CVE-2017-7309

A cross-site scripting XSS vulnerability in the MantisBT Configuration Report page admconfigreport.php allows remote attackers to inject arbitrary code if CSP settings permit it through a crafted 'configoption' parameter. This is fixed in 1.3.9, 2.1.3, and 2.2.3...

CVE-2017-7241

A cross-site scripting XSS vulnerability in the MantisBT Move Attachments page moveattachmentspage.php, part of admin tools allows remote attackers to inject arbitrary code through a crafted 'type' parameter, if Content Security Protection CSP settings allows it. This is fixed in 1.3.9, 2.1.3, an...

CVE-2017-7309

A cross-site scripting XSS vulnerability in the MantisBT Configuration Report page admconfigreport.php allows remote attackers to inject arbitrary code if CSP settings permit it through a crafted 'configoption' parameter. This is fixed in 1.3.9, 2.1.3, and 2.2.3...

Cross site scripting

A cross-site scripting XSS vulnerability in the MantisBT Configuration Report page admconfigreport.php allows remote attackers to inject arbitrary code through a crafted 'action' parameter. This is fixed in 1.3.8, 2.1.2, and 2.2.2...

CVE-2017-7309

A cross-site scripting XSS vulnerability in the MantisBT Configuration Report page admconfigreport.php allows remote attackers to inject arbitrary code if CSP settings permit it through a crafted 'configoption' parameter. This is fixed in 1.3.9, 2.1.3, and 2.2.3...

CVE-2017-6973

CVE-2017-6973 relates to a cross-site scripting (XSS) vulnerability in MantisBT on the Configuration Report page (adm_config_report.php). The issue arises from insufficient sanitization of the crafted action parameter, allowing remote attackers to inject arbitrary code. The vulnerability is fixed...

CVE-2017-7241

CVE-2017-7241 is an XSS vulnerability in MantisBT, triggered via the move_attachments_page.php in the admin tools. The issue allows injection of arbitrary code through a crafted 'type' parameter, contingent on CSP settings. It is mitigated by upgrading mantisbt/mantisbt to 1.3.9, 2.1.3, or 2.2.3 ...

CVE-2017-7241

A cross-site scripting XSS vulnerability in the MantisBT Move Attachments page moveattachmentspage.php, part of admin tools allows remote attackers to inject arbitrary code through a crafted 'type' parameter, if Content Security Protection CSP settings allows it. This is fixed in 1.3.9, 2.1.3, an...

CVE-2017-6973

A cross-site scripting XSS vulnerability in the MantisBT Configuration Report page admconfigreport.php allows remote attackers to inject arbitrary code through a crafted 'action' parameter. This is fixed in 1.3.8, 2.1.2, and 2.2.2...

CVE-2017-7309

A cross-site scripting XSS vulnerability in the MantisBT Configuration Report page admconfigreport.php allows remote attackers to inject arbitrary code if CSP settings permit it through a crafted 'configoption' parameter. This is fixed in 1.3.9, 2.1.3, and 2.2.3...

CVE-2017-7309

CVE-2017-7309 describes a cross-site scripting (XSS) vulnerability in MantisBT’s adm_config_report.php (Configuration Report) where the config_option parameter can be crafted to inject code. Affected software is MantisBT; the vulnerability arises from insufficient input validation on the configur...

MantisBT < 2.1.1 'view_type' XSS Vulnerability - Windows

MantisBT is prone to a cross-site scripting XSS vulnerability. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software...

MantisBT < 2.1.1 'view_type' XSS Vulnerability - Linux

MantisBT is prone to a cross-site scripting XSS vulnerability. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software...

MantisBT 1.2.0a3 < 1.2.17 - XmlImportExport Plugin PHP Code Injection Exploit

Exploit for multiple platform in category web applications This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'MantisBT XmlImportExport Plugin PHP Code Injection Vulnerability',...

CVE-2017-7222

A cross-site scripting XSS vulnerability in MantisBT before 2.1.1 allows remote attackers to inject arbitrary HTML or JavaScript if MantisBT's CSP settings permit it by modifying 'windowtitle' in the application configuration. This requires privileged access to MantisBT configuration management...

Cross site scripting

A cross-site scripting XSS vulnerability in MantisBT before 2.1.1 allows remote attackers to inject arbitrary HTML or JavaScript if MantisBT's CSP settings permit it by modifying 'windowtitle' in the application configuration. This requires privileged access to MantisBT configuration management...

CVE-2017-7222

A cross-site scripting XSS vulnerability in MantisBT before 2.1.1 allows remote attackers to inject arbitrary HTML or JavaScript if MantisBT's CSP settings permit it by modifying 'windowtitle' in the application configuration. This requires privileged access to MantisBT configuration management...

CVE-2017-7222

A cross-site scripting XSS vulnerability in MantisBT before 2.1.1 allows remote attackers to inject arbitrary HTML or JavaScript if MantisBT's CSP settings permit it by modifying 'windowtitle' in the application configuration. This requires privileged access to MantisBT configuration management...

CVE-2017-7222

A cross-site scripting XSS vulnerability in MantisBT before 2.1.1 allows remote attackers to inject arbitrary HTML or JavaScript if MantisBT's CSP settings permit it by modifying 'windowtitle' in the application configuration. This requires privileged access to MantisBT configuration management...

CVE-2017-7222

Summary: CVE-2017-7222 describes a cross-site scripting (XSS) vulnerability in MantisBT prior to 2.1.1 that allows remote attackers to inject arbitrary HTML or JavaScript by modifying the application’s window_title configuration. This requires privileged access to MantisBT configuration managemen...