CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2014-9281
https://notcve.org/view.php?id=CVE-2014-9281
Cross-site scripting (XSS) vulnerability in admin/copy_field.php in MantisBT before 1.2.18 allows remote attackers to inject arbitrary web script or HTML via the dest_id field. Vulnerabilidad de XSS en admin/copy_field.php en MantisBT anterior a 1.2.18 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del campo dest_id. • http://seclists.org/oss-sec/2014/q4/867 http://seclists.org/oss-sec/2014/q4/913 http://seclists.org/oss-sec/2014/q4/924 http://secunia.com/advisories/62101 http://www.debian.org/security/2015/dsa-3120 http://www.securityfocus.com/bid/71371 https://exchange.xforce.ibmcloud.com/vulnerabilities/99038 https://github.com/mantisbt/mantisbt/commit/e5fc835a https://www.mantisbt.org/bugs/view.php?id=17876 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 47EXPL: 0CVE-2014-9270
https://notcve.org/view.php?id=CVE-2014-9270
Cross-site scripting (XSS) vulnerability in the projax_array_serialize_for_autocomplete function in core/projax_api.php in MantisBT 1.1.0a3 through 1.2.17 allows remote attackers to inject arbitrary web script or HTML via the "profile/Platform" field. Vulnerabilidad de XSS en la función projax_array_serialize_for_autocomplete en core/projax_api.php en MantisBT 1.1.0a3 hasta 1.2.17 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del campo 'profile/Platform'. • http://seclists.org/oss-sec/2014/q4/867 http://seclists.org/oss-sec/2014/q4/902 http://secunia.com/advisories/62101 http://www.debian.org/security/2015/dsa-3120 http://www.securityfocus.com/bid/71372 https://exchange.xforce.ibmcloud.com/vulnerabilities/99037 https://github.com/mantisbt/mantisbt/commit/0bff06ec https://www.mantisbt.org/bugs/view.php?id=17583 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 47EXPL: 0CVE-2014-9279
https://notcve.org/view.php?id=CVE-2014-9279
The print_test_result function in admin/upgrade_unattended.php in MantisBT 1.1.0a3 through 1.2.x before 1.2.18 allows remote attackers to obtain database credentials via a URL in the hostname parameter and reading the parameters in the response sent to the URL. La función print_test_result en admin/upgrade_unattended.php en MantisBT 1.1.0a3 hasta 1.2.x anterior a 1.2.18 permite a atacantes remotos obtener las credenciales de la base de datos a través de una URL en el parámetro hostname y la lectura de los parámetros en la respuesta enviada a la URL. • http://seclists.org/oss-sec/2014/q4/863 http://www.mantisbt.org/bugs/view.php?id=17877 http://www.securityfocus.com/bid/71359 https://exchange.xforce.ibmcloud.com/vulnerabilities/99031 https://github.com/mantisbt/mantisbt/commit/0826cef8 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 3%CPEs: 1EXPL: 1CVE-2014-9280
https://notcve.org/view.php?id=CVE-2014-9280
The current_user_get_bug_filter function in core/current_user_api.php in MantisBT before 1.2.18 allows remote attackers to execute arbitrary PHP code via the filter parameter. La función current_user_get_bug_filter en core/current_user_api.php en MantisBT anterior a 1.2.18 permite a atacantes remotos ejecutar código PHP arbitrario a través del parámetro filter. • http://seclists.org/oss-sec/2014/q4/864 http://seclists.org/oss-sec/2014/q4/923 http://secunia.com/advisories/62101 http://www.debian.org/security/2015/dsa-3120 http://www.mantisbt.org/bugs/view.php?id=17875 http://www.securityfocus.com/bid/71361 https://exchange.xforce.ibmcloud.com/vulnerabilities/99016 https://github.com/mantisbt/mantisbt/commit/599364b2 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2014-9117
https://notcve.org/view.php?id=CVE-2014-9117
MantisBT before 1.2.18 uses the public_key parameter value as the key to the CAPTCHA answer, which allows remote attackers to bypass the CAPTCHA protection mechanism by leveraging knowledge of a CAPTCHA answer for a public_key parameter value, as demonstrated by E4652 for the public_key value 0. MantisBT anterior a 1.2.18 utiliza el valor del parámetro public_key como la clave para la respuesta CAPTCHA, lo que permite a atacantes remotos evadir el mecanismo de protección CAPTCHA mediante el aprovechamiento de conocimiento de una respuesta CAPTCHA para un valor del parámetro public_key, tal y como fue demostrado por E4652 por el valor public_key 0. • http://secunia.com/advisories/62101 http://www.debian.org/security/2015/dsa-3120 http://www.openwall.com/lists/oss-security/2014/11/26/19 http://www.openwall.com/lists/oss-security/2014/11/27/8 http://www.securityfocus.com/bid/71321 https://exchange.xforce.ibmcloud.com/vulnerabilities/99004 https://github.com/mantisbt/mantisbt/commit/7bb78e45 https://www.mantisbt.org/bugs/view.php?id=17811 • CWE-284: Improper Access Control •