CVSS: 5.0EPSS: 0%CPEs: 23EXPL: 1CVE-2014-6387
https://notcve.org/view.php?id=CVE-2014-6387
gpc_api.php in MantisBT 1.2.17 and earlier allows remote attackers to bypass authenticated via a password starting will a null byte, which triggers an unauthenticated bind. gpc_api.php en MantisBT 1.2.17 y anteriores permite a atacantes remotos evadir la autenticación a través de una contraseña que empiece por un byte nulo, lo que provoca un bind no autenticado. • http://www.mantisbt.org/bugs/view.php?id=17640 http://www.openwall.com/lists/oss-security/2014/09/12/11 http://www.openwall.com/lists/oss-security/2014/09/12/14 http://www.openwall.com/lists/oss-security/2014/09/13/1 • CWE-287: Improper Authentication •
CVSS: 5.0EPSS: 1%CPEs: 3EXPL: 2CVE-2013-1883
https://notcve.org/view.php?id=CVE-2013-1883
Mantis Bug Tracker (aka MantisBT) 1.2.12 before 1.2.15 allows remote attackers to cause a denial of service (resource consumption) via a filter using a criteria, text search, and the "any condition" match type. Mantis Bug Tracker (también conocido como MantisBT) 1.2.12 anterior a 1.2.15 permite a atacantes remotos causar una denegación de servicio (consumo de recursos) a través de un filtro que utiliza un criterio, búsqueda de texto y el tipo de coincidencia 'cualquier condición'. • http://www.mantisbt.org/bugs/view.php?id=15573 http://www.openwall.com/lists/oss-security/2013/03/22/2 http://www.securityfocus.com/bid/58626 https://bugzilla.redhat.com/show_bug.cgi?id=924340 https://exchange.xforce.ibmcloud.com/vulnerabilities/83347 https://github.com/mantisbt/mantisbt/commit/d16988c3ca232a7 • CWE-20: Improper Input Validation •
CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2013-0197
https://notcve.org/view.php?id=CVE-2013-0197
Cross-site scripting (XSS) vulnerability in the filter_draw_selection_area2 function in core/filter_api.php in MantisBT 1.2.12 before 1.2.13 allows remote attackers to inject arbitrary web script or HTML via the match_type parameter to bugs/search.php. Vulnerabilidad de XSS en la función filter_draw_selection_area2 en core/filter_api.php en MantisBT 1.2.12 anterior a 1.2.13 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro match_type hacia bugs/search.php. • http://hauntit.blogspot.de/2013/01/en-mantis-bug-tracker-1212-persistent.html http://seclists.org/oss-sec/2013/q1/118 http://seclists.org/oss-sec/2013/q1/125 http://seclists.org/oss-sec/2013/q1/140 http://secunia.com/advisories/51853 http://www.mantisbt.org/bugs/view.php?id=15373 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 2.1EPSS: 0%CPEs: 1EXPL: 0CVE-2013-1810
https://notcve.org/view.php?id=CVE-2013-1810
Multiple cross-site scripting (XSS) vulnerabilities in core/summary_api.php in MantisBT 1.2.12 allow remote authenticated users with manager or administrator permissions to inject arbitrary web script or HTML via a (1) category name in the summary_print_by_category function or (2) project name in the summary_print_by_project function. Múltiples vulnerabilidades de XSS en core/summary_api.php en MantisBT 1.2.12 permiten a usuarios remotos autenticados con permisos de gestor o administrador inyectar secuencias de comandos web o HTML arbitrarios a través del nombre de (1) categoría en la función summary_print_by_category o (2) proyecto en la función summary_print_by_project. • http://seclists.org/oss-sec/2013/q1/127 http://seclists.org/oss-sec/2013/q1/556 http://secunia.com/advisories/51853 http://www.mantisbt.org/bugs/view.php?id=15384 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 1CVE-2014-2238 – MantisBT Admin SQL Injection Arbitrary File Read
https://notcve.org/view.php?id=CVE-2014-2238
SQL injection vulnerability in the manage configuration page (adm_config_report.php) in MantisBT 1.2.13 through 1.2.16 allows remote authenticated administrators to execute arbitrary SQL commands via the filter_config_id parameter. Vulnerabilidad de inyección SQL en la página "manage configuration" (adm_config_report.php) en MantisBT 1.2.13 hasta 1.2.16 permite a administradores remotos autenticados ejecutar comandos SQL arbitrarios a través del parámetro filter_config_id. Versions 1.2.13 through 1.2.16 are vulnerable to a SQL injection attack if an attacker can gain access to administrative credentials. This vuln was fixed in 1.2.17. • http://mantisbt.domainunion.de/bugs/view.php?id=17055 http://seclists.org/oss-sec/2014/q1/456 http://seclists.org/oss-sec/2014/q1/490 http://www.mantisbt.org/blog/?p=288 http://www.securityfocus.com/bid/65903 https://exchange.xforce.ibmcloud.com/vulnerabilities/91563 https://www.mantisbt.org/bugs/view.php?id=17055 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •