MantisBT 1.2.3 Local File Inclusion

MantisBT library/adodb/adodb.inc.php ... 4109: 4110: $file = ADODBDIR."/drivers/adodb-".$db.".inc.php"; 4111: @includeonce$file; ... ==================================================================================== Tested on: Microsoft Windows XP Professional SP3 English Debian GNU/Linux squee...

MantisBT <= 1.2.3 (db_type) Local File Inclusion Vulnerability

MantisBT is prone to a local file-include vulnerability because it fails to properly sanitize user supplied input. MantisBT is also prone to a cross-site scripting XSS attack. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are...

Mantis Bug Tracker 1.2.3 - db_type Cross-Site Scripting Full Path Disclosure

Mantis Bug Tracker 1.2.3 - dbtype Cross-Site Scripting Full Path Disclosure MantisBT =1.2.3 dbtype Cross-Site Scripting & Path Disclosure Vulnerability Vendor: MantisBT Group Product web page: http://www.mantisbt.org Version affected: 1.2.4 Summary: MantisBT is a free popular web-based bugtrackin...

MantisBT <=1.2.3 (db_type) Local File Inclusion Vulnerability

Mantis is prone to a local file-include vulnerability because it fails to properly sanitize user supplied input. Input passed through the 'dbtype' parameter GET & POST to upgradeunattended.php script is not properly verified before being used to include files. Mantis is also prone to a cross-site...

Mantis Bug Tracker 1.2.3 - 'db_type' Cross-Site Scripting / Full Path Disclosure

MantisBT =1.2.3 dbtype Cross-Site Scripting & Path Disclosure Vulnerability Vendor: MantisBT Group Product web page: http://www.mantisbt.org Version affected: 1.2.4 Summary: MantisBT is a free popular web-based bugtracking system. It is written in the PHP scripting language and works with MySQL, ...

MantisBT Multiple Cross-site scripting Vulnerabilities

This host is running MantisBT and is prone to multiple cross-site scripting vulnerabilities. OpenVAS Vulnerability Test $Id: gbmantismultxssvuln.nasl 5306 2017-02-16 09:00:16Z teissa $ MantisBT Multiple Cross-site scripting Vulnerabilities Authors: Sooraj KS Copyright: Copyright c 2010 Greenbone...

MantisBT < 1.2.3 Multiple XSS Vulnerabilities

MantisBT is prone to multiple cross-site scripting XSS vulnerabilities. Copyright C 2010 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

MantisBT nusoap/nusoap.php NuSOAP WSDL XSS

The installation of MantisBT on the remote host includes a version of NuSOAP that fails to sanitize user input passed via PHP's $SERVER'PHPSELF' variable to 'nusoap/nusoap.php' via 'soap/mantisconnect.php' before using it to generate dynamic HTML content. An unauthenticated, remote attacker may b...

CVE-2010-3763

Cross-site scripting XSS vulnerability in core/summaryapi.php in MantisBT before 1.2.3 allows remote attackers to inject arbitrary web script or HTML via the Summary field, a different vector than CVE-2010-3303...

CVE-2010-3303

Multiple cross-site scripting XSS vulnerabilities in MantisBT before 1.2.3 allow remote authenticated administrators to inject arbitrary web script or HTML via 1 a plugin name, related to managepluginuninstall.php; 2 an enumeration value or 3 a String value of a custom field, related to...

CVE-2010-3763

Cross-site scripting XSS vulnerability in core/summaryapi.php in MantisBT before 1.2.3 allows remote attackers to inject arbitrary web script or HTML via the Summary field, a different vector than CVE-2010-3303...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in MantisBT before 1.2.3 allow remote authenticated administrators to inject arbitrary web script or HTML via 1 a plugin name, related to managepluginuninstall.php; 2 an enumeration value or 3 a String value of a custom field, related to...

CVE-2010-3303

Multiple cross-site scripting XSS vulnerabilities in MantisBT before 1.2.3 allow remote authenticated administrators to inject arbitrary web script or HTML via 1 a plugin name, related to managepluginuninstall.php; 2 an enumeration value or 3 a String value of a custom field, related to...

Cross site scripting

Cross-site scripting XSS vulnerability in core/summaryapi.php in MantisBT before 1.2.3 allows remote attackers to inject arbitrary web script or HTML via the Summary field, a different vector than CVE-2010-3303...

CVE-2010-3303

CVE-2010-3303 affects MantisBT prior to 1.2.3. Multiple XSS vulnerabilities allow a remote authenticated administrator to inject arbitrary script/HTML via (1) plugin name (manage_plugin_uninstall.php), (2) an enumeration value, (3) a String value of a custom field (core/cfdefs/cfdef_standard.php)...

CVE-2010-3303

Multiple cross-site scripting XSS vulnerabilities in MantisBT before 1.2.3 allow remote authenticated administrators to inject arbitrary web script or HTML via 1 a plugin name, related to managepluginuninstall.php; 2 an enumeration value or 3 a String value of a custom field, related to...

CVE-2010-3763

CVE-2010-3763 is an XSS vulnerability in MantisBT’s core/summary_api.php that allows injection of arbitrary script/HTML via the Summary field in versions before 1.2.3. Impact aligns with a partial integrity exposure (I:P) per CVSS, with no confidentiality or availability impact. The issue is addr...

CVE-2010-3763

Cross-site scripting XSS vulnerability in core/summaryapi.php in MantisBT before 1.2.3 allows remote attackers to inject arbitrary web script or HTML via the Summary field, a different vector than CVE-2010-3303...

NuSOAP 0.9.5 'nusoap.php' XSS Vulnerability

NuSOAP is prone to a cross-site scripting XSS vulnerability. Copyright C 2010 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software;...

CVE-2010-3070

Cross-site scripting XSS vulnerability in NuSOAP 0.9.5, as used in MantisBT and other products, allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to an arbitrary PHP script that uses NuSOAP classes...