What’s added/changed in this version
The vulnerabilities are

Medium Risk: Forum password bypass in xmlhttp.php – reported by Devilshakerz
Low Risk: SQL Injection in Grouppromotions module (ACP) – reported by Devilshakerz
Low Risk: Possible XSS Injection in the error handler – reported by FooBar123
Low Risk: Possible XSS issues in old upgrade files – reported by FooBar123


Please note, that you do need to run the upgrade script for this version

What’s added/changed in this version

This release fixes 5 security vulnerabilities and 51 reported issues causing incorrect functionality of MyBB. Please be aware that not all issues have been fixed in this version in order to provide easy to manage updates
Vulnerabilities
Medium Risk: Forum password bypass in xmlhttp.php – reported by Devilshakerz
Low Risk: SQL Injection in Grouppromotions module (ACP) – reported by Devilshakerz
Low Risk: Possible XSS Injection in the error handler – reported by FooBar123
Low Risk: Possible XSS issues in old upgrade files – reported by FooBar123
Low Risk: Possible Full Path Disclosure in publicly accessible error log files – reported by Devilshakerz

Please view the 1.8.6 changes on the Docs site for more information about the changes in this version

Please note, that you do need to run the upgrade script for this version

What’s added/changed in this version


The vulnerabilities are

Medium Risk: Reset password code check could be circumvented in member.php – reported by solati.sadegh
Medium Risk: Permissions not checked for post search with old sid in search.php – reported by pedder55655
Low Risk: CSRF in ACP mass mail cancellation – reported by Destroy666
Low Risk: Use of the U+200E Unicode character to create “duplicate” username – reported by mahdy2021
Low Risk: Multiple XSS vulnerability requiring admin permissions – reported by adamziaja, Devilshakerz, DingjieYang and sroesemann
Low Risk: A CSRF vulnerability within ACP login – reported by Devilshakerz
Low Risk: Cache handler using var_export without encoding checks – reported by chtg

Please view the 1.6.17 changes on the Docs site for more information about the changes in this version

Please note, that you do not need to run the upgrade script for this version

What’s added/changed in this version

This release fixes 6 security vulnerabilities and 58 reported issues causing incorrect functionality of MyBB. Please be aware that not all issues have been fixed in this version in order to provide easy to manage updates

Vulnerabilities
Medium Risk: Reset password code check could be circumvented in member.php – reported by solati.sadegh
Medium Risk: Sender email could be spoofed when sending an email to a user in member.php – reported by onlinedevelopers
Medium Risk: Permissions not checked for post search with old sid in search.php – reported by pedder55655
Medium Risk: XSS in quick edit function of xmlhttp.php – reported by TiberiusG
Low Risk: CSRF in ACP mass mail cancellation – reported by Destroy666
Low Risk: Use of the U+200E Unicode character to create “duplicate” username – reported by mahdy2021

Please view the 1.8.5 changes on the Docs site for more information about the changes in this version

Please note, that you do need to run the upgrade script for this version

What’s added/changed in this version


This release fixes 7 vulnerabilities and 118 reported issues causing incorrect functionality of MyBB. Please be aware that to be able to provide easy to manage updates not all issues have been fixed in this version
Vulnerabilities: Medium Risk: A XSS vulnerability in member.php – reported by ATofighi
Medium Risk: A XSS vulnerability in MyCode editor – reported by Matthias Ungethüm
Low Risk: Multiple XSS vulnerability requiring admin permissions – reported by adamziaja, Devilshakerz, DingjieYang and sroesemann
Low Risk: A CSRF vulnerability within ACP login – reported by Devilshakerz
Low Risk: Group join request notifications sent to wrong group leaders – reported by Snake_
Low Risk: Cache handler using var_export without encoding checks – reported by chtg
No Risk: A full path disclosure vulnerability within JSON library – reported by Nathan Malcolm

Bugs fixed: Fixed issues in 1.8.4

New features: Support for No CAPTCHA reCAPTCHA
2 Factor Authentication for ACP login

There are no database schema changes in this version.

What’s added/changed in this version

The vulnerabilities are

Low Risk: A XSS vulnerability related to post icons - reported by Destroy666
Low Risk: A XSS vulnerability in admin/modules/style/templates.php
Low Risk: A XSS vulnerability in admin/modules/config/languages.php
Low Risk: unserialize may call magic methods - reported by chtg
Low Risk: request_order can break register globals handling - reported by chtg

Additionally we’ve revised the handling of data fetched from our website as a direct consequence of the compromised GitHub account (#1617). In addition to that, we’ve set the adminsid cookie as httpOnly - #1622.

Please note, that you do not need to run the upgrade script for this version.
There are no database schema changes in this version.

What’s added/changed in this version

The vulnerabilities are

High Risk: A SQL injection vulnerability in theme selection - reported by StefanT
Medium Risk: A XSS vulnerability in calender.php - reported by - Acid
Medium Risk: A XSS vulnerability in MyCode editor - reported by My-BB.Ir
Low Risk: A XSS vulnerability related to post icons - reported by Destroy666
Low Risk: unserialize may call PHP magic methods - reported by chtg
Low Risk: PHP setting request_order can break register globals handling - reported by chtg

Additionally we’ve fixed an issue with the video MyCode introduced with MyBB 1.8.2 (#1625) and revised the handling of data fetched from our website as a direct consequence of the compromised GitHub account (#1617). In addition to that, we’ve set the adminsid cookie as httpOnly (#1622). We also plan to add enhanced options to protect the Admin CP like two factor authentication with one of the next maintenance releases.

Please note, that you do not need to run the upgrade script for this version.
There are no database schema changes in this version.

What’s added/changed in this version
The vulnerabilities are
=============
High Risk: A SQL injection vulnerability in member.php
Medium Risk: A XSS vulnerability in report.php
Medium Risk: A XSS vulnerability in inc/class_parser.php
Low Risk: A XSS vulnerability in admin/modules/style/templates.php
Low Risk: A XSS vulnerability in admin/modules/config/languages.php
================
Please note, that you do not need to run the upgrade script for this version
There are no database schema changes in this version