Mantisbt

Mantisbt

119 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
4.7

CVE-2016-7111

  • EPSS 0.33%
  • Veröffentlicht 17.02.2017 17:59:01
  • Zuletzt bearbeitet 20.04.2025 01:37:25

MantisBT before 1.3.1 and 2.x before 2.0.0-beta.2 uses a weak Content Security Policy when using the Gravatar plugin, which allows remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.

6.1

CVE-2016-5364

Exploit
  • EPSS 0.3%
  • Veröffentlicht 17.02.2017 17:59:00
  • Zuletzt bearbeitet 20.04.2025 01:37:25

Cross-site scripting (XSS) vulnerability in manage_custom_field_edit_page.php in MantisBT 1.2.19 and earlier allows remote attackers to inject arbitrary web script or HTML via the return parameter.

6.1

CVE-2016-6837

  • EPSS 0.94%
  • Veröffentlicht 10.01.2017 15:59:00
  • Zuletzt bearbeitet 20.04.2025 01:37:25

Cross-site scripting (XSS) vulnerability in MantisBT Filter API in MantisBT versions before 1.2.19, and versions 2.0.0-beta1, 1.3.0-beta1 allows remote attackers to inject arbitrary web script or HTML via the 'view_type' parameter.

5.3

CVE-2014-9759

  • EPSS 0.29%
  • Veröffentlicht 11.04.2016 21:59:00
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Incomplete blacklist vulnerability in the config_is_private function in config_api.php in MantisBT 1.3.x before 1.3.0 allows remote attackers to obtain sensitive master salt configuration information via a SOAP API request.

3.5

CVE-2014-8987

  • EPSS 0.53%
  • Veröffentlicht 24.08.2015 15:59:01
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Cross-site scripting (XSS) vulnerability in the "set configuration" box in the Configuration Report page (adm_config_report.php) in MantisBT 1.2.13 through 1.2.17 allows remote administrators to inject arbitrary web script or HTML via the config_opti...

5.8

CVE-2015-1042

Exploit
  • EPSS 0.62%
  • Veröffentlicht 10.02.2015 20:59:00
  • Zuletzt bearbeitet 12.04.2025 10:46:40

The string_sanitize_url function in core/string_api.php in MantisBT 1.2.0a3 through 1.2.18 uses an incorrect regular expression, which allows remote attackers to conduct open redirect and phishing attacks via a URL with a ":/" (colon slash) separator...

6

CVE-2014-9573

Exploit
  • EPSS 0.4%
  • Veröffentlicht 26.01.2015 15:59:12
  • Zuletzt bearbeitet 12.04.2025 10:46:40

SQL injection vulnerability in manage_user_page.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote administrators with FILE privileges to execute arbitrary SQL commands via the MANTIS_MANAGE_USERS_COOKIE cookie.

7.5

CVE-2014-9572

  • EPSS 0.92%
  • Veröffentlicht 26.01.2015 15:59:11
  • Zuletzt bearbeitet 12.04.2025 10:46:40

MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 does not properly restrict access to /*/install.php, which allows remote attackers to obtain database credentials via the install parameter with the value 4.

4.3

CVE-2014-9571

Exploit
  • EPSS 0.45%
  • Veröffentlicht 26.01.2015 15:59:10
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Cross-site scripting (XSS) vulnerability in admin/install.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the (1) admin_username or (2) admin_password parameter.

4.3

CVE-2014-9272

  • EPSS 0.44%
  • Veröffentlicht 09.01.2015 18:59:03
  • Zuletzt bearbeitet 12.04.2025 10:46:40

The string_insert_href function in MantisBT 1.2.0a1 through 1.2.x before 1.2.18 does not properly validate the URL protocol, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the javascript:// protocol.