CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2018-6526
https://notcve.org/view.php?id=CVE-2018-6526
view_all_bug_page.php in MantisBT 2.10.0-development before 2018-02-02 allows remote attackers to discover the full path via an invalid filter parameter, related to a filter_ensure_valid_filter call in current_user_api.php. En el archivo view_all_bug_page.php en MantisBT versión 2.10.0-desarrollo antes del 02-02-2018, permite a los atacantes remotos detectar la path completa por medio de un parámetro filter no válido, relacionado con una llamada a la función filter_ensure_valid_filter en el archivo current_user_api.php. • http://www.securityfocus.com/bid/103065 https://github.com/mantisbt/mantisbt/commit/de686a9e6d8c909485b87ca09c8f912bf83082f2 https://mantisbt.org/bugs/view.php?id=23921 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-9624
https://notcve.org/view.php?id=CVE-2014-9624
CAPTCHA bypass vulnerability in MantisBT before 1.2.19. Existe una vulnerabilidad de omisión de CAPTCHA en MantisBT en versiones anteriores a la 1.2.19. • http://www.openwall.com/lists/oss-security/2015/01/18/11 http://www.securitytracker.com/id/1031633 https://bugzilla.redhat.com/show_bug.cgi?id=1183593 https://exchange.xforce.ibmcloud.com/vulnerabilities/100213 https://www.mantisbt.org/bugs/changelog_page.php?project=mantisbt&version=1.2.19 https://www.mantisbt.org/bugs/view.php?id=17984 • CWE-287: Improper Authentication •
CVSS: 6.1EPSS: 0%CPEs: 7EXPL: 0CVE-2015-2046
https://notcve.org/view.php?id=CVE-2015-2046
Cross-site scripting (XSS) vulnerability in MantisBT 1.2.13 and later before 1.2.20. Existe una vulnerabilidad de tipo Cross-Site Scripting (XSS) en MantisBT 1.2.13 y posteriores antes de la 1.2.20. • http://www.openwall.com/lists/oss-security/2015/02/21/1 http://www.openwall.com/lists/oss-security/2015/02/21/2 https://bugzilla.redhat.com/show_bug.cgi?id=1191130 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2014-9701
https://notcve.org/view.php?id=CVE-2014-9701
Cross-site scripting (XSS) vulnerability in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the url parameter to permalink_page.php. Una vulnerabilidad de tipo cross-site scripting (XSS) en MantisBT en versiones anteriores a la 1.2.19 y en versiones 1.3.x anteriores a la 1.3.0-beta.2 permite que atacantes remotos inyecten scripts web o HTML mediante el parámetro url a permalink_page.php. • http://www.openwall.com/lists/oss-security/2015/03/15/2 https://bugzilla.redhat.com/show_bug.cgi?id=1202885 https://github.com/mantisbt/mantisbt/commit/d95f070db852614fa18ccca6a4f12f4bffede1fd https://github.com/mantisbt/mantisbt/commit/e7e2b5503580e42db9d91e0d599d61d3ff03c27e https://www.mantisbt.org/bugs/view.php?id=17362#c40613 https://www.mantisbt.org/bugs/view.php?id=19493 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2015-5059
https://notcve.org/view.php?id=CVE-2015-5059
The "Project Documentation" feature in MantisBT 1.2.19 and earlier, when the threshold to access files ($g_view_proj_doc_threshold) is set to ANYBODY, allows remote authenticated users to download attachments linked to arbitrary private projects via a file id number in the file_id parameter to file_download.php. En caso de que el nivel de permiso para acceder a los archivos ($g_view_proj_doc_threshold) se establezca en ANYBODY, la característica "Project Documentation" en las versiones 1.2.19 y anteriores de MantisBT permite a usuarios remotos autenticados descargar adjuntos enlazados con proyectos privados arbitrarios, utilizando un identificador de archivo en el parámetro file_id al file_download.php. • http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163191.html http://www.openwall.com/lists/oss-security/2015/06/25/3 http://www.openwall.com/lists/oss-security/2015/06/25/4 http://www.securityfocus.com/bid/75414 https://bugzilla.redhat.com/show_bug.cgi?id=1237199 https://github.com/mantisbt/mantisbt/commit/a4be76d6e5c4939545d84712c79d3f8f4a108c4f https://github.com/mantisbt/mantisbt/commit/f39cf5251953b468e9d921e1cf2aca3abdb00772 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •