CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2018-17783
https://notcve.org/view.php?id=CVE-2018-17783
A cross-site scripting (XSS) vulnerability in the Edit Filter page (manage_filter_edit page.php) in MantisBT 2.1.0 through 2.17.1 allows remote attackers (if access rights permit it) to inject arbitrary code (if CSP settings permit it) through a crafted project name. Una vulnerabilidad de Cross-Site Scripting (XSS) en la página Edit Filter (manage_filter_edit page.php) en MantisBT, desde la versión 2.1.0 hasta la 2.17.1, permite que los atacantes remotos (si los derechos de acceso lo permiten) inyecten código arbitrario (si la configuración CSP lo permite) mediante un nombre de proyecto manipulado. • https://mantisbt.org/blog/archives/mantisbt/613 https://mantisbt.org/bugs/view.php?id=24814 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2018-14504
https://notcve.org/view.php?id=CVE-2018-14504
An issue was discovered in manage_filter_edit_page.php in MantisBT 2.x through 2.15.0. A cross-site scripting (XSS) vulnerability in the Edit Filter page allows execution of arbitrary code (if CSP settings permit it) when displaying a filter with a crafted name (e.g., 'foobar" onclick="alert(1)'). Se ha descubierto un problema en manage_filter_edit_page.php en MantisBT en versiones 2.x hasta la versión 2.15.0. Una vulnerabilidad Cross-Site Scripting (XSS) en la página Edit Filter permite la ejecución de código arbitrario (si la configuración CSP lo permite) al mostrar un filtro con un nombre manipulado (p.ej. 'foobar" onclick="alert(1)'). • http://github.com/mantisbt/mantisbt/commit/8b5fa243dbf04344a55fe880135ec149fc1f439f https://mantisbt.org/blog/archives/mantisbt/602 https://mantisbt.org/bugs/view.php?id=24608 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-13055 – Mantis 2.11.1 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2018-13055
A cross-site scripting (XSS) vulnerability in the View Filters page (view_filters_page.php) in MantisBT 2.1.0 through 2.15.0 allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted PATH_INFO. Una vulnerabilidad de Cross-Site Scripting (XSS) en la página View Filters (view_filters_page.php) en MantisBT, desde la versión 2.1.0 hasta la 2.15.0, permite que los atacantes remotos inyecten código arbitrario (si la configuración CSP lo permite) mediante un PATH_INFO manipulado. Mantis version 2.11.1 suffers from a cross site scripting vulnerability. • http://github.com/mantisbt/mantisbt/commit/4efac90ed89a5c009108b641e2e95683791a165a https://mantisbt.org/blog/archives/mantisbt/602 https://mantisbt.org/bugs/view.php?id=24580 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2018-6526
https://notcve.org/view.php?id=CVE-2018-6526
view_all_bug_page.php in MantisBT 2.10.0-development before 2018-02-02 allows remote attackers to discover the full path via an invalid filter parameter, related to a filter_ensure_valid_filter call in current_user_api.php. En el archivo view_all_bug_page.php en MantisBT versión 2.10.0-desarrollo antes del 02-02-2018, permite a los atacantes remotos detectar la path completa por medio de un parámetro filter no válido, relacionado con una llamada a la función filter_ensure_valid_filter en el archivo current_user_api.php. • http://www.securityfocus.com/bid/103065 https://github.com/mantisbt/mantisbt/commit/de686a9e6d8c909485b87ca09c8f912bf83082f2 https://mantisbt.org/bugs/view.php?id=23921 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.1EPSS: 0%CPEs: 18EXPL: 1CVE-2017-12062
https://notcve.org/view.php?id=CVE-2017-12062
An XSS issue was discovered in manage_user_page.php in MantisBT 2.x before 2.5.2. The 'filter' field is not sanitized before being rendered in the Manage User page, allowing remote attackers to execute arbitrary JavaScript code if CSP is disabled. Se detectó una vulnerabilidad de tipo Cross-Site Scripting (XSS) en manage_user_page.php en MantisBT en sus versiones 2.X anteriores a la 2.5.2. El campo "filter" no se sanitiza antes de que se renderice en la página Manage User, permitiendo a los atacantes remotos ejecutar código JavaScript arbitrario si se deshabilita la política de seguridad de contenido (CSP). • http://openwall.com/lists/oss-security/2017/08/01/1 http://openwall.com/lists/oss-security/2017/08/01/2 http://www.securitytracker.com/id/1039030 https://github.com/mantisbt/mantisbt/commit/9b5b71dadbeeeec27efea59f562ac5bd6d2673b7 https://mantisbt.org/bugs/view.php?id=23166 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •