Page 13 of 67 results (0.009 seconds)

CVSS: 7.5EPSS: 0%CPEs: 75EXPL: 2

CVE-2014-8554

https://notcve.org/view.php?id=CVE-2014-8554

SQL injection vulnerability in the mc_project_get_attachments function in api/soap/mc_project_api.php in MantisBT before 1.2.18 allows remote attackers to execute arbitrary SQL commands via the project_id parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1609. Una vulnerabilidad de inyección SQL en la función mc_project_get_attachments en api/soap/mc_project_api.php en MantisBT anterior a 1.2.18 permite a atacantes remotos ejecutar comandos SQL arbitrarios a través del parámetro project_id. NOTA: esta vulnerabilidad existe debido a una solución incompleta de CVE-2014-1609. • http://seclists.org/oss-sec/2014/q4/479 http://seclists.org/oss-sec/2014/q4/487 http://secunia.com/advisories/62101 http://www.debian.org/security/2015/dsa-3120 http://www.mantisbt.org/bugs/view.php?id=16880 http://www.mantisbt.org/bugs/view.php?id=17812 http://www.securityfocus.com/bid/70856 https://exchange.xforce.ibmcloud.com/vulnerabilities/98457 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 5.0EPSS: 0%CPEs: 23EXPL: 1

CVE-2014-6387

https://notcve.org/view.php?id=CVE-2014-6387

gpc_api.php in MantisBT 1.2.17 and earlier allows remote attackers to bypass authenticated via a password starting will a null byte, which triggers an unauthenticated bind. gpc_api.php en MantisBT 1.2.17 y anteriores permite a atacantes remotos evadir la autenticación a través de una contraseña que empiece por un byte nulo, lo que provoca un bind no autenticado. • http://www.mantisbt.org/bugs/view.php?id=17640 http://www.openwall.com/lists/oss-security/2014/09/12/11 http://www.openwall.com/lists/oss-security/2014/09/12/14 http://www.openwall.com/lists/oss-security/2014/09/13/1 • CWE-287: Improper Authentication •

CVSS: 5.0EPSS: 1%CPEs: 3EXPL: 2

CVE-2013-1883

https://notcve.org/view.php?id=CVE-2013-1883

Mantis Bug Tracker (aka MantisBT) 1.2.12 before 1.2.15 allows remote attackers to cause a denial of service (resource consumption) via a filter using a criteria, text search, and the "any condition" match type. Mantis Bug Tracker (también conocido como MantisBT) 1.2.12 anterior a 1.2.15 permite a atacantes remotos causar una denegación de servicio (consumo de recursos) a través de un filtro que utiliza un criterio, búsqueda de texto y el tipo de coincidencia 'cualquier condición'. • http://www.mantisbt.org/bugs/view.php?id=15573 http://www.openwall.com/lists/oss-security/2013/03/22/2 http://www.securityfocus.com/bid/58626 https://bugzilla.redhat.com/show_bug.cgi?id=924340 https://exchange.xforce.ibmcloud.com/vulnerabilities/83347 https://github.com/mantisbt/mantisbt/commit/d16988c3ca232a7 • CWE-20: Improper Input Validation •

CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 1

CVE-2014-2238 – MantisBT Admin SQL Injection Arbitrary File Read

https://notcve.org/view.php?id=CVE-2014-2238

SQL injection vulnerability in the manage configuration page (adm_config_report.php) in MantisBT 1.2.13 through 1.2.16 allows remote authenticated administrators to execute arbitrary SQL commands via the filter_config_id parameter. Vulnerabilidad de inyección SQL en la página "manage configuration" (adm_config_report.php) en MantisBT 1.2.13 hasta 1.2.16 permite a administradores remotos autenticados ejecutar comandos SQL arbitrarios a través del parámetro filter_config_id. Versions 1.2.13 through 1.2.16 are vulnerable to a SQL injection attack if an attacker can gain access to administrative credentials. This vuln was fixed in 1.2.17. • http://mantisbt.domainunion.de/bugs/view.php?id=17055 http://seclists.org/oss-sec/2014/q1/456 http://seclists.org/oss-sec/2014/q1/490 http://www.mantisbt.org/blog/?p=288 http://www.securityfocus.com/bid/65903 https://exchange.xforce.ibmcloud.com/vulnerabilities/91563 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 7.5EPSS: 0%CPEs: 21EXPL: 1

CVE-2014-1608

https://notcve.org/view.php?id=CVE-2014-1608

SQL injection vulnerability in the mci_file_get function in api/soap/mc_file_api.php in MantisBT before 1.2.16 allows remote attackers to execute arbitrary SQL commands via a crafted envelope tag in a mc_issue_attachment_get SOAP request. Vulnerabilidad de inyección SQL en la función mci_file_get en api/soap/mc_file_api.php en MantisBT anterior a 1.2.16 permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de una etiqueta envolvente manipulada en una solicitud mc_issue_attachment_get SOAP. • http://osvdb.org/103118 http://secunia.com/advisories/61432 http://www.debian.org/security/2014/dsa-3030 http://www.mantisbt.org/bugs/view.php?id=16879 http://www.ocert.org/advisories/ocert-2014-001.html http://www.securityfocus.com/bid/65445 https://bugzilla.redhat.com/show_bug.cgi?id=1063111 https://github.com/mantisbt/mantisbt/commit/00b4c17088fa56594d85fe46b6c6057bb3421102 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •