CVE-2018-16362

CVE-2018-16362 affects the Source Integration plugin for MantisBT, vulnerable in versions prior to 1.5.9 and 2.x prior to 2.1.5. The issue is a cross-site scripting (XSS) flaw on the Manage Repository and Changesets List pages, exploitable to run arbitrary code if CSP settings permit it via repo_...

MantisBT Cross-Site Scripting Vulnerability (CNVD-2018-14790)

MantisBT is a Web-based open source defect tracking system of the MantisBT team . The system provides project management and defect tracking services in the form of Web operations. A cross-site scripting vulnerability exists in the managefiltereditpage.php file on the Edit Filter page in MantisBT...

MantisBT 2.1.0 - 2.15.0 'View Filters' And 'Edit Filter' Pages XSS Vulnerabilities - Windows

MantisBT is prone to multiple cross-site scripting XSS vulnerabilities. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

MantisBT 2.1.0 - 2.15.0 'View Filters' And 'Edit Filter' Pages XSS Vulnerabilities - Linux

MantisBT is prone to multiple cross-site scripting XSS vulnerabilities. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

CVE-2018-13055

A cross-site scripting XSS vulnerability in the View Filters page viewfilterspage.php in MantisBT 2.1.0 through 2.15.0 allows remote attackers to inject arbitrary code if CSP settings permit it through a crafted PATHINFO...

Cross site scripting

A cross-site scripting XSS vulnerability in the View Filters page viewfilterspage.php in MantisBT 2.1.0 through 2.15.0 allows remote attackers to inject arbitrary code if CSP settings permit it through a crafted PATHINFO...

CVE-2018-13055

A cross-site scripting XSS vulnerability in the View Filters page viewfilterspage.php in MantisBT 2.1.0 through 2.15.0 allows remote attackers to inject arbitrary code if CSP settings permit it through a crafted PATHINFO...

Cross site scripting

An issue was discovered in managefiltereditpage.php in MantisBT 2.x through 2.15.0. A cross-site scripting XSS vulnerability in the Edit Filter page allows execution of arbitrary code if CSP settings permit it when displaying a filter with a crafted name e.g., 'foobar" onclick="alert1'...

CVE-2018-13055

A cross-site scripting XSS vulnerability in the View Filters page viewfilterspage.php in MantisBT 2.1.0 through 2.15.0 allows remote attackers to inject arbitrary code if CSP settings permit it through a crafted PATHINFO...

CVE-2018-14504

An issue was discovered in managefiltereditpage.php in MantisBT 2.x through 2.15.0. A cross-site scripting XSS vulnerability in the Edit Filter page allows execution of arbitrary code if CSP settings permit it when displaying a filter with a crafted name e.g., 'foobar" onclick="alert1'...

CVE-2018-14504

An issue was discovered in managefiltereditpage.php in MantisBT 2.x through 2.15.0. A cross-site scripting XSS vulnerability in the Edit Filter page allows execution of arbitrary code if CSP settings permit it when displaying a filter with a crafted name e.g., 'foobar" onclick="alert1'...

CVE-2018-14504

An issue was discovered in managefiltereditpage.php in MantisBT 2.x through 2.15.0. A cross-site scripting XSS vulnerability in the Edit Filter page allows execution of arbitrary code if CSP settings permit it when displaying a filter with a crafted name e.g., 'foobar" onclick="alert1'...

CVE-2018-14504

CVE-2018-14504 is an XSS vulnerability in MantisBT, affecting the Edit Filter page (manage_filter_edit_page.php) for MantisBT 2.x up to 2.15.0. A crafted filter name (for example, 'foobar" onclick="alert(1)') can trigger script execution when the filter is displayed, potentially enabling arbitrar...

CVE-2018-13055

CVE-2018-13055 family (MantisBT) : The cross‑site scripting flaw affects MantisBT 2.1.0–2.15.0 (and related advisories) via PATH_INFO on the View Filters page (view_filters_page.php) and related Edit Filter paths, caused by an incomplete fix for this issue. Connected entries reiterate the same XS...

CVE-2018-13055

A cross-site scripting XSS vulnerability in the View Filters page viewfilterspage.php in MantisBT 2.1.0 through 2.15.0 allows remote attackers to inject arbitrary code if CSP settings permit it through a crafted PATHINFO...

CVE-2018-14504

An issue was discovered in managefiltereditpage.php in MantisBT 2.x through 2.15.0. A cross-site scripting XSS vulnerability in the Edit Filter page allows execution of arbitrary code if CSP settings permit it when displaying a filter with a crafted name e.g., 'foobar" onclick="alert1'...

MantisBT 'sql' Parameter SQL Injection Vulnerability (Feb 2018) - Linux

MantisBT is prone to an SQL injection SQLi vulnerability. Note: The vendor disputes the significance of this report because server.php is intended to execute arbitrary SQL statements on behalf of authenticated users from 127.0.0.1, and the issue does not have an authentication bypass...

MantisBT 2.10.0 'view_all_bug_page' Path Disclosure Vulnerability - Windows

MantisBT is prone to a path disclosure vulnerability. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

MantisBT 'sql' Parameter SQL Injection Vulnerability (Feb 2018) - Windows

MantisBT is prone to an SQL injection SQLi vulnerability. Note: The vendor disputes the significance of this report because server.php is intended to execute arbitrary SQL statements on behalf of authenticated users from 127.0.0.1, and the issue does not have an authentication bypass...

MantisBT 2.10.0 'view_all_bug_page' Path Disclosure Vulnerability - Linux

MantisBT is prone to a path disclosure vulnerability. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...