MantisBT Cross Site Scripting and SQL Injection Vulnerabilities

MantisBT is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability. Exploiting these issues could allow an attacker to steal cookie- based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying...

MantisBT <= 1.2.6 XSS and SQLi Vulnerabilities

MantisBT is prone to an SQL injection SQLi and a cross-site scripting XSS vulnerability. Copyright C 2011 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later Thi...

Mantis Bug Tracker 1.1.8 - Cross-Site Scripting SQL Injection

Mantis Bug Tracker 1.1.8 - Cross-Site Scripting SQL Injection source: https://www.securityfocus.com/bid/49235/info MantisBT is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability. Exploiting these issues could allow an attacker to steal cookie-based authentication...

XSS issue in MantisBT

Net.Edit0r from BlACK Hat Group reported an XSS issue in search.php. All MantisBT users including anonymous users that are not logged in to public bug trackers could be impacted by this vulnerability...

MantisBT CMS SQL Injection / Cross Site Scripting

. \ \ | | | / | \ | | / | \ \ / | |/ / / / \ | | \ |/ \ | | / /\ | \ | /\ / / / / / /// .ORG !===========================================================================! Title : MantisBT CMS Multiple VulnerabilitiesSQL/XSS Author : Net.Edit0r [email protected] Homepage :...

Mantis Bug Tracker 1.1.8 - Cross-Site Scripting / SQL Injection

source: https://www.securityfocus.com/bid/49235/info MantisBT is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability. Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, o...

MantisBT Multiple Vulnerabilities

This host is running MantisBT and is prone to multiple vulnerabilities. OpenVAS Vulnerability Test $Id: gbmantisbtmultvuln.nasl 7015 2017-08-28 11:51:24Z teissa $ MantisBT Multiple Vulnerabilities Authors: Sooraj KS Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net Thi...

MantisBT < 1.2.4 Multiple Vulnerabilities

MantisBT is prone to multiple vulnerabilities. Copyright C 2011 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2010-4349

admin/upgradeunattended.php in MantisBT before 1.2.4 allows remote attackers to obtain sensitive information via an invalid dbtype parameter, which reveals the installation path in an error message, related to an unsafe call by MantisBT to a function in the ADOdb Library for PHP...

CVE-2010-4350

Directory traversal vulnerability in admin/upgradeunattended.php in MantisBT before 1.2.4 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the dbtype parameter, related to an unsafe call by MantisBT to a function in the ADOdb Library for PHP...

CVE-2010-4348

Cross-site scripting XSS vulnerability in admin/upgradeunattended.php in MantisBT before 1.2.4 allows remote attackers to inject arbitrary web script or HTML via the dbtype parameter, related to an unsafe call by MantisBT to a function in the ADOdb Library for PHP...

Cross site scripting

Cross-site scripting XSS vulnerability in admin/upgradeunattended.php in MantisBT before 1.2.4 allows remote attackers to inject arbitrary web script or HTML via the dbtype parameter, related to an unsafe call by MantisBT to a function in the ADOdb Library for PHP...

Directory traversal

Directory traversal vulnerability in admin/upgradeunattended.php in MantisBT before 1.2.4 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the dbtype parameter, related to an unsafe call by MantisBT to a function in the ADOdb Library for PHP...

CVE-2010-4349

admin/upgradeunattended.php in MantisBT before 1.2.4 allows remote attackers to obtain sensitive information via an invalid dbtype parameter, which reveals the installation path in an error message, related to an unsafe call by MantisBT to a function in the ADOdb Library for PHP...

CVE-2010-4348

Cross-site scripting XSS vulnerability in admin/upgradeunattended.php in MantisBT before 1.2.4 allows remote attackers to inject arbitrary web script or HTML via the dbtype parameter, related to an unsafe call by MantisBT to a function in the ADOdb Library for PHP...

CVE-2010-4350

Directory traversal vulnerability in admin/upgradeunattended.php in MantisBT before 1.2.4 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the dbtype parameter, related to an unsafe call by MantisBT to a function in the ADOdb Library for PHP...

CVE-2010-4348

Cross-site scripting XSS vulnerability in admin/upgradeunattended.php in MantisBT before 1.2.4 allows remote attackers to inject arbitrary web script or HTML via the dbtype parameter, related to an unsafe call by MantisBT to a function in the ADOdb Library for PHP...

CVE-2010-4349

admin/upgradeunattended.php in MantisBT before 1.2.4 allows remote attackers to obtain sensitive information via an invalid dbtype parameter, which reveals the installation path in an error message, related to an unsafe call by MantisBT to a function in the ADOdb Library for PHP...

CVE-2010-4350

Directory traversal vulnerability in admin/upgradeunattended.php in MantisBT before 1.2.4 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the dbtype parameter, related to an unsafe call by MantisBT to a function in the ADOdb Library for PHP...

CVE-2010-4350

CVE-2010-4350 affects MantisBT prior to 1.2.4 and is a directory traversal flaw in admin/upgrade_unattended.php that allows remote inclusion of local files via db_type, due to unsafe ADOdb usage. Impact per CVSS: partial disclosure/integrity/availability (base 5.1, MEDIUM). Gentoo/OpenVAS advisor...