CVE-2021-33557

An XSS issue was discovered in managecustomfieldeditpage.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field...

CVE-2021-33557

An XSS issue was discovered in managecustomfieldeditpage.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field...

Cross site scripting

An XSS issue was discovered in managecustomfieldeditpage.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field...

CVE-2021-33557

An XSS issue was discovered in managecustomfieldeditpage.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field...

CVE-2021-33557

An XSS issue was discovered in managecustomfieldeditpage.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field...

CVE-2021-33557

Issue summary: CVE-2021-33557 is an XSS vulnerability in MantisBT before 2.25.2. The flaw is in manage_custom_field_edit_page.php where the return parameter is echoed unescaped, enabling injection of script into a hidden input field. Affected components/versions: MantisBT up to version 2.25.1 (pr...

MantisBT 跨站脚本漏洞

MantisBT is a lightweight, free and open source, web-based defect tracking system. A cross-site scripting vulnerability exists in managecustomfieldeditpage.php in versions of MantisBT prior to 2.25.2. An attacker can exploit this vulnerability to inject code into hidden input fields...

MantisBT < 2.24.5 Session Hijacking Vulnerability - Windows

MantisBT is prone to a session hijacking vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you c...

MantisBT < 2.24.5 Session Hijacking Vulnerability - Linux

MantisBT is prone to a session hijacking vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you c...

CVE-2009-20001

An issue was discovered in MantisBT before 2.24.5. It associates a unique cookie string with each user. This string is not reset upon logout i.e., the user session is still considered valid and active, allowing an attacker who somehow gained access to a user's cookie to login as them...

Design/Logic Flaw

An issue was discovered in MantisBT before 2.24.5. It associates a unique cookie string with each user. This string is not reset upon logout i.e., the user session is still considered valid and active, allowing an attacker who somehow gained access to a user's cookie to login as them...

CVE-2009-20001

An issue was discovered in MantisBT before 2.24.5. It associates a unique cookie string with each user. This string is not reset upon logout i.e., the user session is still considered valid and active, allowing an attacker who somehow gained access to a user's cookie to login as them...

CVE-2009-20001

CVE-2009-20001 affects MantisBT prior to 2.24.5. The issue is that a unique cookie string assigned per user is not reset on logout, so a stolen/compromised cookie may keep the session valid and allow an attacker to log in as the victim. The description and connected records consistently state thi...

MantisBT Cross-Site Scripting Vulnerability (CNVD-2021-14399)

MantisBT is MantisBT Mantisbt team of a Web-based open source defect tracking system . The system provides project management and defect tracking services in the form of Web operations. A security vulnerability exists in MantisBT 2.24.3 and earlier versions, which stems from a custom field name n...

CVE-2020-35571

An issue was discovered in MantisBT through 2.24.3. In the helperensureconfirmed call in managecustomfieldupdate.php, the custom field name is not sanitized. This may be problematic depending on CSP settings...

CVE-2020-35571

An issue was discovered in MantisBT through 2.24.3. In the helperensureconfirmed call in managecustomfieldupdate.php, the custom field name is not sanitized. This may be problematic depending on CSP settings...

Code injection

An issue was discovered in MantisBT through 2.24.3. In the helperensureconfirmed call in managecustomfieldupdate.php, the custom field name is not sanitized. This may be problematic depending on CSP settings...

CVE-2020-35571

MantisBT

CVE-2020-35571

An issue was discovered in MantisBT through 2.24.3. In the helperensureconfirmed call in managecustomfieldupdate.php, the custom field name is not sanitized. This may be problematic depending on CSP settings...

MantisBT 跨站脚本漏洞

MantisBT is MantisBT Mantisbt team of a Web-based open source defect tracking system . The system provides project management and defect tracking services in the form of Web operations. A security vulnerability exists in MantisBT 2.24.3 and earlier versions, which stems from a custom field name n...