CVSS: 4.8EPSS: 0%CPEs: 23EXPL: 1CVE-2017-6973
https://notcve.org/view.php?id=CVE-2017-6973
31 Mar 2017 — A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code through a crafted 'action' parameter. This is fixed in 1.3.8, 2.1.2, and 2.2.2. Una vulnerabilidad XSS en la página Informe de configuración de MantisBT (adm_config_report.php) permite a atacantes remotos inyectar código arbitrario a través de un parámetro 'acción' creado. Esto se fija en 1.3.8, 2.1.2 y 2.2.2. • http://openwall.com/lists/oss-security/2017/03/30/4 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-7222
https://notcve.org/view.php?id=CVE-2017-7222
22 Mar 2017 — A cross-site scripting (XSS) vulnerability in MantisBT before 2.1.1 allows remote attackers to inject arbitrary HTML or JavaScript (if MantisBT's CSP settings permit it) by modifying 'window_title' in the application configuration. This requires privileged access to MantisBT configuration management pages (i.e., administrator access rights) or altering the system configuration file (config_inc.php). Vulnerabilidad de XSS en MantisBT en versiones anteriores a 2.1.1 permite a atacantes remotos inyectar código... • http://github.com/mantisbt/mantisbt/commit/a85b0b96c8ebe3e010d0d016cf88ab3c8bfc196a • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2017-6799
https://notcve.org/view.php?id=CVE-2017-6799
10 Mar 2017 — A cross-site scripting (XSS) vulnerability in view_filters_page.php in MantisBT before 2.2.1 allows remote attackers to inject arbitrary JavaScript via the 'view_type' parameter. Una vulnerabilidad de XSS en view_filters_page.php en MantisBT en versiones anteriores a 2.2.1 permite a atacantes remotos inyectar código JavaScript arbitrario a través del parámetro 'view_type'. • http://mantisbt.org/bugs/view.php?id=22497 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 2CVE-2017-6797
https://notcve.org/view.php?id=CVE-2017-6797
10 Mar 2017 — A cross-site scripting (XSS) vulnerability in bug_change_status_page.php in MantisBT before 1.3.7 and 2.x before 2.2.1 allows remote attackers to inject arbitrary JavaScript via the 'action_type' parameter. Una vulnerabilidad de XSS en bug_change_status_page.php en MantisBT en versiones anteriores a 1.3.7 y 2.x en versiones anteriores a 2.2.1 permite a atacantes remotos inyectar JavaScript arbitrario a través del parámetro 'action_type'. • http://www.mantisbt.org/bugs/view.php?id=22486 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •