microsoft Edge, mishandles 'target="_blank" rel="noopener"' in A elements, which makes it easier for remote attackers to conduct redirection attacks.

• CWE-601

• http://www.securityfocus.com/bid/104187Third Party Advisory, VDB Entry
• https://gist.github.com/MayurUdiniya/7aaa50b878d82b6aab6ed0b3e2b080bcThird Party Advisory
• http://www.securityfocus.com/bid/104187Third Party Advisory, VDB Entry
• https://gist.github.com/MayurUdiniya/7aaa50b878d82b6aab6ed0b3e2b080bcThird Party Advisory

Published

May 13, 2018

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-10665ILIAS 5.3.4 has XSS through unsanitized output of PHP_SELF, …
• CVE-2018-10666The Owned smart contract implementation for Aurora IDEX Memb…
• CVE-2018-1067In Undertow before versions 7.1.2.CR1, 7.1.2.GA it was found…6.1
• CVE-2018-10675The do_get_mempolicy function in mm/mempolicy.c in the Linux…7.8
• CVE-2018-10676CeNova, Night OWL, Novo, Pulnix, QSee, Securus, and TBK Visi…
• CVE-2018-10677The DecodeGifImg function in ngiflib.c in MiniUPnP ngiflib 0…
• CVE-2018-1068A flaw was found in the Linux 4.x kernel's implementation of…6.7
• CVE-2018-10680Z-BlogPHP 1.5.2 has a stored Cross Site Scripting Vulnerabil…
• CVE-2018-10682An issue was discovered in WildFly 10.1.2.Final. It is possi…9.8
• CVE-2018-10683An issue was discovered in WildFly 10.1.2.Final. In the case…9.8
• CVE-2018-10685In Long Range Zip (aka lrzip) 0.631, there is a use-after-fr…
• CVE-2018-10686An issue was discovered in Vesta Control Panel 0.9.8-20. The…