CVE-2011-3358

Multiple cross-site scripting XSS vulnerabilities in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the 1 os, 2 osbuild, or 3 platform parameter to a bugreportpage.php or b bugupdateadvancedpage.php, related to use of the Projax library...

CVE-2011-3578

Cross-site scripting XSS vulnerability in bugactiongroupextpage.php in MantisBT before 1.2.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter, related to bugactiongrouppage.php, a different vulnerability than CVE-2011-3357...

CVE-2011-3356

CVE-2011-3356 affects MantisBT up to 1.2.8, where multiple XSS vulnerabilities exist in config_defaults_inc.php allowing remote script injection via PATH_INFO to pages such as manage_config_email_page.php, manage_config_workflow_page.php, or bugs/plugin.php. The issue stems from input handling in...

CVE-2011-2938

Multiple cross-site scripting XSS vulnerabilities in filterapi.php in MantisBT before 1.2.7 allow remote attackers to inject arbitrary web script or HTML via a parameter, as demonstrated by the projectid parameter to search.php...

CVE-2011-2938

CVE-2011-2938 affects MantisBT prior to 1.2.7, with multiple XSS vulnerabilities in filter_api.php exploitable via the project_id parameter to search.php to inject arbitrary scripts/HTML. OpenVAS and Gentoo/Gentoo GLSA refs corroborate the issue and indicate upgrades to newer MantisBT versions as...

CVE-2011-3356

Multiple cross-site scripting XSS vulnerabilities in configdefaultsinc.php in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO, as demonstrated by the PATHINFO to 1 manageconfigemailpage.php, 2 manageconfigworkflowpage.php, or 3 bugs/plugin.php...

Multiple vulnerabilities in MantisBT

Vulnerability ID: HTB23045 Reference: https://www.htbridge.ch/advisory/multiplevulnerabilitiesinmantisbt.html Product: MantisBT Vendor: www.mantisbt.org http://www.mantisbt.org/ Vulnerable Version: 1.2.7 and probably prior Tested Version: 1.2.7 Vendor Notification: 31 August 2011 Vulnerability...

MantisBT 1.2.7 Cross Site Scripting / Local File Inclusion

Vulnerability ID: HTB23045 Reference: https://www.htbridge.ch/advisory/multiplevulnerabilitiesinmantisbt.html Product: MantisBT Vendor: www.mantisbt.org http://www.mantisbt.org/ Vulnerable Version: 1.2.7 and probably prior Tested Version: 1.2.7 Vendor Notification: 31 August 2011 Vulnerability...

FreeBSD : XSS issue in MantisBT (a83f25df-d775-11e0-8bf1-003067b2972c)

Net.Edit0r from BlACK Hat Group reported an XSS issue in search.php. All MantisBT users including anonymous users that are not logged in to public bug trackers could be impacted by this vulnerability. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in...

Multiple Vulnerabilities in MantisBT

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in MantisBT which could be exploited to perform cross-site scripting attacks, gain access to sensitive information and compromise vulnerable system. 1 Cross-site scripting XSS vulnerabilities in MantisBT:...

MantisBT <= 1.2.6 XSS and SQLi Vulnerabilities

MantisBT is prone to an SQL injection SQLi and a cross-site scripting XSS vulnerability. Copyright C 2011 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later Thi...

MantisBT Cross Site Scripting and SQL Injection Vulnerabilities

MantisBT is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability. Exploiting these issues could allow an attacker to steal cookie- based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying...

XSS issue in MantisBT

Net.Edit0r from BlACK Hat Group reported an XSS issue in search.php. All MantisBT users including anonymous users that are not logged in to public bug trackers could be impacted by this vulnerability...

Mantis Bug Tracker 1.1.8 - Cross-Site Scripting / SQL Injection

source: https://www.securityfocus.com/bid/49235/info MantisBT is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability. Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, o...

Mantis Bug Tracker 1.1.8 - Cross-Site Scripting SQL Injection

Mantis Bug Tracker 1.1.8 - Cross-Site Scripting SQL Injection source: https://www.securityfocus.com/bid/49235/info MantisBT is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability. Exploiting these issues could allow an attacker to steal cookie-based authentication...

MantisBT CMS SQL Injection / Cross Site Scripting

. \ \ | | | / | \ | | / | \ \ / | |/ / / / \ | | \ |/ \ | | / /\ | \ | /\ / / / / / /// .ORG !===========================================================================! Title : MantisBT CMS Multiple VulnerabilitiesSQL/XSS Author : Net.Edit0r [email protected] Homepage :...

MantisBT Multiple Vulnerabilities

This host is running MantisBT and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: gbmantisbtmultvuln.nasl 7015 2017-08-28 11:51:24Z teissa $ MantisBT Multiple Vulnerabilities Authors: Sooraj KS Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net Thi...

MantisBT < 1.2.4 Multiple Vulnerabilities

MantisBT is prone to multiple vulnerabilities. Copyright C 2011 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2010-4349

admin/upgradeunattended.php in MantisBT before 1.2.4 allows remote attackers to obtain sensitive information via an invalid dbtype parameter, which reveals the installation path in an error message, related to an unsafe call by MantisBT to a function in the ADOdb Library for PHP...

CVE-2010-4350

Directory traversal vulnerability in admin/upgradeunattended.php in MantisBT before 1.2.4 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the dbtype parameter, related to an unsafe call by MantisBT to a function in the ADOdb Library for PHP...