ID de Prueba:	1.3.6.1.4.1.25623.1.0.806640
Categoría:	Web application abuses
Título:	MantisBT 1.1.0a3 - 1.2.17 Multiple Vulnerabilities - Windows
Resumen:	MantisBT is prone to multiple vulnerabilities.
Descripción:	Summary: MantisBT is prone to multiple vulnerabilities. Vulnerability Insight: Multiple flaws exist as, - the function 'projax_array_serialize_for_autocomplete' within core/projax_api.php script doesn't validate input passed by the user. - the unattended upgrade script retrieved DB connection settings from POST parameters allows an attacker to get the script to connect to their host with the current DB config credentials. - the input passed via project cookie to helper_api.php script is not validated before returning it to user. Vulnerability Impact: Successful exploitation will allow remote attackers to inject arbitrary web script or HTML via the 'profile/Platform' field and gain access to sensitive information. Affected Software/OS: MantisBT versions 1.1.0a3 through 1.2.17. Solution: Update to version 1.2.18 or later. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2014-9270 BugTraq ID: 71372 http://www.securityfocus.com/bid/71372 Debian Security Information: DSA-3120 (Google Search) http://www.debian.org/security/2015/dsa-3120 http://seclists.org/oss-sec/2014/q4/867 http://seclists.org/oss-sec/2014/q4/902 http://secunia.com/advisories/62101 XForce ISS Database: mantisbt-projaxapi-xss(99037) https://exchange.xforce.ibmcloud.com/vulnerabilities/99037 Common Vulnerability Exposure (CVE) ID: CVE-2014-9279 BugTraq ID: 71359 http://www.securityfocus.com/bid/71359 http://seclists.org/oss-sec/2014/q4/863 XForce ISS Database: mantisbt-upgradeunattaended-sec-bypass(99031) https://exchange.xforce.ibmcloud.com/vulnerabilities/99031 Common Vulnerability Exposure (CVE) ID: CVE-2014-9269
Copyright	Copyright (C) 2015 Greenbone Networks GmbH

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.