1157 matches found
CVE-2018-14504
An issue was discovered in managefiltereditpage.php in MantisBT 2.x through 2.15.0. A cross-site scripting XSS vulnerability in the Edit Filter page allows execution of arbitrary code if CSP settings permit it when displaying a filter with a crafted name e.g., 'foobar" onclick="alert1'...
CVE-2018-14504
An issue was discovered in managefiltereditpage.php in MantisBT 2.x through 2.15.0. A cross-site scripting XSS vulnerability in the Edit Filter page allows execution of arbitrary code if CSP settings permit it when displaying a filter with a crafted name e.g., 'foobar" onclick="alert1'...
CVE-2018-13055
A cross-site scripting XSS vulnerability in the View Filters page viewfilterspage.php in MantisBT 2.1.0 through 2.15.0 allows remote attackers to inject arbitrary code if CSP settings permit it through a crafted PATHINFO...
CVE-2018-14504
An issue was discovered in managefiltereditpage.php in MantisBT 2.x through 2.15.0. A cross-site scripting XSS vulnerability in the Edit Filter page allows execution of arbitrary code if CSP settings permit it when displaying a filter with a crafted name e.g., 'foobar" onclick="alert1'...
CVE-2018-14504
CVE-2018-14504 is an XSS vulnerability in MantisBT, affecting the Edit Filter page (manage_filter_edit_page.php) for MantisBT 2.x up to 2.15.0. A crafted filter name (for example, 'foobar" onclick="alert(1)') can trigger script execution when the filter is displayed, potentially enabling arbitrar...
CVE-2018-13055
CVE-2018-13055 family (MantisBT) : The cross‑site scripting flaw affects MantisBT 2.1.0–2.15.0 (and related advisories) via PATH_INFO on the View Filters page (view_filters_page.php) and related Edit Filter paths, caused by an incomplete fix for this issue. Connected entries reiterate the same XS...
MantisBT 'sql' Parameter SQL Injection Vulnerability (Feb 2018) - Windows
MantisBT is prone to an SQL injection SQLi vulnerability. Note: The vendor disputes the significance of this report because server.php is intended to execute arbitrary SQL statements on behalf of authenticated users from 127.0.0.1, and the issue does not have an authentication bypass...
MantisBT 'sql' Parameter SQL Injection Vulnerability (Feb 2018) - Linux
MantisBT is prone to an SQL injection SQLi vulnerability. Note: The vendor disputes the significance of this report because server.php is intended to execute arbitrary SQL statements on behalf of authenticated users from 127.0.0.1, and the issue does not have an authentication bypass...
MantisBT 2.10.0 'view_all_bug_page' Path Disclosure Vulnerability - Windows
MantisBT is prone to a path disclosure vulnerability. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
MantisBT 2.10.0 'view_all_bug_page' Path Disclosure Vulnerability - Linux
MantisBT is prone to a path disclosure vulnerability. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
CVE-2018-6526
viewallbugpage.php in MantisBT 2.10.0-development before 2018-02-02 allows remote attackers to discover the full path via an invalid filter parameter, related to a filterensurevalidfilter call in currentuserapi.php...
Design/Logic Flaw
viewallbugpage.php in MantisBT 2.10.0-development before 2018-02-02 allows remote attackers to discover the full path via an invalid filter parameter, related to a filterensurevalidfilter call in currentuserapi.php...
CVE-2018-6526
viewallbugpage.php in MantisBT 2.10.0-development before 2018-02-02 allows remote attackers to discover the full path via an invalid filter parameter, related to a filterensurevalidfilter call in currentuserapi.php...
CVE-2018-6526
viewallbugpage.php in MantisBT 2.10.0-development before 2018-02-02 allows remote attackers to discover the full path via an invalid filter parameter, related to a filterensurevalidfilter call in currentuserapi.php...
CVE-2018-6526
CVE-2018-6526 affects MantisBT; path disclosure in view_all_bug_page.php (2.10.0-development before 2018-02-02) via an invalid filter parameter tied to filter_ensure_valid_filter in current_user_api.php. The vulnerability allows remote attackers to discover the full filesystem path. Affected comp...
MantisBT SQL Injection Vulnerability (CNVD-2018-03423)
MantisBT is a Web-based open source defect tracking system of the MantisBT team . The system provides project management and defect tracking services in the form of Web operations. A security vulnerability exists in MantisBT version 2.10.0. A local attacker can exploit this vulnerability to condu...
Sql injection
DISPUTED MantisBT 2.10.0 allows local users to conduct SQL Injection attacks via the vendor/adodb/adodb-php/server.php sql parameter in a request to the 127.0.0.1 IP address. NOTE: the vendor disputes the significance of this report because server.php is intended to execute arbitrary SQL statemen...
CVE-2018-6382
MantisBT 2.10.0 allows local users to conduct SQL Injection attacks via the vendor/adodb/adodb-php/server.php sql parameter in a request to the 127.0.0.1 IP address. NOTE: the vendor disputes the significance of this report because server.php is intended to execute arbitrary SQL statements on...
CVE-2018-6382
MantisBT 2.10.0 allows local users to conduct SQL Injection attacks via the vendor/adodb/adodb-php/server.php sql parameter in a request to the 127.0.0.1 IP address. NOTE: the vendor disputes the significance of this report because server.php is intended to execute arbitrary SQL statements on...
CVE-2018-6382
MantisBT 2.10.0 allows local users to conduct SQL Injection attacks via the vendor/adodb/adodb-php/server.php sql parameter in a request to the 127.0.0.1 IP address. NOTE: the vendor disputes the significance of this report because server.php is intended to execute arbitrary SQL statements on...