Page 5 of 43 results (0.002 seconds)

CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 1

CVE-2014-9572 – MantisBT 1.2.17 XSS / Improper Access Control / SQL Injection

https://notcve.org/view.php?id=CVE-2014-9572

26 Jan 2015 — MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 does not properly restrict access to /*/install.php, which allows remote attackers to obtain database credentials via the install parameter with the value 4. MantisBT anterior a 1.2.19 y 1.3.x anterior a 1.3.0-beta.2 no restringe correctamente el acceso a /*/install.php, lo que permite a atacantes remotos obtener credenciales de la base de datos a través del parámetro install con el valor 4. MantisBT version 1.2.17 suffers from improper access control, cr... • https://packetstorm.news/files/id/130173 • CWE-284: Improper Access Control •

CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 3

CVE-2014-9573 – MantisBT 1.2.17 XSS / Improper Access Control / SQL Injection

https://notcve.org/view.php?id=CVE-2014-9573

26 Jan 2015 — SQL injection vulnerability in manage_user_page.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote administrators with FILE privileges to execute arbitrary SQL commands via the MANTIS_MANAGE_USERS_COOKIE cookie. Vulnerabilidad de inyección SQL en manage_user_page.php en MantisBT anterior a 1.2.19 y 1.3.x anterior a 1.3.0-beta.2 permite a administradores remotos con privilegios FILE ejecutar comandos SQL arbitrarios a través de la cookie MANTIS_MANAGE_USERS_COOKIE. MantisBT version 1.2... • https://packetstorm.news/files/id/130173 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 3

CVE-2014-9571 – MantisBT 1.2.17 XSS / Improper Access Control / SQL Injection

https://notcve.org/view.php?id=CVE-2014-9571

26 Jan 2015 — Cross-site scripting (XSS) vulnerability in admin/install.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the (1) admin_username or (2) admin_password parameter. Vulnerabilidad de XSS en admin/install.php en MantisBT anterior a 1.2.19 y 1.3.x anterior a 1.3.0-beta.2 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro (1) admin_username o (2) admin_password. MantisBT version 1.... • https://packetstorm.news/files/id/130173 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •