2.6

CVE-2014-9269

Cross-site scripting (XSS) vulnerability in helper_api.php in MantisBT 1.1.0a1 through 1.2.x before 1.2.18, when Extended project browser is enabled, allows remote attackers to inject arbitrary web script or HTML via the project cookie.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mantisbt ≫ Mantisbt Version1.1.0 Updatea1
Mantisbt ≫ Mantisbt Version1.1.0 Updatea2
Mantisbt ≫ Mantisbt Version1.1.0 Updatea3
Mantisbt ≫ Mantisbt Version1.1.0 Updatea4
Mantisbt ≫ Mantisbt Version1.1.0 Updaterc1
Mantisbt ≫ Mantisbt Version1.1.0 Updaterc2
Mantisbt ≫ Mantisbt Version1.1.0 Updaterc3
Mantisbt ≫ Mantisbt Version1.1.1
Mantisbt ≫ Mantisbt Version1.1.2
Mantisbt ≫ Mantisbt Version1.1.3
Mantisbt ≫ Mantisbt Version1.1.4
Mantisbt ≫ Mantisbt Version1.1.5
Mantisbt ≫ Mantisbt Version1.1.6
Mantisbt ≫ Mantisbt Version1.1.7
Mantisbt ≫ Mantisbt Version1.1.8
Mantisbt ≫ Mantisbt Version1.1.9
Mantisbt ≫ Mantisbt Version1.2.0
Mantisbt ≫ Mantisbt Version1.2.0 Updatealpha1
Mantisbt ≫ Mantisbt Version1.2.0 Updatealpha2
Mantisbt ≫ Mantisbt Version1.2.0 Updatealpha3
Mantisbt ≫ Mantisbt Version1.2.0 Updaterc1
Mantisbt ≫ Mantisbt Version1.2.0 Updaterc2
Mantisbt ≫ Mantisbt Version1.2.0a1
Mantisbt ≫ Mantisbt Version1.2.0a2
Mantisbt ≫ Mantisbt Version1.2.1
Mantisbt ≫ Mantisbt Version1.2.2
Mantisbt ≫ Mantisbt Version1.2.3
Mantisbt ≫ Mantisbt Version1.2.4
Mantisbt ≫ Mantisbt Version1.2.5
Mantisbt ≫ Mantisbt Version1.2.6
Mantisbt ≫ Mantisbt Version1.2.7
Mantisbt ≫ Mantisbt Version1.2.8
Mantisbt ≫ Mantisbt Version1.2.9
Mantisbt ≫ Mantisbt Version1.2.10
Mantisbt ≫ Mantisbt Version1.2.11
Mantisbt ≫ Mantisbt Version1.2.12
Mantisbt ≫ Mantisbt Version1.2.13
Mantisbt ≫ Mantisbt Version1.2.14
Mantisbt ≫ Mantisbt Version1.2.15
Mantisbt ≫ Mantisbt Version1.2.16
Mantisbt ≫ Mantisbt Version1.2.17
Debian ≫ Debian Linux Version7.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.41% 0.584
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 2.6 4.9 2.9
AV:N/AC:H/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.