CVE-2017-7897

A cross-site scripting XSS vulnerability in the MantisBT 2.3.x before 2.3.2 Timeline include page, used in My View myviewpage.php and User Information viewuserpage.php pages, allows remote attackers to inject arbitrary code if CSP settings permit it through crafted PATHINFO in a URL, due to use o...

Cross site scripting

A cross-site scripting XSS vulnerability in the MantisBT 2.3.x before 2.3.2 Timeline include page, used in My View myviewpage.php and User Information viewuserpage.php pages, allows remote attackers to inject arbitrary code if CSP settings permit it through crafted PATHINFO in a URL, due to use o...

PT-2017-17980

Name of the Vulnerable Software and Affected Versions MantisBT versions 2.3.x through 2.3.1 Description A cross-site scripting issue exists due to the use of unsanitized $ SERVER'PHP SELF' to generate URLs, allowing remote attackers to inject arbitrary code through crafted PATH INFO in a URL, if...