1157 matches found
Cross site scripting
An XSS issue was discovered in MantisBT before 2.25.3. Improper escaping of a Plugin name allows execution of arbitrary code if CSP allows it in managepluginpage.php and managepluginuninstall.php when a crafted plugin is installed...
CVE-2022-26144
An XSS issue was discovered in MantisBT before 2.25.3. Improper escaping of a Plugin name allows execution of arbitrary code if CSP allows it in managepluginpage.php and managepluginuninstall.php when a crafted plugin is installed...
CVE-2022-26144
MantisBT prior to 2.25.3 is affected by an XSS due to improper escaping of a Plugin name in manage_plugin_page.php and manage_plugin_uninstall.php when a crafted plugin is installed. This can enable execution of arbitrary code (if CSP allows it); exploitation requires user interaction according t...
CVE-2022-26144
An XSS issue was discovered in MantisBT before 2.25.3. Improper escaping of a Plugin name allows execution of arbitrary code if CSP allows it in managepluginpage.php and managepluginuninstall.php when a crafted plugin is installed...
MantisBT 跨站脚本漏洞
MantisBT is MantisBT Mantisbt team of a Web-based open source defect tracking system . The system provides project management and defect tracking services in the form of Web operations. A security vulnerability exists in MantisBT versions prior to 2.25.3, which stems from improper escaping of...
MantisBT Default Credentials (HTTP)
The remote MantisBT instance is using known default credentials for the HTTP login. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This...
The vulnerability of the manage_custom_field_edit_page.php component of the MantisBT error tracking system, related to the lack of protective measures for website structures, allows attackers to execute cross-site scripting attacks.
The vulnerability of the MantisBT error tracking system’s managecustomfieldeditpage.php component is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks...
MantisBT Cross-Site Scripting Vulnerability (CNVD-2021-45145)
MantisBT is a lightweight, free and open source, web-based defect tracking system. A cross-site scripting vulnerability exists in managecustomfieldeditpage.php in versions of MantisBT prior to 2.25.2. An attacker can exploit this vulnerability to inject code into hidden input fields...
MantisBT < 2.25.2 XSS Vulnerability - Linux
MantisBT is prone to a cross-site scripting XSS vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software...
MantisBT < 2.25.2 XSS Vulnerability - Windows
MantisBT is prone to a cross-site scripting XSS vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software...
CVE-2021-33557
An XSS issue was discovered in managecustomfieldeditpage.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field...
CVE-2021-33557
An XSS issue was discovered in managecustomfieldeditpage.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field...
Cross site scripting
An XSS issue was discovered in managecustomfieldeditpage.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field...
CVE-2021-33557
An XSS issue was discovered in managecustomfieldeditpage.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field...
CVE-2021-33557
An XSS issue was discovered in managecustomfieldeditpage.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field...
CVE-2021-33557
Issue summary: CVE-2021-33557 is an XSS vulnerability in MantisBT before 2.25.2. The flaw is in manage_custom_field_edit_page.php where the return parameter is echoed unescaped, enabling injection of script into a hidden input field. Affected components/versions: MantisBT up to version 2.25.1 (pr...
MantisBT 跨站脚本漏洞
MantisBT is a lightweight, free and open source, web-based defect tracking system. A cross-site scripting vulnerability exists in managecustomfieldeditpage.php in versions of MantisBT prior to 2.25.2. An attacker can exploit this vulnerability to inject code into hidden input fields...
MantisBT < 2.24.5 Session Hijacking Vulnerability - Linux
MantisBT is prone to a session hijacking vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you c...
MantisBT < 2.24.5 Session Hijacking Vulnerability - Windows
MantisBT is prone to a session hijacking vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you c...
CVE-2009-20001
An issue was discovered in MantisBT before 2.24.5. It associates a unique cookie string with each user. This string is not reset upon logout i.e., the user session is still considered valid and active, allowing an attacker who somehow gained access to a user's cookie to login as them...