1160 matches found
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in filterapi.php in MantisBT before 1.2.7 allow remote attackers to inject arbitrary web script or HTML via a parameter, as demonstrated by the projectid parameter to search.php...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in configdefaultsinc.php in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO, as demonstrated by the PATHINFO to 1 manageconfigemailpage.php, 2 manageconfigworkflowpage.php, or 3 bugs/plugin.php...
CVE-2011-3358
Multiple cross-site scripting XSS vulnerabilities in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the 1 os, 2 osbuild, or 3 platform parameter to a bugreportpage.php or b bugupdateadvancedpage.php, related to use of the Projax library...
CVE-2011-3357
Directory traversal vulnerability in bugactiongroupextpage.php in MantisBT before 1.2.8 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the action parameter, related to bugactiongrouppage.php...
CVE-2011-2938
Multiple cross-site scripting XSS vulnerabilities in filterapi.php in MantisBT before 1.2.7 allow remote attackers to inject arbitrary web script or HTML via a parameter, as demonstrated by the projectid parameter to search.php...
Cross site scripting
Cross-site scripting XSS vulnerability in bugactiongroupextpage.php in MantisBT before 1.2.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter, related to bugactiongrouppage.php, a different vulnerability than CVE-2011-3357...
CVE-2011-3356
Multiple cross-site scripting XSS vulnerabilities in configdefaultsinc.php in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO, as demonstrated by the PATHINFO to 1 manageconfigemailpage.php, 2 manageconfigworkflowpage.php, or 3 bugs/plugin.php...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the 1 os, 2 osbuild, or 3 platform parameter to a bugreportpage.php or b bugupdateadvancedpage.php, related to use of the Projax library...
CVE-2011-3578
Cross-site scripting XSS vulnerability in bugactiongroupextpage.php in MantisBT before 1.2.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter, related to bugactiongrouppage.php, a different vulnerability than CVE-2011-3357...
CVE-2011-3357
Directory traversal vulnerability in bugactiongroupextpage.php in MantisBT before 1.2.8 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the action parameter, related to bugactiongrouppage.php...
CVE-2011-3358
Multiple cross-site scripting XSS vulnerabilities in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the 1 os, 2 osbuild, or 3 platform parameter to a bugreportpage.php or b bugupdateadvancedpage.php, related to use of the Projax library...
CVE-2011-3357
CVE-2011-3357 is a directory traversal (local file inclusion) vulnerability in MantisBT up to version 1.2.8, allowing remote attackers to include and execute arbitrary local files by supplying a .. in the action parameter (via bug_actiongroup_ext_page.php). The issue is caused by insufficient val...
CVE-2011-3358
CVE-2011-3358 involves multiple cross-site scripting (XSS) weaknesses in MantisBT before 1.2.8, exploitable via the os, os_build, or platform parameters in bug_report_page.php or bug_update_advanced_page.php due to the Projax library. The vulnerability allows remote attackers to inject arbitrary ...
CVE-2011-3578
CVE-2011-3578 is a cross-site scripting (XSS) vulnerability affecting MantisBT prior to 1.2.8 . The issue is triggered via the parameter action in the script bug_actiongroup_ext_page.php, enabling remote attackers to inject arbitrary web script or HTML. The description links this to bug_actiongro...
CVE-2011-2938
Multiple cross-site scripting XSS vulnerabilities in filterapi.php in MantisBT before 1.2.7 allow remote attackers to inject arbitrary web script or HTML via a parameter, as demonstrated by the projectid parameter to search.php...
CVE-2011-3578
Cross-site scripting XSS vulnerability in bugactiongroupextpage.php in MantisBT before 1.2.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter, related to bugactiongrouppage.php, a different vulnerability than CVE-2011-3357...
CVE-2011-3356
CVE-2011-3356 affects MantisBT up to 1.2.8, where multiple XSS vulnerabilities exist in config_defaults_inc.php allowing remote script injection via PATH_INFO to pages such as manage_config_email_page.php, manage_config_workflow_page.php, or bugs/plugin.php. The issue stems from input handling in...
CVE-2011-3356
Multiple cross-site scripting XSS vulnerabilities in configdefaultsinc.php in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO, as demonstrated by the PATHINFO to 1 manageconfigemailpage.php, 2 manageconfigworkflowpage.php, or 3 bugs/plugin.php...
CVE-2011-2938
CVE-2011-2938 affects MantisBT prior to 1.2.7, with multiple XSS vulnerabilities in filter_api.php exploitable via the project_id parameter to search.php to inject arbitrary scripts/HTML. OpenVAS and Gentoo/Gentoo GLSA refs corroborate the issue and indicate upgrades to newer MantisBT versions as...
Multiple vulnerabilities in MantisBT
Vulnerability ID: HTB23045 Reference: https://www.htbridge.ch/advisory/multiplevulnerabilitiesinmantisbt.html Product: MantisBT Vendor: www.mantisbt.org http://www.mantisbt.org/ Vulnerable Version: 1.2.7 and probably prior Tested Version: 1.2.7 Vendor Notification: 31 August 2011 Vulnerability...