CVE-2014-9572

MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 does not properly restrict access to //install.php, which allows remote attackers to obtain database credentials via the install parameter with the value 4...

CVE-2014-9572

CVE-2014-9572 affects MantisBT versions prior to 1.2.19 and 1.3.x prior to 1.3.0-beta.2. The issue is improper access restriction on the file path /*/install.php, allowing remote attackers to obtain database credentials via the install parameter with the value 4. This is a credential disclosure d...

CVE-2014-9573

CVE-2014-9573 is a SQL injection flaw in MantisBT: the vulnerability exists in manage_user_page.php when handling the MANTIS_MANAGE_USERS_COOKIE cookie, exploitable by remote admins with FILE privileges to run arbitrary SQL. Affected are MantisBT releases before 1.2.19 and 1.3.x before 1.3.0-beta...

CVE-2014-9571

Cross-site scripting XSS vulnerability in admin/install.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the 1 adminusername or 2 adminpassword parameter...

CVE-2014-9571

CVE-2014-9571 affects MantisBT versions in the 1.2.x line before 1.2.19 and 1.3.x before 1.3.0-beta.2. The vulnerability is an XSS in admin/install.php that allows remote attackers to inject arbitrary web script or HTML via the admin_username or admin_password parameters. Exploitation could occur...

MantisBT 1.2.x < 1.2.18 Multiple Vulnerabilities

According to its version number, the MantisBT application hosted on the remote web server is 1.2.x prior to 1.2.18. It is, therefore, affected by the following vulnerabilities : - Multiple input-validation errors exist that could allow cross-site scripting attacks. CVE-2014-7146, CVE-2014-8986,...

MantisBT 1.2.13 - 1.2.16 'admin_config_report.php' SQLi

According to its version number, the MantisBT application hosted on the remote web server is 1.2.13 or later but prior to 1.2.17. It is, therefore, affected by an input validation error related to the 'filterconfigid' parameter in the script 'adminconfigreport.php', which could allow SQL injectio...

CVE-2014-9272

The stringinserthref function in MantisBT 1.2.0a1 through 1.2.x before 1.2.18 does not properly validate the URL protocol, which allows remote attackers to conduct cross-site scripting XSS attacks via the javascript:// protocol...

CVE-2014-9271

Cross-site scripting XSS vulnerability in filedownload.php in MantisBT before 1.2.18 allows remote authenticated users to inject arbitrary web script or HTML via a Flash file with an image extension, related to inline attachments, as demonstrated by a .swf.jpeg filename...

CVE-2014-9269

Cross-site scripting XSS vulnerability in helperapi.php in MantisBT 1.1.0a1 through 1.2.x before 1.2.18, when Extended project browser is enabled, allows remote attackers to inject arbitrary web script or HTML via the project cookie...

CVE-2014-9272

The stringinserthref function in MantisBT 1.2.0a1 through 1.2.x before 1.2.18 does not properly validate the URL protocol, which allows remote attackers to conduct cross-site scripting XSS attacks via the javascript:// protocol...

CVE-2014-9269

Cross-site scripting XSS vulnerability in helperapi.php in MantisBT 1.1.0a1 through 1.2.x before 1.2.18, when Extended project browser is enabled, allows remote attackers to inject arbitrary web script or HTML via the project cookie...

Cross site scripting

The stringinserthref function in MantisBT 1.2.0a1 through 1.2.x before 1.2.18 does not properly validate the URL protocol, which allows remote attackers to conduct cross-site scripting XSS attacks via the javascript:// protocol...

Cross site scripting

Cross-site scripting XSS vulnerability in filedownload.php in MantisBT before 1.2.18 allows remote authenticated users to inject arbitrary web script or HTML via a Flash file with an image extension, related to inline attachments, as demonstrated by a .swf.jpeg filename...

Cross site scripting

Cross-site scripting XSS vulnerability in helperapi.php in MantisBT 1.1.0a1 through 1.2.x before 1.2.18, when Extended project browser is enabled, allows remote attackers to inject arbitrary web script or HTML via the project cookie...

CVE-2014-9271

Cross-site scripting XSS vulnerability in filedownload.php in MantisBT before 1.2.18 allows remote authenticated users to inject arbitrary web script or HTML via a Flash file with an image extension, related to inline attachments, as demonstrated by a .swf.jpeg filename...

CVE-2014-9271

CVE-2014-9271 affects MantisBT 1.2.x up to 1.2.18. It is a cross-site scripting (XSS) vulnerability in file_download.php that allows an attacker to inject arbitrary web script or HTML via a Flash file with an image extension (e.g., a .swf.jpeg filename) related to inline attachments. Root cause: ...

CVE-2014-9272

The stringinserthref function in MantisBT 1.2.0a1 through 1.2.x before 1.2.18 does not properly validate the URL protocol, which allows remote attackers to conduct cross-site scripting XSS attacks via the javascript:// protocol...

CVE-2014-9271

Cross-site scripting XSS vulnerability in filedownload.php in MantisBT before 1.2.18 allows remote authenticated users to inject arbitrary web script or HTML via a Flash file with an image extension, related to inline attachments, as demonstrated by a .swf.jpeg filename...

CVE-2014-9272

MantisBT 1.2.0a1 through 1.2.x before 1.2.18 is affected. The vulnerability stems from string_insert_href not properly validating the URL protocol, allowing remote XSS via the javascript:// protocol. Affected component: URL handling in string_insert_href. Impact: cross-site scripting that can be ...