Mantisbt

Mantisbt

140 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.1

CVE-2017-12062

Exploit
  • EPSS 3.9%
  • Veröffentlicht 01.08.2017 15:29:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

An XSS issue was discovered in manage_user_page.php in MantisBT 2.x before 2.5.2. The 'filter' field is not sanitized before being rendered in the Manage User page, allowing remote attackers to execute arbitrary JavaScript code if CSP is disabled.

5.3

CVE-2015-5059

  • EPSS 1.44%
  • Veröffentlicht 01.08.2017 14:29:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

The "Project Documentation" feature in MantisBT 1.2.19 and earlier, when the threshold to access files ($g_view_proj_doc_threshold) is set to ANYBODY, allows remote authenticated users to download attachments linked to arbitrary private projects via ...

6.5

CVE-2017-7620

Exploit
  • EPSS 1.36%
  • Veröffentlicht 21.05.2017 14:29:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

MantisBT before 1.3.11, 2.x before 2.3.3, and 2.4.x before 2.4.1 omits a backslash check in string_api.php and consequently has conflicting interpretations of an initial \/ substring as introducing either a local pathname or a remote hostname, which ...

6.1

CVE-2017-7897

Exploit
  • EPSS 1.75%
  • Veröffentlicht 18.04.2017 17:59:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

A cross-site scripting (XSS) vulnerability in the MantisBT (2.3.x before 2.3.2) Timeline include page, used in My View (my_view_page.php) and User Information (view_user_page.php) pages, allows remote attackers to inject arbitrary code (if CSP settin...

8.8

CVE-2017-7615

Exploit
  • EPSS 90.86%
  • Veröffentlicht 16.04.2017 14:59:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php.

4.8

CVE-2017-6973

Exploit
  • EPSS 0.93%
  • Veröffentlicht 31.03.2017 04:59:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code through a crafted 'action' parameter. This is fixed in 1.3.8, 2.1.2, and 2.2.2.

4.8

CVE-2017-7241

Exploit
  • EPSS 0.93%
  • Veröffentlicht 31.03.2017 04:59:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page (move_attachments_page.php, part of admin tools) allows remote attackers to inject arbitrary code through a crafted 'type' parameter, if Content Security Protection (CSP...

4.8

CVE-2017-7309

Exploit
  • EPSS 57.32%
  • Veröffentlicht 31.03.2017 04:59:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted 'config_option' parameter. This is fixed in 1....

6.1

CVE-2017-7222

  • EPSS 0.81%
  • Veröffentlicht 22.03.2017 05:59:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

A cross-site scripting (XSS) vulnerability in MantisBT before 2.1.1 allows remote attackers to inject arbitrary HTML or JavaScript (if MantisBT's CSP settings permit it) by modifying 'window_title' in the application configuration. This requires priv...

6.1

CVE-2017-6799

Exploit
  • EPSS 3.54%
  • Veröffentlicht 10.03.2017 10:59:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

A cross-site scripting (XSS) vulnerability in view_filters_page.php in MantisBT before 2.2.1 allows remote attackers to inject arbitrary JavaScript via the 'view_type' parameter.