CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2020-36192
https://notcve.org/view.php?id=CVE-2020-36192
An issue was discovered in the Source Integration plugin before 2.4.1 for MantisBT. An attacker can gain access to the Summary field of private Issues (either marked as Private, or part of a private Project), if they are attached to an existing Changeset. The information is visible on the view.php page, as well as on the list.php page (a pop-up on the Affected Issues id hyperlink). Additionally, if the attacker has "Update threshold" in the plugin's configuration (set to the "updater" access level by default), then they can link any Issue to a Changeset by entering the Issue's Id, even if they do not have access to it. Se detectó un problema en el plugin Source Integration versiones anteriores a 2.4.1 para MantisBT. • https://github.com/mantisbt-plugins/source-integration/issues/344 •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2020-8981
https://notcve.org/view.php?id=CVE-2020-8981
A cross-site scripting (XSS) vulnerability was discovered in the Source Integration plugin before 1.6.2 and 2.x before 2.3.1 for MantisBT. The repo_delete.php Delete Repository page allows execution of arbitrary code via a repo name (if CSP settings permit it). This is related to CVE-2018-16362. Se detectó una vulnerabilidad de tipo cross-site scripting (XSS) en el plugin Source Integration versiones anteriores a 1.6.2 y versiones 2.x anteriores a 2.3.1, para MantisBT. La página Delete Repository repo_delete.php permite una ejecución de código arbitrario por medio de un nombre repo (si la configuración de CSP lo permite). • https://github.com/mantisbt-plugins/source-integration/commit/270675c964c675829fe010f9f0830521dc0835f0 https://github.com/mantisbt-plugins/source-integration/issues/338 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2018-16362
https://notcve.org/view.php?id=CVE-2018-16362
An issue was discovered in the Source Integration plugin before 1.5.9 and 2.x before 2.1.5 for MantisBT. A cross-site scripting (XSS) vulnerability in the Manage Repository and Changesets List pages allows execution of arbitrary code (if CSP settings permit it) via repo_manage_page.php or list.php. Se ha descubierto un problema en el plugin Source Integration en versiones anteriores a la 1.5.9 y versiones 2.x anteriores a la 2.1.5 para MantisBT. Una vulnerabilidad Cross-Site Scripting (XSS) en las páginas "Manage Repository" y "Changesets List" permite la ejecución de código arbitrario (si lo permite la configuración CSP) mediante repo_manage_page.php o list.php. • https://github.com/mantisbt-plugins/source-integration/issues/286 https://github.com/mantisbt-plugins/source-integration/releases/tag/v1.5.9 https://github.com/mantisbt-plugins/source-integration/releases/tag/v2.1.5 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-6958
https://notcve.org/view.php?id=CVE-2017-6958
An XSS vulnerability in the MantisBT Source Integration Plugin (before 2.0.2) search result page allows an attacker to inject arbitrary HTML or JavaScript (if MantisBT's CSP settings permit it) by crafting any valid parameter. Una vulnerabilidad de XSS en la página de resultados de búsqueda MantisBT Source Integration Plugin (en versiones anteriores a 2.0.2) permite a un atacante inyectar HTML o JavaScript arbitrario (si la configuración CSP de MantisBT lo permite) creando cualquier parámetro válido. • https://github.com/mantisbt-plugins/source-integration/issues/205 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •