CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 30/10/2018 |
| CVE-2018-14504 | 보통6.1 | An issue was discovered in manage_filter_edit_page.php in MantisBT 2.x through 2.15.0. A cross-site scripting (XSS) vulnerability in the Edit Filter page allows execution of arbitrary code (if CSP settings permit it) when displaying a filter with a crafted name (e.g., 'foobar" onclick="alert(1)'). | 03/08/2018 |
| CVE-2018-13055 | 보통6.1 | A cross-site scripting (XSS) vulnerability in the View Filters page (view_filters_page.php) in MantisBT 2.1.0 through 2.15.0 allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted PATH_INFO. | 03/08/2018 |
| CVE-2018-6526 | 보통5.3 | view_all_bug_page.php in MantisBT 2.10.0-development before 2018-02-02 allows remote attackers to discover the full path via an invalid filter parameter, related to a filter_ensure_valid_filter call in current_user_api.php. | 02/02/2018 |
| CVE-2018-6382 | 낮음3.3 | MantisBT 2.10.0 allows local users to conduct SQL Injection attacks via the vendor/adodb/adodb-php/server.php sql parameter in a request to the 127.0.0.1 IP address. NOTE: the vendor disputes the significance of this report because server.php is intended to execute arbitrary SQL statements on behalf of authenticated us | 30/01/2018 |
| CVE-2014-9624 | 높음7.5 | CAPTCHA bypass vulnerability in MantisBT before 1.2.19. | 12/09/2017 |
| CVE-2015-2046 | 보통6.1 | Cross-site scripting (XSS) vulnerability in MantisBT 1.2.13 and later before 1.2.20. | 28/08/2017 |
| CVE-2014-9701 | 보통6.5 | Cross-site scripting (XSS) vulnerability in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the url parameter to permalink_page.php. | 09/08/2017 |
| CVE-2017-12419 | 보통4.9 | If, after successful installation of MantisBT through 2.5.2 on MySQL/MariaDB, the administrator does not remove the 'admin' directory (as recommended in the "Post-installation and upgrade tasks" section of the MantisBT Admin Guide), and the MySQL client has a local_infile setting enabled (in php.ini mysqli.allow_local_ | 05/08/2017 |
| CVE-2017-12062 | 보통6.1 | An XSS issue was discovered in manage_user_page.php in MantisBT 2.x before 2.5.2. The 'filter' field is not sanitized before being rendered in the Manage User page, allowing remote attackers to execute arbitrary JavaScript code if CSP is disabled. | 01/08/2017 |
| CVE-2017-12061 | 보통6.1 | An XSS issue was discovered in admin/install.php in MantisBT before 1.3.12 and 2.x before 2.5.2. Some variables under user control in the MantisBT installation script are not properly sanitized before being output, allowing remote attackers to inject arbitrary JavaScript code, as demonstrated by the $f_database, $f_db_ | 01/08/2017 |
| CVE-2015-5059 | 보통5.3 | The "Project Documentation" feature in MantisBT 1.2.19 and earlier, when the threshold to access files ($g_view_proj_doc_threshold) is set to ANYBODY, allows remote authenticated users to download attachments linked to arbitrary private projects via a file id number in the file_id parameter to file_download.php. | 01/08/2017 |
| CVE-2017-7620 | 보통6.5 | MantisBT before 1.3.11, 2.x before 2.3.3, and 2.4.x before 2.4.1 omits a backslash check in string_api.php and consequently has conflicting interpretations of an initial \/ substring as introducing either a local pathname or a remote hostname, which leads to (1) arbitrary Permalink Injection via CSRF attacks on a perma | 21/05/2017 |
| CVE-2017-7897 | 보통6.1 | A cross-site scripting (XSS) vulnerability in the MantisBT (2.3.x before 2.3.2) Timeline include page, used in My View (my_view_page.php) and User Information (view_user_page.php) pages, allows remote attackers to inject arbitrary code (if CSP settings permit it) through crafted PATH_INFO in a URL, due to use of unsani | 18/04/2017 |
| CVE-2017-7615 | 높음8.8 | MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access via an empty confirm_hash value to verify.php. | 16/04/2017 |
| CVE-2017-7309 | 보통4.8 | A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted 'config_option' parameter. This is fixed in 1.3.9, 2.1.3, and 2.2.3. | 31/03/2017 |
| CVE-2017-7241 | 보통4.8 | A cross-site scripting (XSS) vulnerability in the MantisBT Move Attachments page (move_attachments_page.php, part of admin tools) allows remote attackers to inject arbitrary code through a crafted 'type' parameter, if Content Security Protection (CSP) settings allows it. This is fixed in 1.3.9, 2.1.3, and 2.2.3. Note t | 31/03/2017 |
| CVE-2017-6973 | 보통4.8 | A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page (adm_config_report.php) allows remote attackers to inject arbitrary code through a crafted 'action' parameter. This is fixed in 1.3.8, 2.1.2, and 2.2.2. | 31/03/2017 |