1157 matches found
Design/Logic Flaw
An access control issue in MantisBT before 1.2.13 allows users with "Reporter" permissions to change any issue to "New"...
CVE-2013-1811
An access control issue in MantisBT before 1.2.13 allows users with "Reporter" permissions to change any issue to "New"...
CVE-2013-1811
CVE-2013-1811 affects MantisBT prior to 1.2.13, where users with Reporter permissions can change any issue to the New status due to an access-control flaw. The impact is an improper state change/authorization weakness; CVSS metrics in the public entry indicate a MEDIUM base severity (approx. 4.3/...
CVE-2013-1931
A cross-site scripting XSS vulnerability in MantisBT 1.2.14 allows remote attackers to inject arbitrary web script or HTML via a version, related to deleting a version...
CVE-2013-1930
MantisBT 1.2.12 before 1.2.15 allows authenticated users to by the workflow restriction and close issues...
CVE-2013-1934
A cross-site scripting XSS vulnerability in the configuration report page admconfigreport.php in MantisBT 1.2.0rc1 before 1.2.14 allows remote authenticated users to inject arbitrary web script or HTML via a complex value...
Cross site scripting
A cross-site scripting XSS vulnerability in the configuration report page admconfigreport.php in MantisBT 1.2.13 allows remote authenticated users to inject arbitrary web script or HTML via a project name...
CVE-2013-1932
A cross-site scripting XSS vulnerability in the configuration report page admconfigreport.php in MantisBT 1.2.13 allows remote authenticated users to inject arbitrary web script or HTML via a project name...
CVE-2013-1930
MantisBT 1.2.12 before 1.2.15 allows authenticated users to by the workflow restriction and close issues...
Cross site scripting
A cross-site scripting XSS vulnerability in MantisBT 1.2.14 allows remote attackers to inject arbitrary web script or HTML via a version, related to deleting a version...
CVE-2013-1931
A cross-site scripting XSS vulnerability in MantisBT 1.2.14 allows remote attackers to inject arbitrary web script or HTML via a version, related to deleting a version...
CVE-2013-1934
A cross-site scripting XSS vulnerability in the configuration report page admconfigreport.php in MantisBT 1.2.0rc1 before 1.2.14 allows remote authenticated users to inject arbitrary web script or HTML via a complex value...
Design/Logic Flaw
MantisBT 1.2.12 before 1.2.15 allows authenticated users to by the workflow restriction and close issues...
Cross site scripting
A cross-site scripting XSS vulnerability in the configuration report page admconfigreport.php in MantisBT 1.2.0rc1 before 1.2.14 allows remote authenticated users to inject arbitrary web script or HTML via a complex value...
CVE-2013-1934
A cross-site scripting XSS vulnerability in the configuration report page admconfigreport.php in MantisBT 1.2.0rc1 before 1.2.14 allows remote authenticated users to inject arbitrary web script or HTML via a complex value...
CVE-2013-1934
The CVE-2013-1934 issue affects MantisBT 1.2.0rc1 and earlier, where the configuration report page adm_config_report.php allows remote authenticated users to inject arbitrary script/HTML via a complex value, enabling cross-site scripting. Root cause: insufficient input sanitization on the adm_con...
CVE-2013-1932
A cross-site scripting XSS vulnerability in the configuration report page admconfigreport.php in MantisBT 1.2.13 allows remote authenticated users to inject arbitrary web script or HTML via a project name...
CVE-2013-1932
CVE-2013-1932 affects MantisBT 1.2.13. The OpenVAS entries and NVD description confirm a cross-site scripting (XSS) vulnerability in the configuration report page (adm_config_report.php) that allows remote authenticated users to inject arbitrary script/HTML via the project name. The Nessus NASL i...
CVE-2013-1931
A cross-site scripting XSS vulnerability in MantisBT 1.2.14 allows remote attackers to inject arbitrary web script or HTML via a version, related to deleting a version...
CVE-2013-1931
The CVE-2013-1931 entry describes a cross-site scripting (XSS) vulnerability in MantisBT 1.2.14 that allows remote attackers to inject arbitrary web script or HTML via a version, related to deleting a version. The connected documents confirm the affected product/version and the XSS nature but do ...