CVSS: 2.6EPSS: 0%CPEs: 42EXPL: 0CVE-2014-9269
https://notcve.org/view.php?id=CVE-2014-9269
Cross-site scripting (XSS) vulnerability in helper_api.php in MantisBT 1.1.0a1 through 1.2.x before 1.2.18, when Extended project browser is enabled, allows remote attackers to inject arbitrary web script or HTML via the project cookie. Vulnerabilidad de XSS en helper_api.php en MantisBT 1.1.0a1 hasta 1.2.x anterior a 1.2.18, cuando el navegador de proyectos extendidos está habilitado, permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de la cookie de proyectos. • http://seclists.org/oss-sec/2014/q4/867 http://seclists.org/oss-sec/2014/q4/902 http://secunia.com/advisories/62101 http://www.debian.org/security/2015/dsa-3120 https://github.com/mantisbt/mantisbt/commit/511564cc https://www.mantisbt.org/bugs/view.php?id=17890 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 3.5EPSS: 0%CPEs: 5EXPL: 0CVE-2014-8987
https://notcve.org/view.php?id=CVE-2014-8987
Cross-site scripting (XSS) vulnerability in the "set configuration" box in the Configuration Report page (adm_config_report.php) in MantisBT 1.2.13 through 1.2.17 allows remote administrators to inject arbitrary web script or HTML via the config_option parameter, a different vulnerability than CVE-2014-8986. Vulnerabilidad de XSS en la casilla 'set configuration' en la página Configuration Report (adm_config_report.php) en MantisBT 1.2.13 hasta la versión 1.2.17, permite a administradores remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro config_option, una vulnerabilidad diferente a CVE-2014-8986. • http://www.mantisbt.org/bugs/view.php?id=17870 http://www.openwall.com/lists/oss-security/2014/11/14/9 http://www.openwall.com/lists/oss-security/2014/11/15/2 http://www.openwall.com/lists/oss-security/2014/11/15/3 http://www.openwall.com/lists/oss-security/2014/11/15/4 http://www.openwall.com/lists/oss-security/2014/11/19/21 https://github.com/mantisbt/mantisbt/commit/49c3d089 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 3.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-9506
https://notcve.org/view.php?id=CVE-2014-9506
MantisBT before 1.2.18 does not properly check permissions when sending an email that indicates when a monitored issue is related to another issue, which allows remote authenticated users to obtain sensitive information about restricted issues. MantisBT anterior a 1.2.18 no comprueba correctamente los permisos cuando envía una email que indica cuando un problema monitorizado está relacionado con otro problema, lo que permite a usuarios remotos autenticados obtener información sensible sobre los problemas restringidos. • http://seclists.org/oss-sec/2014/q4/955 http://secunia.com/advisories/62101 http://www.debian.org/security/2015/dsa-3120 https://www.mantisbt.org/bugs/changelog_page.php?version_id=191 https://www.mantisbt.org/bugs/view.php?id=9885 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2014-9388
https://notcve.org/view.php?id=CVE-2014-9388
bug_report.php in MantisBT before 1.2.18 allows remote attackers to assign arbitrary issues via the handler_id parameter. bug_report.php en MantisBT anterior a 1.2.18 permite a atacantes remotos a asignar código arbitrario mediante el parámetro handler_id. • http://seclists.org/oss-sec/2014/q4/955 http://secunia.com/advisories/62101 http://www.debian.org/security/2015/dsa-3120 https://www.mantisbt.org/bugs/changelog_page.php?version_id=191 https://www.mantisbt.org/bugs/view.php?id=17878 • CWE-284: Improper Access Control •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2014-8553
https://notcve.org/view.php?id=CVE-2014-8553
The mci_account_get_array_by_id function in api/soap/mc_account_api.php in MantisBT before 1.2.18 allows remote attackers to obtain sensitive information via a (1) mc_project_get_users, (2) mc_issue_get, (3) mc_filter_get_issues, or (4) mc_project_get_issues SOAP request. La función mci_account_get_array_by_id en api/soap/mc_account_api.php en MantisBT anteriores a 1.2.18, permite a atacantes remotos, obtener información sensible mediante peticiones SOAP (1) mc_project_get_users, (2) mc_issue_get, (3) mc_filter_get_issues o (4) mc_project_get_issues. • http://seclists.org/oss-sec/2014/q4/955 http://secunia.com/advisories/62101 http://www.debian.org/security/2015/dsa-3120 https://bugzilla.redhat.com/show_bug.cgi?id=1171783 https://exchange.xforce.ibmcloud.com/vulnerabilities/99257 https://github.com/mantisbt/mantisbt/commit/f779e3d4394a0638d822849863c4098421d911c5 https://www.mantisbt.org/bugs/changelog_page.php?version_id=191 https://www.mantisbt.org/bugs/view.php?id=17243 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •