CVSS: 5.4EPSS: 0%CPEs: 40EXPL: 1CVE-2014-9271 – Debian Security Advisory 3120-1
https://notcve.org/view.php?id=CVE-2014-9271
07 Jan 2015 — Cross-site scripting (XSS) vulnerability in file_download.php in MantisBT before 1.2.18 allows remote authenticated users to inject arbitrary web script or HTML via a Flash file with an image extension, related to inline attachments, as demonstrated by a .swf.jpeg filename. Vulnerabilidad de XSS en file_download.php en MantisBT anterior a 1.2.18 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a través de un fichero Flash con un extensión de imagen, relacionado ... • http://seclists.org/oss-sec/2014/q4/867 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 40EXPL: 0CVE-2014-9272 – Debian Security Advisory 3120-1
https://notcve.org/view.php?id=CVE-2014-9272
07 Jan 2015 — The string_insert_href function in MantisBT 1.2.0a1 through 1.2.x before 1.2.18 does not properly validate the URL protocol, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the javascript:// protocol. La función string_insert_href en MantisBT 1.2.0a1 hasta 1.2.x anterior a 1.2.18 no valida correctamente el protocolo de URLs, lo que permite a atacantes remotos realizar ataques de XSS a través del protocolo javascript://. Multiple security issues have been found in the Mantis b... • http://seclists.org/oss-sec/2014/q4/867 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 5EXPL: 0CVE-2014-8987 – Mantis BugTracker 1.2.17 XSS / DoS / Redirect
https://notcve.org/view.php?id=CVE-2014-8987
05 Jan 2015 — Cross-site scripting (XSS) vulnerability in the "set configuration" box in the Configuration Report page (adm_config_report.php) in MantisBT 1.2.13 through 1.2.17 allows remote administrators to inject arbitrary web script or HTML via the config_option parameter, a different vulnerability than CVE-2014-8986. Vulnerabilidad de XSS en la casilla 'set configuration' en la página Configuration Report (adm_config_report.php) en MantisBT 1.2.13 hasta la versión 1.2.17, permite a administradores remotos inyectar s... • http://www.mantisbt.org/bugs/view.php?id=17870 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-9506
https://notcve.org/view.php?id=CVE-2014-9506
04 Jan 2015 — MantisBT before 1.2.18 does not properly check permissions when sending an email that indicates when a monitored issue is related to another issue, which allows remote authenticated users to obtain sensitive information about restricted issues. MantisBT anterior a 1.2.18 no comprueba correctamente los permisos cuando envía una email que indica cuando un problema monitorizado está relacionado con otro problema, lo que permite a usuarios remotos autenticados obtener información sensible sobre los problemas re... • http://seclists.org/oss-sec/2014/q4/955 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-8553 – Debian Security Advisory 3120-1
https://notcve.org/view.php?id=CVE-2014-8553
17 Dec 2014 — The mci_account_get_array_by_id function in api/soap/mc_account_api.php in MantisBT before 1.2.18 allows remote attackers to obtain sensitive information via a (1) mc_project_get_users, (2) mc_issue_get, (3) mc_filter_get_issues, or (4) mc_project_get_issues SOAP request. La función mci_account_get_array_by_id en api/soap/mc_account_api.php en MantisBT anteriores a 1.2.18, permite a atacantes remotos, obtener información sensible mediante peticiones SOAP (1) mc_project_get_users, (2) mc_issue_get, (3) mc_fi... • http://seclists.org/oss-sec/2014/q4/955 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-9388 – Debian Security Advisory 3120-1
https://notcve.org/view.php?id=CVE-2014-9388
17 Dec 2014 — bug_report.php in MantisBT before 1.2.18 allows remote attackers to assign arbitrary issues via the handler_id parameter. bug_report.php en MantisBT anterior a 1.2.18 permite a atacantes remotos a asignar código arbitrario mediante el parámetro handler_id. Multiple security issues have been found in the Mantis bug tracking system, which may result in phishing, information disclosure, CAPTCHA bypass, SQL injection, cross-site scripting or the execution of arbitrary PHP code. • http://seclists.org/oss-sec/2014/q4/955 • CWE-284: Improper Access Control •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2014-6316 – Debian Security Advisory 3120-1
https://notcve.org/view.php?id=CVE-2014-6316
12 Dec 2014 — core/string_api.php in MantisBT before 1.2.18 does not properly categorize URLs when running under the web root, which allows remote attackers to conduct open redirect and phishing attacks via a crafted URL in the return parameter to login_page.php. core/string_api.php en MantisBT anterior a 1.2.18 no categoriza correctamente las URLs cuando funciona bajo el root web, lo que permite a atacantes remotos realizar ataques de redirección abierta y phishing a través de una URL manipulada en el parámetro return e... • http://seclists.org/oss-sec/2014/q4/931 •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2014-9281 – Debian Security Advisory 3120-1
https://notcve.org/view.php?id=CVE-2014-9281
09 Dec 2014 — Cross-site scripting (XSS) vulnerability in admin/copy_field.php in MantisBT before 1.2.18 allows remote attackers to inject arbitrary web script or HTML via the dest_id field. Vulnerabilidad de XSS en admin/copy_field.php en MantisBT anterior a 1.2.18 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del campo dest_id. Multiple security issues have been found in the Mantis bug tracking system, which may result in phishing, information disclosure, CAPTCHA bypass, SQ... • http://seclists.org/oss-sec/2014/q4/867 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 47EXPL: 0CVE-2014-9270 – Debian Security Advisory 3120-1
https://notcve.org/view.php?id=CVE-2014-9270
08 Dec 2014 — Cross-site scripting (XSS) vulnerability in the projax_array_serialize_for_autocomplete function in core/projax_api.php in MantisBT 1.1.0a3 through 1.2.17 allows remote attackers to inject arbitrary web script or HTML via the "profile/Platform" field. Vulnerabilidad de XSS en la función projax_array_serialize_for_autocomplete en core/projax_api.php en MantisBT 1.1.0a3 hasta 1.2.17 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del campo 'profile/Platform'. Multip... • http://seclists.org/oss-sec/2014/q4/867 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 47EXPL: 0CVE-2014-9279
https://notcve.org/view.php?id=CVE-2014-9279
08 Dec 2014 — The print_test_result function in admin/upgrade_unattended.php in MantisBT 1.1.0a3 through 1.2.x before 1.2.18 allows remote attackers to obtain database credentials via a URL in the hostname parameter and reading the parameters in the response sent to the URL. La función print_test_result en admin/upgrade_unattended.php en MantisBT 1.1.0a3 hasta 1.2.x anterior a 1.2.18 permite a atacantes remotos obtener las credenciales de la base de datos a través de una URL en el parámetro hostname y la lectura de los p... • http://seclists.org/oss-sec/2014/q4/863 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •