CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2020-36192
https://notcve.org/view.php?id=CVE-2020-36192
18 Jan 2021 — An issue was discovered in the Source Integration plugin before 2.4.1 for MantisBT. An attacker can gain access to the Summary field of private Issues (either marked as Private, or part of a private Project), if they are attached to an existing Changeset. The information is visible on the view.php page, as well as on the list.php page (a pop-up on the Affected Issues id hyperlink). Additionally, if the attacker has "Update threshold" in the plugin's configuration (set to the "updater" access level by defaul... • https://github.com/mantisbt-plugins/source-integration/issues/344 •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2020-8981
https://notcve.org/view.php?id=CVE-2020-8981
13 Feb 2020 — A cross-site scripting (XSS) vulnerability was discovered in the Source Integration plugin before 1.6.2 and 2.x before 2.3.1 for MantisBT. The repo_delete.php Delete Repository page allows execution of arbitrary code via a repo name (if CSP settings permit it). This is related to CVE-2018-16362. Se detectó una vulnerabilidad de tipo cross-site scripting (XSS) en el plugin Source Integration versiones anteriores a 1.6.2 y versiones 2.x anteriores a 2.3.1, para MantisBT. La página Delete Repository repo_delet... • https://github.com/mantisbt-plugins/source-integration/commit/270675c964c675829fe010f9f0830521dc0835f0 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2018-16362
https://notcve.org/view.php?id=CVE-2018-16362
02 Sep 2018 — An issue was discovered in the Source Integration plugin before 1.5.9 and 2.x before 2.1.5 for MantisBT. A cross-site scripting (XSS) vulnerability in the Manage Repository and Changesets List pages allows execution of arbitrary code (if CSP settings permit it) via repo_manage_page.php or list.php. Se ha descubierto un problema en el plugin Source Integration en versiones anteriores a la 1.5.9 y versiones 2.x anteriores a la 2.1.5 para MantisBT. Una vulnerabilidad Cross-Site Scripting (XSS) en las páginas "... • https://github.com/mantisbt-plugins/source-integration/issues/286 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-6958
https://notcve.org/view.php?id=CVE-2017-6958
17 Mar 2017 — An XSS vulnerability in the MantisBT Source Integration Plugin (before 2.0.2) search result page allows an attacker to inject arbitrary HTML or JavaScript (if MantisBT's CSP settings permit it) by crafting any valid parameter. Una vulnerabilidad de XSS en la página de resultados de búsqueda MantisBT Source Integration Plugin (en versiones anteriores a 2.0.2) permite a un atacante inyectar HTML o JavaScript arbitrario (si la configuración CSP de MantisBT lo permite) creando cualquier parámetro válido. • https://github.com/mantisbt-plugins/source-integration/issues/205 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •