Cross site scripting

A cross-site scripting XSS vulnerability was discovered in the Source Integration plugin before 1.6.2 and 2.x before 2.3.1 for MantisBT. The repodelete.php Delete Repository page allows execution of arbitrary code via a repo name if CSP settings permit it. This is related to CVE-2018-16362...

CVE-2020-8981

A cross-site scripting XSS vulnerability was discovered in the Source Integration plugin before 1.6.2 and 2.x before 2.3.1 for MantisBT. The repodelete.php Delete Repository page allows execution of arbitrary code via a repo name if CSP settings permit it. This is related to CVE-2018-16362...

CVE-2020-8981

The CVE-2020-8981 entry is linked to the MantisBT Source Integration plugin and is corroborated by multiple sources describing a cross-site scripting (XSS) vulnerability in the Manage Repository and Changesets List pages (via repo_manage_page.php or list.php). The related exploitation path can le...

CVE-2009-2802

MantisBT 1.2.x before 1.2.2 insecurely handles attachments and MIME types. Arbitrary inline attachment rendering could lead to cross-domain scripting or other browser attacks...

CVE-2009-2802

MantisBT 1.2.x before 1.2.2 insecurely handles attachments and MIME types. Arbitrary inline attachment rendering could lead to cross-domain scripting or other browser attacks...

Cross site scripting

MantisBT 1.2.x before 1.2.2 insecurely handles attachments and MIME types. Arbitrary inline attachment rendering could lead to cross-domain scripting or other browser attacks...

CVE-2009-2802

MantisBT 1.2.x before 1.2.2 insecurely handles attachments and MIME types. Arbitrary inline attachment rendering could lead to cross-domain scripting or other browser attacks...

CVE-2009-2802

Affected product: MantisBT 1.2.x prior to 1.2.2. Vulnerability arises from insecure handling of attachments and MIME types, allowing arbitrary inline attachment rendering that could enable cross-domain scripting or other browser attacks. Root cause: improper attachment/MIME processing in the lega...

CVE-2013-1811

An access control issue in MantisBT before 1.2.13 allows users with "Reporter" permissions to change any issue to "New"...

CVE-2013-1811

An access control issue in MantisBT before 1.2.13 allows users with "Reporter" permissions to change any issue to "New"...

Design/Logic Flaw

An access control issue in MantisBT before 1.2.13 allows users with "Reporter" permissions to change any issue to "New"...

CVE-2013-1811

CVE-2013-1811 affects MantisBT prior to 1.2.13, where users with Reporter permissions can change any issue to the New status due to an access-control flaw. The impact is an improper state change/authorization weakness; CVSS metrics in the public entry indicate a MEDIUM base severity (approx. 4.3/...

CVE-2013-1811

An access control issue in MantisBT before 1.2.13 allows users with "Reporter" permissions to change any issue to "New"...

CVE-2013-1934

A cross-site scripting XSS vulnerability in the configuration report page admconfigreport.php in MantisBT 1.2.0rc1 before 1.2.14 allows remote authenticated users to inject arbitrary web script or HTML via a complex value...

CVE-2013-1931

A cross-site scripting XSS vulnerability in MantisBT 1.2.14 allows remote attackers to inject arbitrary web script or HTML via a version, related to deleting a version...

CVE-2013-1930

MantisBT 1.2.12 before 1.2.15 allows authenticated users to by the workflow restriction and close issues...

Cross site scripting

A cross-site scripting XSS vulnerability in MantisBT 1.2.14 allows remote attackers to inject arbitrary web script or HTML via a version, related to deleting a version...

CVE-2013-1931

A cross-site scripting XSS vulnerability in MantisBT 1.2.14 allows remote attackers to inject arbitrary web script or HTML via a version, related to deleting a version...

Design/Logic Flaw

MantisBT 1.2.12 before 1.2.15 allows authenticated users to by the workflow restriction and close issues...

Cross site scripting

A cross-site scripting XSS vulnerability in the configuration report page admconfigreport.php in MantisBT 1.2.13 allows remote authenticated users to inject arbitrary web script or HTML via a project name...