PT-2011-1513

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.4 Description The issue is related to a directory traversal vulnerability. It allows remote attackers to include and execute arbitrary local files via a .. dot dot in the db type parameter. This is due to an unsa...

PT-2011-1512

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.4 Description The issue allows remote attackers to obtain sensitive information via an invalid db type parameter. This is related to an unsafe call by MantisBT to a function in the ADOdb Library for PHP, which...

PT-2011-1511

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.4 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the db type parameter in the admin/upgrade unattended.php file. This is related to an...

MantisBT 'db_type' Parameter Local File Inclusion

The MantisBT install on the remote host fails to sanitize user input to the 'dbtype' parameter of the 'admin/upgradeunattended.php' script before using it to include PHP code. Regardless of PHP's 'registerglobals' and 'magicquotesgpc' settings, an unauthenticated attacker can exploit this...

MantisBT <=1.2.3 (db_type) Local File Inclusion Vulnerability

Exploit for php platform in category web applications Vendor: MantisBT Group Product web page: http://www.mantisbt.org Version affected: library/adodb/adodb.inc.php ... 4109: 4110: $file = ADODBDIR."/drivers/adodb-".$db.".inc.php"; 4111: @includeonce$file;...

MantisBT <=1.2.3 (db_type) Cross-Site Scripting & Path Disclosure

Exploit for php platform in category web applications Vendor: MantisBT Group Product web page: http://www.mantisbt.org Version affected: 1.2.4 Summary: MantisBT is a free popular web-based bugtracking system. It is written in the PHP scripting language and works with MySQL, MS SQL, and PostgreSQL...

MantisBT 1.2.3 Cross Site Scripting / Path Disclosure

MantisBT =1.2.3 dbtype Cross-Site Scripting & Path Disclosure Vulnerability Vendor: MantisBT Group Product web page: http://www.mantisbt.org Version affected: 1.2.4 Summary: MantisBT is a free popular web-based bugtracking system. It is written in the PHP scripting language and works with MySQL, ...

MantisBT <=1.2.3 (db_type) Local File Inclusion Vulnerability

Mantis is prone to a local file-include vulnerability because it fails to properly sanitize user supplied input. Input passed through the 'dbtype' parameter GET & POST to upgradeunattended.php script is not properly verified before being used to include files. Mantis is also prone to a cross-site...

MantisBT <=1.2.3 (db_type) Cross-Site Scripting & Path Disclosure Vulnerability

Summary MantisBT is a free popular web-based bugtracking system. It is written in the PHP scripting language and works with MySQL, MS SQL, and PostgreSQL databases and a webserver. MantisBT has been installed on Windows, Linux, Mac OS, OS/2, and others. Almost any web browser should be able to...

MantisBT <=1.2.3 (db_type) Local File Inclusion Vulnerability

Summary MantisBT is a free popular web-based bugtracking system. It is written in the PHP scripting language and works with MySQL, MS SQL, and PostgreSQL databases and a webserver. MantisBT has been installed on Windows, Linux, Mac OS, OS/2, and others. Almost any web browser should be able to...

Mantis Bug Tracker 1.2.3 - 'db_type' Local File Inclusion

MantisBT library/adodb/adodb.inc.php ... 4109: 4110: $file = ADODBDIR."/drivers/adodb-".$db.".inc.php"; 4111: @includeonce$file; ... ==================================================================================== Tested on: Microsoft Windows XP Professional SP3 English Debian GNU/Linux squee...

Mantis Bug Tracker 1.2.3 - 'db_type' Cross-Site Scripting / Full Path Disclosure

MantisBT =1.2.3 dbtype Cross-Site Scripting & Path Disclosure Vulnerability Vendor: MantisBT Group Product web page: http://www.mantisbt.org Version affected: 1.2.4 Summary: MantisBT is a free popular web-based bugtracking system. It is written in the PHP scripting language and works with MySQL, ...

MantisBT 1.2.3 Local File Inclusion

MantisBT library/adodb/adodb.inc.php ... 4109: 4110: $file = ADODBDIR."/drivers/adodb-".$db.".inc.php"; 4111: @includeonce$file; ... ==================================================================================== Tested on: Microsoft Windows XP Professional SP3 English Debian GNU/Linux squee...

Mantis Bug Tracker 1.2.3 - db_type Local File Inclusion

Mantis Bug Tracker 1.2.3 - dbtype Local File Inclusion MantisBT library/adodb/adodb.inc.php ... 4109: 4110: $file = ADODBDIR."/drivers/adodb-".$db.".inc.php"; 4111: @includeonce$file; ... ==================================================================================== Tested on: Microsoft...

Mantis Bug Tracker 1.2.3 - db_type Cross-Site Scripting Full Path Disclosure

Mantis Bug Tracker 1.2.3 - dbtype Cross-Site Scripting Full Path Disclosure MantisBT =1.2.3 dbtype Cross-Site Scripting & Path Disclosure Vulnerability Vendor: MantisBT Group Product web page: http://www.mantisbt.org Version affected: 1.2.4 Summary: MantisBT is a free popular web-based bugtrackin...

MantisBT <= 1.2.3 (db_type) Local File Inclusion Vulnerability

MantisBT is prone to a local file-include vulnerability because it fails to properly sanitize user supplied input. MantisBT is also prone to a cross-site scripting XSS attack. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are...

MantisBT Multiple Cross-site scripting Vulnerabilities

This host is running MantisBT and is prone to multiple cross-site scripting vulnerabilities. OpenVAS Vulnerability Test $Id: gbmantismultxssvuln.nasl 5306 2017-02-16 09:00:16Z teissa $ MantisBT Multiple Cross-site scripting Vulnerabilities Authors: Sooraj KS Copyright: Copyright c 2010 Greenbone...

MantisBT < 1.2.3 Multiple XSS Vulnerabilities

MantisBT is prone to multiple cross-site scripting XSS vulnerabilities. Copyright C 2010 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

MantisBT nusoap/nusoap.php NuSOAP WSDL XSS

The installation of MantisBT on the remote host includes a version of NuSOAP that fails to sanitize user input passed via PHP's $SERVER'PHPSELF' variable to 'nusoap/nusoap.php' via 'soap/mantisconnect.php' before using it to generate dynamic HTML content. An unauthenticated, remote attacker may b...

CVE-2010-3763

Cross-site scripting XSS vulnerability in core/summaryapi.php in MantisBT before 1.2.3 allows remote attackers to inject arbitrary web script or HTML via the Summary field, a different vector than CVE-2010-3303...