Show filters
120 Total Results
Displaying 61-70 of 120
Sort by:
Attacker Value
Unknown
CVE-2017-6797
Disclosure Date: March 10, 2017 (last updated November 26, 2024)
A cross-site scripting (XSS) vulnerability in bug_change_status_page.php in MantisBT before 1.3.7 and 2.x before 2.2.1 allows remote attackers to inject arbitrary JavaScript via the 'action_type' parameter.
0
Attacker Value
Unknown
CVE-2016-7111
Disclosure Date: February 17, 2017 (last updated November 26, 2024)
MantisBT before 1.3.1 and 2.x before 2.0.0-beta.2 uses a weak Content Security Policy when using the Gravatar plugin, which allows remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.
0
Attacker Value
Unknown
CVE-2016-5364
Disclosure Date: February 17, 2017 (last updated November 26, 2024)
Cross-site scripting (XSS) vulnerability in manage_custom_field_edit_page.php in MantisBT 1.2.19 and earlier allows remote attackers to inject arbitrary web script or HTML via the return parameter.
0
Attacker Value
Unknown
CVE-2016-6837
Disclosure Date: January 10, 2017 (last updated November 25, 2024)
Cross-site scripting (XSS) vulnerability in MantisBT Filter API in MantisBT versions before 1.2.19, and versions 2.0.0-beta1, 1.3.0-beta1 allows remote attackers to inject arbitrary web script or HTML via the 'view_type' parameter.
0
Attacker Value
Unknown
CVE-2014-9759
Disclosure Date: April 11, 2016 (last updated November 25, 2024)
Incomplete blacklist vulnerability in the config_is_private function in config_api.php in MantisBT 1.3.x before 1.3.0 allows remote attackers to obtain sensitive master salt configuration information via a SOAP API request.
0
Attacker Value
Unknown
CVE-2014-8987
Disclosure Date: August 24, 2015 (last updated October 05, 2023)
Cross-site scripting (XSS) vulnerability in the "set configuration" box in the Configuration Report page (adm_config_report.php) in MantisBT 1.2.13 through 1.2.17 allows remote administrators to inject arbitrary web script or HTML via the config_option parameter, a different vulnerability than CVE-2014-8986.
0
Attacker Value
Unknown
CVE-2015-1042
Disclosure Date: February 10, 2015 (last updated October 05, 2023)
The string_sanitize_url function in core/string_api.php in MantisBT 1.2.0a3 through 1.2.18 uses an incorrect regular expression, which allows remote attackers to conduct open redirect and phishing attacks via a URL with a ":/" (colon slash) separator in the return parameter to login_page.php, a different vulnerability than CVE-2014-6316.
0
Attacker Value
Unknown
CVE-2014-9571
Disclosure Date: January 26, 2015 (last updated October 05, 2023)
Cross-site scripting (XSS) vulnerability in admin/install.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the (1) admin_username or (2) admin_password parameter.
0
Attacker Value
Unknown
CVE-2014-9573
Disclosure Date: January 26, 2015 (last updated October 05, 2023)
SQL injection vulnerability in manage_user_page.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote administrators with FILE privileges to execute arbitrary SQL commands via the MANTIS_MANAGE_USERS_COOKIE cookie.
0
Attacker Value
Unknown
CVE-2014-9572
Disclosure Date: January 26, 2015 (last updated October 05, 2023)
MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 does not properly restrict access to /*/install.php, which allows remote attackers to obtain database credentials via the install parameter with the value 4.
0
