MantisBT manage_user_page.php file cross-site scripting vulnerability

MantisBT is a Web-based open source defect tracking system of the MantisBT team . The system provides project management and defect tracking services in the form of Web operations. A cross-site scripting vulnerability exists in the manageuserpage.php file in version 2.x of MantisBT prior to 2.5.2...

MantisBT admin/install.php file cross-site scripting vulnerability

MantisBT is a Web-based open source defect tracking system of the MantisBT team . The system provides project management and defect tracking services in the form of Web operations. A cross-site scripting vulnerability exists in the admin/install.php file in versions 2.x prior to MantisBT 2.5.2 an...

CVE-2017-12061

An XSS issue was discovered in admin/install.php in MantisBT before 1.3.12 and 2.x before 2.5.2. Some variables under user control in the MantisBT installation script are not properly sanitized before being output, allowing remote attackers to inject arbitrary JavaScript code, as demonstrated by...

CVE-2017-12062

An XSS issue was discovered in manageuserpage.php in MantisBT 2.x before 2.5.2. The 'filter' field is not sanitized before being rendered in the Manage User page, allowing remote attackers to execute arbitrary JavaScript code if CSP is disabled...

CVE-2017-12061

An XSS issue was discovered in admin/install.php in MantisBT before 1.3.12 and 2.x before 2.5.2. Some variables under user control in the MantisBT installation script are not properly sanitized before being output, allowing remote attackers to inject arbitrary JavaScript code, as demonstrated by...

Cross site scripting

An XSS issue was discovered in manageuserpage.php in MantisBT 2.x before 2.5.2. The 'filter' field is not sanitized before being rendered in the Manage User page, allowing remote attackers to execute arbitrary JavaScript code if CSP is disabled...

Cross site scripting

An XSS issue was discovered in admin/install.php in MantisBT before 1.3.12 and 2.x before 2.5.2. Some variables under user control in the MantisBT installation script are not properly sanitized before being output, allowing remote attackers to inject arbitrary JavaScript code, as demonstrated by...

CVE-2017-12062

An XSS issue was discovered in manageuserpage.php in MantisBT 2.x before 2.5.2. The 'filter' field is not sanitized before being rendered in the Manage User page, allowing remote attackers to execute arbitrary JavaScript code if CSP is disabled...

CVE-2017-12062

An XSS issue was discovered in manageuserpage.php in MantisBT 2.x before 2.5.2. The 'filter' field is not sanitized before being rendered in the Manage User page, allowing remote attackers to execute arbitrary JavaScript code if CSP is disabled...

CVE-2017-12061

An XSS issue was discovered in admin/install.php in MantisBT before 1.3.12 and 2.x before 2.5.2. Some variables under user control in the MantisBT installation script are not properly sanitized before being output, allowing remote attackers to inject arbitrary JavaScript code, as demonstrated by...

CVE-2017-12061

CVE-2017-12061 affects MantisBT installations via admin/install.php, with XSS caused by unsanitized user-controlled variables in the installer (notably $f_database, $f_db_username, $f_admin_username). Vulnerable versions are MantisBT < 1.3.12 and

CVE-2017-12062

CVE-2017-12062 affects MantisBT 2.x before 2.5.2. An XSS flaw in manage_user_page.php arises because the filter field is not sanitized before rendering on the Manage User page. This allows a remote attacker to execute arbitrary JavaScript if a Content Security Policy is disabled. The documented m...

CVE-2015-5059

The "Project Documentation" feature in MantisBT 1.2.19 and earlier, when the threshold to access files $gviewprojdocthreshold is set to ANYBODY, allows remote authenticated users to download attachments linked to arbitrary private projects via a file id number in the fileid parameter to...

CVE-2015-5059

The "Project Documentation" feature in MantisBT 1.2.19 and earlier, when the threshold to access files $gviewprojdocthreshold is set to ANYBODY, allows remote authenticated users to download attachments linked to arbitrary private projects via a file id number in the fileid parameter to...

CVE-2015-5059

The "Project Documentation" feature in MantisBT 1.2.19 and earlier, when the threshold to access files $gviewprojdocthreshold is set to ANYBODY, allows remote authenticated users to download attachments linked to arbitrary private projects via a file id number in the fileid parameter to...

CVE-2015-5059

CVE-2015-5059 affects MantisBT up to version 1.2.19, where the Project Documentation feature exposes attachments in private projects when the file access threshold ($g_view_proj_doc_threshold) is set to ANYBODY. This allows remote authenticated users to download attachments linked to arbitrary pr...

Mantis MantisBT Bug Tracker adm_config_report.php move_attachments_page.php XSS (CVE-2017-7309)

Three cross-site scripting vulnerabilities exist in Mantis Bug Tracker MantisBT. These vulnerabilities are due to insufficient input validation of the action, type and configoption HTTP parameters by admconfigreport.php and moveattachmentspage.php. A remote attacker could exploit this vulnerabili...

MantisBT Cross-Site Request Forgery Vulnerability

MantisBT is a Web-based open source defect tracking system of the MantisBT team . The system provides project management and defect tracking services in the form of Web operations. A cross-site request forgery vulnerability exists in MantisBT versions prior to 2.4.1, which stems from a missing...

MantisBT < 1.3.11, 2.x < 2.3.3, 2.4.0 CSRF Vulnerability - Linux

MantisBT is prone to a cross-site request forgery CSRF vulnerability. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

MantisBT < 1.3.11, 2.x < 2.3.3, 2.4.0 CSRF Vulnerability - Windows

MantisBT is prone to a cross-site request forgery CSRF vulnerability. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...