1529 matches found
CVE-2011-2938
Multiple cross-site scripting XSS vulnerabilities in filterapi.php in MantisBT before 1.2.7 allow remote attackers to inject arbitrary web script or HTML via a parameter, as demonstrated by the projectid parameter to search.php...
CVE-2011-3578
Cross-site scripting XSS vulnerability in bugactiongroupextpage.php in MantisBT before 1.2.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter, related to bugactiongrouppage.php, a different vulnerability than CVE-2011-3357...
CVE-2011-3357
Directory traversal vulnerability in bugactiongroupextpage.php in MantisBT before 1.2.8 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the action parameter, related to bugactiongrouppage.php...
CVE-2011-3356
Multiple cross-site scripting XSS vulnerabilities in configdefaultsinc.php in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO, as demonstrated by the PATHINFO to 1 manageconfigemailpage.php, 2 manageconfigworkflowpage.php, or 3 bugs/plugin.php...
CVE-2011-3578
Cross-site scripting XSS vulnerability in bugactiongroupextpage.php in MantisBT before 1.2.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter, related to bugactiongrouppage.php, a different vulnerability than CVE-2011-3357...
CVE-2011-3578
CVE-2011-3578 is a cross-site scripting (XSS) vulnerability affecting MantisBT prior to 1.2.8 . The issue is triggered via the parameter action in the script bug_actiongroup_ext_page.php, enabling remote attackers to inject arbitrary web script or HTML. The description links this to bug_actiongro...
CVE-2011-3356
Multiple cross-site scripting XSS vulnerabilities in configdefaultsinc.php in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the PATHINFO, as demonstrated by the PATHINFO to 1 manageconfigemailpage.php, 2 manageconfigworkflowpage.php, or 3 bugs/plugin.php...
CVE-2011-3578
Cross-site scripting XSS vulnerability in bugactiongroupextpage.php in MantisBT before 1.2.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter, related to bugactiongrouppage.php, a different vulnerability than CVE-2011-3357...
CVE-2011-3358
CVE-2011-3358 involves multiple cross-site scripting (XSS) weaknesses in MantisBT before 1.2.8, exploitable via the os, os_build, or platform parameters in bug_report_page.php or bug_update_advanced_page.php due to the Projax library. The vulnerability allows remote attackers to inject arbitrary ...
CVE-2011-3356
CVE-2011-3356 affects MantisBT up to 1.2.8, where multiple XSS vulnerabilities exist in config_defaults_inc.php allowing remote script injection via PATH_INFO to pages such as manage_config_email_page.php, manage_config_workflow_page.php, or bugs/plugin.php. The issue stems from input handling in...
CVE-2011-3358
Multiple cross-site scripting XSS vulnerabilities in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the 1 os, 2 osbuild, or 3 platform parameter to a bugreportpage.php or b bugupdateadvancedpage.php, related to use of the Projax library...
CVE-2011-3357
Directory traversal vulnerability in bugactiongroupextpage.php in MantisBT before 1.2.8 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the action parameter, related to bugactiongrouppage.php...
CVE-2011-3357
Directory traversal vulnerability in bugactiongroupextpage.php in MantisBT before 1.2.8 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the action parameter, related to bugactiongrouppage.php...
CVE-2011-2938
Multiple cross-site scripting XSS vulnerabilities in filterapi.php in MantisBT before 1.2.7 allow remote attackers to inject arbitrary web script or HTML via a parameter, as demonstrated by the projectid parameter to search.php...
CVE-2011-2938
Multiple cross-site scripting XSS vulnerabilities in filterapi.php in MantisBT before 1.2.7 allow remote attackers to inject arbitrary web script or HTML via a parameter, as demonstrated by the projectid parameter to search.php...
CVE-2011-3358
Multiple cross-site scripting XSS vulnerabilities in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the 1 os, 2 osbuild, or 3 platform parameter to a bugreportpage.php or b bugupdateadvancedpage.php, related to use of the Projax library...
CVE-2011-2938
CVE-2011-2938 affects MantisBT prior to 1.2.7, with multiple XSS vulnerabilities in filter_api.php exploitable via the project_id parameter to search.php to inject arbitrary scripts/HTML. OpenVAS and Gentoo/Gentoo GLSA refs corroborate the issue and indicate upgrades to newer MantisBT versions as...
CVE-2011-3357
CVE-2011-3357 is a directory traversal (local file inclusion) vulnerability in MantisBT up to version 1.2.8, allowing remote attackers to include and execute arbitrary local files by supplying a .. in the action parameter (via bug_actiongroup_ext_page.php). The issue is caused by insufficient val...
PT-2011-4403
Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.8 Description The issue allows remote attackers to include and execute arbitrary local files via a .. dot dot in the action parameter. This is related to the bug actiongroup page.php file. Recommendations For...
CVE-2011-3357: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in bugactiongroupextpage.php in MantisBT before 1.2.8 allows remote attackers to include and execute arbitrary local files via a .. dot dot in the action parameter, related to bugactiongrouppage.php...