Page 6 of 111 results (0.006 seconds)

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2

CVE-2017-6799

https://notcve.org/view.php?id=CVE-2017-6799

10 Mar 2017 — A cross-site scripting (XSS) vulnerability in view_filters_page.php in MantisBT before 2.2.1 allows remote attackers to inject arbitrary JavaScript via the 'view_type' parameter. Una vulnerabilidad de XSS en view_filters_page.php en MantisBT en versiones anteriores a 2.2.1 permite a atacantes remotos inyectar código JavaScript arbitrario a través del parámetro 'view_type'. • http://mantisbt.org/bugs/view.php?id=22497 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 2

CVE-2017-6797

https://notcve.org/view.php?id=CVE-2017-6797

10 Mar 2017 — A cross-site scripting (XSS) vulnerability in bug_change_status_page.php in MantisBT before 1.3.7 and 2.x before 2.2.1 allows remote attackers to inject arbitrary JavaScript via the 'action_type' parameter. Una vulnerabilidad de XSS en bug_change_status_page.php en MantisBT en versiones anteriores a 1.3.7 y 2.x en versiones anteriores a 2.2.1 permite a atacantes remotos inyectar JavaScript arbitrario a través del parámetro 'action_type'. • http://www.mantisbt.org/bugs/view.php?id=22486 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1

CVE-2016-5364

https://notcve.org/view.php?id=CVE-2016-5364

17 Feb 2017 — Cross-site scripting (XSS) vulnerability in manage_custom_field_edit_page.php in MantisBT 1.2.19 and earlier allows remote attackers to inject arbitrary web script or HTML via the return parameter. Vulnerabilidad de XSS en manage_custom_field_edit_page.php en MantisBT 1.2.19 y versiones anteriores permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro return. • http://www.openwall.com/lists/oss-security/2016/06/11/5 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 4.7EPSS: 0%CPEs: 2EXPL: 0

CVE-2016-7111

https://notcve.org/view.php?id=CVE-2016-7111

17 Feb 2017 — MantisBT before 1.3.1 and 2.x before 2.0.0-beta.2 uses a weak Content Security Policy when using the Gravatar plugin, which allows remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors. MantisBT en versiones anteriores a 1.3.1 y 2.x en versiones anteriores a 2.0.0-beta.2 utiliza una política de seguridad de contenido débil cuando se utiliza el plugin Gravatar, que permite a atacantes remotos realizar ataques de secuencias de comandos de sitios cruzados (XSS) a través de vect... • http://www.openwall.com/lists/oss-security/2016/08/28/1 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0

CVE-2016-6837

https://notcve.org/view.php?id=CVE-2016-6837

10 Jan 2017 — Cross-site scripting (XSS) vulnerability in MantisBT Filter API in MantisBT versions before 1.2.19, and versions 2.0.0-beta1, 1.3.0-beta1 allows remote attackers to inject arbitrary web script or HTML via the 'view_type' parameter. Vulnerabilidad de XSS en MantisBT Filter API en MantisBT en versiones anteriores a 1.2.19 y versiones 2.0.0-beta1, 1.3.0-beta1 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro 'view_type'. • http://www.securityfocus.com/bid/92522 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0

CVE-2014-9759

https://notcve.org/view.php?id=CVE-2014-9759

11 Apr 2016 — Incomplete blacklist vulnerability in the config_is_private function in config_api.php in MantisBT 1.3.x before 1.3.0 allows remote attackers to obtain sensitive master salt configuration information via a SOAP API request. Vulnerabilidad de lista negra incompleta en la función config_is_private en config_api.php en MantisBT 1.3.x en versiones anteriores a 1.3.0 permite a atacantes remotos obtener información sensible de la configuración de la salt maestra a través de una petición API SOAP. • http://sourceforge.net/p/mantisbt/mailman/message/32948048 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 6.1EPSS: 0%CPEs: 21EXPL: 3

CVE-2015-1042 – Mantis BugTracker 1.2.19 Open Redirect

https://notcve.org/view.php?id=CVE-2015-1042

28 Jan 2015 — The string_sanitize_url function in core/string_api.php in MantisBT 1.2.0a3 through 1.2.18 uses an incorrect regular expression, which allows remote attackers to conduct open redirect and phishing attacks via a URL with a ":/" (colon slash) separator in the return parameter to login_page.php, a different vulnerability than CVE-2014-6316. La función string_sanitize_url en core/string_api.php en MantisBT 1.2.0a3 hasta 1.2.18 utiliza una expresión regular incorrecta, lo que permite a atacantes remotos realizar... • https://packetstorm.news/files/id/130142 •

CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 3

CVE-2014-9571 – MantisBT 1.2.17 XSS / Improper Access Control / SQL Injection

https://notcve.org/view.php?id=CVE-2014-9571

26 Jan 2015 — Cross-site scripting (XSS) vulnerability in admin/install.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the (1) admin_username or (2) admin_password parameter. Vulnerabilidad de XSS en admin/install.php en MantisBT anterior a 1.2.19 y 1.3.x anterior a 1.3.0-beta.2 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro (1) admin_username o (2) admin_password. MantisBT version 1.... • https://packetstorm.news/files/id/130173 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 1

CVE-2014-9572 – MantisBT 1.2.17 XSS / Improper Access Control / SQL Injection

https://notcve.org/view.php?id=CVE-2014-9572

26 Jan 2015 — MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 does not properly restrict access to /*/install.php, which allows remote attackers to obtain database credentials via the install parameter with the value 4. MantisBT anterior a 1.2.19 y 1.3.x anterior a 1.3.0-beta.2 no restringe correctamente el acceso a /*/install.php, lo que permite a atacantes remotos obtener credenciales de la base de datos a través del parámetro install con el valor 4. MantisBT version 1.2.17 suffers from improper access control, cr... • https://packetstorm.news/files/id/130173 • CWE-284: Improper Access Control •

CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 3

CVE-2014-9573 – MantisBT 1.2.17 XSS / Improper Access Control / SQL Injection

https://notcve.org/view.php?id=CVE-2014-9573

26 Jan 2015 — SQL injection vulnerability in manage_user_page.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote administrators with FILE privileges to execute arbitrary SQL commands via the MANTIS_MANAGE_USERS_COOKIE cookie. Vulnerabilidad de inyección SQL en manage_user_page.php en MantisBT anterior a 1.2.19 y 1.3.x anterior a 1.3.0-beta.2 permite a administradores remotos con privilegios FILE ejecutar comandos SQL arbitrarios a través de la cookie MANTIS_MANAGE_USERS_COOKIE. MantisBT version 1.2... • https://packetstorm.news/files/id/130173 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •