CVSS: 6.1EPSS: 0%CPEs: 21EXPL: 3CVE-2015-1042 – Mantis BugTracker 1.2.19 Open Redirect
https://notcve.org/view.php?id=CVE-2015-1042
28 Jan 2015 — The string_sanitize_url function in core/string_api.php in MantisBT 1.2.0a3 through 1.2.18 uses an incorrect regular expression, which allows remote attackers to conduct open redirect and phishing attacks via a URL with a ":/" (colon slash) separator in the return parameter to login_page.php, a different vulnerability than CVE-2014-6316. La función string_sanitize_url en core/string_api.php en MantisBT 1.2.0a3 hasta 1.2.18 utiliza una expresión regular incorrecta, lo que permite a atacantes remotos realizar... • https://packetstorm.news/files/id/130142 •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 3CVE-2014-9571 – MantisBT 1.2.17 XSS / Improper Access Control / SQL Injection
https://notcve.org/view.php?id=CVE-2014-9571
26 Jan 2015 — Cross-site scripting (XSS) vulnerability in admin/install.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the (1) admin_username or (2) admin_password parameter. Vulnerabilidad de XSS en admin/install.php en MantisBT anterior a 1.2.19 y 1.3.x anterior a 1.3.0-beta.2 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro (1) admin_username o (2) admin_password. MantisBT version 1.... • https://packetstorm.news/files/id/130173 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.1EPSS: 0%CPEs: 2EXPL: 1CVE-2014-9572 – MantisBT 1.2.17 XSS / Improper Access Control / SQL Injection
https://notcve.org/view.php?id=CVE-2014-9572
26 Jan 2015 — MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 does not properly restrict access to /*/install.php, which allows remote attackers to obtain database credentials via the install parameter with the value 4. MantisBT anterior a 1.2.19 y 1.3.x anterior a 1.3.0-beta.2 no restringe correctamente el acceso a /*/install.php, lo que permite a atacantes remotos obtener credenciales de la base de datos a través del parámetro install con el valor 4. MantisBT version 1.2.17 suffers from improper access control, cr... • https://packetstorm.news/files/id/130173 • CWE-284: Improper Access Control •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 3CVE-2014-9573 – MantisBT 1.2.17 XSS / Improper Access Control / SQL Injection
https://notcve.org/view.php?id=CVE-2014-9573
26 Jan 2015 — SQL injection vulnerability in manage_user_page.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote administrators with FILE privileges to execute arbitrary SQL commands via the MANTIS_MANAGE_USERS_COOKIE cookie. Vulnerabilidad de inyección SQL en manage_user_page.php en MantisBT anterior a 1.2.19 y 1.3.x anterior a 1.3.0-beta.2 permite a administradores remotos con privilegios FILE ejecutar comandos SQL arbitrarios a través de la cookie MANTIS_MANAGE_USERS_COOKIE. MantisBT version 1.2... • https://packetstorm.news/files/id/130173 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 42EXPL: 0CVE-2014-9269 – Debian Security Advisory 3120-1
https://notcve.org/view.php?id=CVE-2014-9269
07 Jan 2015 — Cross-site scripting (XSS) vulnerability in helper_api.php in MantisBT 1.1.0a1 through 1.2.x before 1.2.18, when Extended project browser is enabled, allows remote attackers to inject arbitrary web script or HTML via the project cookie. Vulnerabilidad de XSS en helper_api.php en MantisBT 1.1.0a1 hasta 1.2.x anterior a 1.2.18, cuando el navegador de proyectos extendidos está habilitado, permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de la cookie de proyectos. Mult... • http://seclists.org/oss-sec/2014/q4/867 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 40EXPL: 1CVE-2014-9271 – Debian Security Advisory 3120-1
https://notcve.org/view.php?id=CVE-2014-9271
07 Jan 2015 — Cross-site scripting (XSS) vulnerability in file_download.php in MantisBT before 1.2.18 allows remote authenticated users to inject arbitrary web script or HTML via a Flash file with an image extension, related to inline attachments, as demonstrated by a .swf.jpeg filename. Vulnerabilidad de XSS en file_download.php en MantisBT anterior a 1.2.18 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a través de un fichero Flash con un extensión de imagen, relacionado ... • http://seclists.org/oss-sec/2014/q4/867 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 40EXPL: 0CVE-2014-9272 – Debian Security Advisory 3120-1
https://notcve.org/view.php?id=CVE-2014-9272
07 Jan 2015 — The string_insert_href function in MantisBT 1.2.0a1 through 1.2.x before 1.2.18 does not properly validate the URL protocol, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the javascript:// protocol. La función string_insert_href en MantisBT 1.2.0a1 hasta 1.2.x anterior a 1.2.18 no valida correctamente el protocolo de URLs, lo que permite a atacantes remotos realizar ataques de XSS a través del protocolo javascript://. Multiple security issues have been found in the Mantis b... • http://seclists.org/oss-sec/2014/q4/867 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 5EXPL: 0CVE-2014-8987 – Mantis BugTracker 1.2.17 XSS / DoS / Redirect
https://notcve.org/view.php?id=CVE-2014-8987
05 Jan 2015 — Cross-site scripting (XSS) vulnerability in the "set configuration" box in the Configuration Report page (adm_config_report.php) in MantisBT 1.2.13 through 1.2.17 allows remote administrators to inject arbitrary web script or HTML via the config_option parameter, a different vulnerability than CVE-2014-8986. Vulnerabilidad de XSS en la casilla 'set configuration' en la página Configuration Report (adm_config_report.php) en MantisBT 1.2.13 hasta la versión 1.2.17, permite a administradores remotos inyectar s... • http://www.mantisbt.org/bugs/view.php?id=17870 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-9506
https://notcve.org/view.php?id=CVE-2014-9506
04 Jan 2015 — MantisBT before 1.2.18 does not properly check permissions when sending an email that indicates when a monitored issue is related to another issue, which allows remote authenticated users to obtain sensitive information about restricted issues. MantisBT anterior a 1.2.18 no comprueba correctamente los permisos cuando envía una email que indica cuando un problema monitorizado está relacionado con otro problema, lo que permite a usuarios remotos autenticados obtener información sensible sobre los problemas re... • http://seclists.org/oss-sec/2014/q4/955 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-8553 – Debian Security Advisory 3120-1
https://notcve.org/view.php?id=CVE-2014-8553
17 Dec 2014 — The mci_account_get_array_by_id function in api/soap/mc_account_api.php in MantisBT before 1.2.18 allows remote attackers to obtain sensitive information via a (1) mc_project_get_users, (2) mc_issue_get, (3) mc_filter_get_issues, or (4) mc_project_get_issues SOAP request. La función mci_account_get_array_by_id en api/soap/mc_account_api.php en MantisBT anteriores a 1.2.18, permite a atacantes remotos, obtener información sensible mediante peticiones SOAP (1) mc_project_get_users, (2) mc_issue_get, (3) mc_fi... • http://seclists.org/oss-sec/2014/q4/955 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •