Show filters
9 Total Results
Displaying 1-9 of 9
Sort by:
Attacker Value
Unknown
CVE-2014-9701
Disclosure Date: August 09, 2017 (last updated November 26, 2024)
Cross-site scripting (XSS) vulnerability in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the url parameter to permalink_page.php.
0
Attacker Value
Unknown
CVE-2017-7241
Disclosure Date: March 31, 2017 (last updated November 26, 2024)
A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page (move_attachments_page.php, part of admin tools) allows remote attackers to inject arbitrary code through a crafted 'type' parameter, if Content Security Protection (CSP) settings allows it. This is fixed in 1.3.9, 2.1.3, and 2.2.3. Note that this vulnerability is not exploitable if the admin tools directory is removed, as recommended in the "Post-installation and upgrade tasks" of the MantisBT Admin Guide. A reminder to do so is also displayed on the login page.
0
Attacker Value
Unknown
CVE-2017-7309
Disclosure Date: March 31, 2017 (last updated November 26, 2024)
A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted 'config_option' parameter. This is fixed in 1.3.9, 2.1.3, and 2.2.3.
0
Attacker Value
Unknown
CVE-2017-6973
Disclosure Date: March 31, 2017 (last updated November 26, 2024)
A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code through a crafted 'action' parameter. This is fixed in 1.3.8, 2.1.2, and 2.2.2.
0
Attacker Value
Unknown
CVE-2016-6837
Disclosure Date: January 10, 2017 (last updated November 25, 2024)
Cross-site scripting (XSS) vulnerability in MantisBT Filter API in MantisBT versions before 1.2.19, and versions 2.0.0-beta1, 1.3.0-beta1 allows remote attackers to inject arbitrary web script or HTML via the 'view_type' parameter.
0
Attacker Value
Unknown
CVE-2014-9759
Disclosure Date: April 11, 2016 (last updated November 25, 2024)
Incomplete blacklist vulnerability in the config_is_private function in config_api.php in MantisBT 1.3.x before 1.3.0 allows remote attackers to obtain sensitive master salt configuration information via a SOAP API request.
0
Attacker Value
Unknown
CVE-2014-9571
Disclosure Date: January 26, 2015 (last updated October 05, 2023)
Cross-site scripting (XSS) vulnerability in admin/install.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the (1) admin_username or (2) admin_password parameter.
0
Attacker Value
Unknown
CVE-2014-9573
Disclosure Date: January 26, 2015 (last updated October 05, 2023)
SQL injection vulnerability in manage_user_page.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote administrators with FILE privileges to execute arbitrary SQL commands via the MANTIS_MANAGE_USERS_COOKIE cookie.
0
Attacker Value
Unknown
CVE-2014-9572
Disclosure Date: January 26, 2015 (last updated October 05, 2023)
MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 does not properly restrict access to /*/install.php, which allows remote attackers to obtain database credentials via the install parameter with the value 4.
0
