Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in configdefaultsinc.php in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO, as demonstrated by the PATHINFO to 1 manageconfigemailpage.php, 2 manageconfigworkflowpage.php, or 3 bugs/plugin.php...

CVE-2011-3357

Directory traversal vulnerability in bugactiongroupextpage.php in MantisBT before 1.2.8 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the action parameter, related to bugactiongrouppage.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in filterapi.php in MantisBT before 1.2.7 allow remote attackers to inject arbitrary web script or HTML via a parameter, as demonstrated by the projectid parameter to search.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the 1 os, 2 osbuild, or 3 platform parameter to a bugreportpage.php or b bugupdateadvancedpage.php, related to use of the Projax library...

CVE-2011-3356

Multiple cross-site scripting XSS vulnerabilities in configdefaultsinc.php in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO, as demonstrated by the PATHINFO to 1 manageconfigemailpage.php, 2 manageconfigworkflowpage.php, or 3 bugs/plugin.php...

CVE-2011-2938

Multiple cross-site scripting XSS vulnerabilities in filterapi.php in MantisBT before 1.2.7 allow remote attackers to inject arbitrary web script or HTML via a parameter, as demonstrated by the projectid parameter to search.php...

CVE-2011-3578

Cross-site scripting XSS vulnerability in bugactiongroupextpage.php in MantisBT before 1.2.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter, related to bugactiongrouppage.php, a different vulnerability than CVE-2011-3357...

CVE-2011-2938

CVE-2011-2938 affects MantisBT prior to 1.2.7, with multiple XSS vulnerabilities in filter_api.php exploitable via the project_id parameter to search.php to inject arbitrary scripts/HTML. OpenVAS and Gentoo/Gentoo GLSA refs corroborate the issue and indicate upgrades to newer MantisBT versions as...

CVE-2011-3356

Multiple cross-site scripting XSS vulnerabilities in configdefaultsinc.php in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO, as demonstrated by the PATHINFO to 1 manageconfigemailpage.php, 2 manageconfigworkflowpage.php, or 3 bugs/plugin.php...

CVE-2011-3357

CVE-2011-3357 is a directory traversal (local file inclusion) vulnerability in MantisBT up to version 1.2.8, allowing remote attackers to include and execute arbitrary local files by supplying a .. in the action parameter (via bug_actiongroup_ext_page.php). The issue is caused by insufficient val...

CVE-2011-3357

Directory traversal vulnerability in bugactiongroupextpage.php in MantisBT before 1.2.8 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the action parameter, related to bugactiongrouppage.php...

CVE-2011-3358

CVE-2011-3358 involves multiple cross-site scripting (XSS) weaknesses in MantisBT before 1.2.8, exploitable via the os, os_build, or platform parameters in bug_report_page.php or bug_update_advanced_page.php due to the Projax library. The vulnerability allows remote attackers to inject arbitrary ...

CVE-2011-3578

CVE-2011-3578 is a cross-site scripting (XSS) vulnerability affecting MantisBT prior to 1.2.8 . The issue is triggered via the parameter action in the script bug_actiongroup_ext_page.php, enabling remote attackers to inject arbitrary web script or HTML. The description links this to bug_actiongro...

CVE-2011-2938

Multiple cross-site scripting XSS vulnerabilities in filterapi.php in MantisBT before 1.2.7 allow remote attackers to inject arbitrary web script or HTML via a parameter, as demonstrated by the projectid parameter to search.php...

CVE-2011-3358

Multiple cross-site scripting XSS vulnerabilities in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the 1 os, 2 osbuild, or 3 platform parameter to a bugreportpage.php or b bugupdateadvancedpage.php, related to use of the Projax library...

CVE-2011-3356

CVE-2011-3356 affects MantisBT up to 1.2.8, where multiple XSS vulnerabilities exist in config_defaults_inc.php allowing remote script injection via PATH_INFO to pages such as manage_config_email_page.php, manage_config_workflow_page.php, or bugs/plugin.php. The issue stems from input handling in...

Multiple vulnerabilities in MantisBT

Vulnerability ID: HTB23045 Reference: https://www.htbridge.ch/advisory/multiplevulnerabilitiesinmantisbt.html Product: MantisBT Vendor: www.mantisbt.org http://www.mantisbt.org/ Vulnerable Version: 1.2.7 and probably prior Tested Version: 1.2.7 Vendor Notification: 31 August 2011 Vulnerability...

MantisBT 1.2.7 Cross Site Scripting / Local File Inclusion

Vulnerability ID: HTB23045 Reference: https://www.htbridge.ch/advisory/multiplevulnerabilitiesinmantisbt.html Product: MantisBT Vendor: www.mantisbt.org http://www.mantisbt.org/ Vulnerable Version: 1.2.7 and probably prior Tested Version: 1.2.7 Vendor Notification: 31 August 2011 Vulnerability...

FreeBSD : XSS issue in MantisBT (a83f25df-d775-11e0-8bf1-003067b2972c)

Net.Edit0r from BlACK Hat Group reported an XSS issue in search.php. All MantisBT users including anonymous users that are not logged in to public bug trackers could be impacted by this vulnerability. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

Multiple Vulnerabilities in MantisBT

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in MantisBT which could be exploited to perform cross-site scripting attacks, gain access to sensitive information and compromise vulnerable system. 1 Cross-site scripting XSS vulnerabilities in MantisBT:...