CVE-2015-1042

CVE-2015-1042 affects MantisBT 1.2.0a3 through 1.2.18. The flaw is in string_sanitize_url (core/string_api.php) where an incorrect regular expression enables open redirect and phishing via a colon-slash (:/) return parameter to login_page.php. Public sources in the connected documents describe it...

CVE-2015-1042

The stringsanitizeurl function in core/stringapi.php in MantisBT 1.2.0a3 through 1.2.18 uses an incorrect regular expression, which allows remote attackers to conduct open redirect and phishing attacks via a URL with a ":/" colon slash separator in the return parameter to loginpage.php, a differe...

mantisbt: multiple issues

CVE-2014-9571 cross-side scripting Cross-site scripting XSS vulnerability in admin/install.php allows remote attackers to inject arbitrary web script or HTML via the 1 adminusername or 2 adminpassword parameter. - CVE-2014-9572 information disclosure It was discovered that mantisbt does not...

MantisBT < 1.2.19, 1.3.x < 1.3.0-beta.2 Multiple Vulnerabilities

MantisBT is prone to multiple vulnerabilities. Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Multiple vulnerabilities in MantisBT

Advisory ID: HTB23243 Product: MantisBT Vendor: MantisBT Team Vulnerable Versions: 1.2.17 and probably prior Tested Version: 1.2.17 Advisory Publication: December 3, 2014 without technical details Vendor Notification: December 3, 2014 Vendor Patch: January 25, 2015 Public Disclosure: January 28,...

MantisBT 1.2.17 XSS / Improper Access Control / SQL Injection Vulnerabilities

MantisBT version 1.2.17 suffers from improper access control, cross site scripting, and remote SQL injection vulnerabilities. Product: MantisBT Vendor: MantisBT Team Vulnerable Versions: 1.2.17 and probably prior Tested Version: 1.2.17 Advisory Publication: December 3, 2014 without technical...

MantisBT 1.2.17 XSS / Improper Access Control / SQL Injection

Advisory ID: HTB23243 Product: MantisBT Vendor: MantisBT Team Vulnerable Versions: 1.2.17 and probably prior Tested Version: 1.2.17 Advisory Publication: December 3, 2014 without technical details Vendor Notification: December 3, 2014 Vendor Patch: January 25, 2015 Public Disclosure: January 28,...

MantisBT Improper Access Control Vulnerability

MantisBT is a Web-based open source defect tracking system of the MantisBT team . The system provides project management and defect tracking services in the form of Web operations. A security vulnerability exists in MantisBT versions 1.2.18 and earlier and 1.3.0-beta.1, which stems from the progr...

MantisBT Cross-Site Scripting Vulnerability

MantisBT is a Web-based open source defect tracking system of the MantisBT team . The system provides project management and defect tracking services in the form of Web operations. A cross-site scripting vulnerability exists in the admin/install.php script in MantisBT versions 1.2.18 and earlier...

MantisBT SQL Injection Vulnerability

MantisBT is a Web-based open source defect tracking system of the MantisBT team . The system provides project management and defect tracking services in the form of Web operations. A SQL injection vulnerability exists in the manageuserpage.php script in MantisBT versions 1.2.18 and earlier and...

CVE-2014-9573

SQL injection vulnerability in manageuserpage.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote administrators with FILE privileges to execute arbitrary SQL commands via the MANTISMANAGEUSERSCOOKIE cookie...

CVE-2014-9572

MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 does not properly restrict access to //install.php, which allows remote attackers to obtain database credentials via the install parameter with the value 4...

CVE-2014-9571

Cross-site scripting XSS vulnerability in admin/install.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the 1 adminusername or 2 adminpassword parameter...

CVE-2014-9572

MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 does not properly restrict access to //install.php, which allows remote attackers to obtain database credentials via the install parameter with the value 4...

Sql injection

SQL injection vulnerability in manageuserpage.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote administrators with FILE privileges to execute arbitrary SQL commands via the MANTISMANAGEUSERSCOOKIE cookie...

Code injection

MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 does not properly restrict access to //install.php, which allows remote attackers to obtain database credentials via the install parameter with the value 4...

CVE-2014-9571

Cross-site scripting XSS vulnerability in admin/install.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the 1 adminusername or 2 adminpassword parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in admin/install.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the 1 adminusername or 2 adminpassword parameter...

CVE-2014-9573

SQL injection vulnerability in manageuserpage.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote administrators with FILE privileges to execute arbitrary SQL commands via the MANTISMANAGEUSERSCOOKIE cookie...

CVE-2014-9573

SQL injection vulnerability in manageuserpage.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote administrators with FILE privileges to execute arbitrary SQL commands via the MANTISMANAGEUSERSCOOKIE cookie...