Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (127 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2013-1934 2 Debian, Mantisbt 2 Debian Linux, Mantisbt 2024-11-21 5.4 Medium
A cross-site scripting (XSS) vulnerability in the configuration report page (adm_config_report.php) in MantisBT 1.2.0rc1 before 1.2.14 allows remote authenticated users to inject arbitrary web script or HTML via a complex value.
CVE-2013-1932 1 Mantisbt 1 Mantisbt 2024-11-21 5.4 Medium
A cross-site scripting (XSS) vulnerability in the configuration report page (adm_config_report.php) in MantisBT 1.2.13 allows remote authenticated users to inject arbitrary web script or HTML via a project name.
CVE-2013-1931 2 Fedoraproject, Mantisbt 2 Fedora, Mantisbt 2024-11-21 6.1 Medium
A cross-site scripting (XSS) vulnerability in MantisBT 1.2.14 allows remote attackers to inject arbitrary web script or HTML via a version, related to deleting a version.
CVE-2013-1930 2 Fedoraproject, Mantisbt 2 Fedora, Mantisbt 2024-11-21 4.3 Medium
MantisBT 1.2.12 before 1.2.15 allows authenticated users to by the workflow restriction and close issues.
CVE-2013-1811 2 Debian, Mantisbt 2 Debian Linux, Mantisbt 2024-11-21 4.3 Medium
An access control issue in MantisBT before 1.2.13 allows users with "Reporter" permissions to change any issue to "New".
CVE-2009-2802 1 Mantisbt 1 Mantisbt 2024-11-21 6.1 Medium
MantisBT 1.2.x before 1.2.2 insecurely handles attachments and MIME types. Arbitrary inline attachment rendering could lead to cross-domain scripting or other browser attacks.
CVE-2009-20001 1 Mantisbt 1 Mantisbt 2024-11-21 8.1 High
An issue was discovered in MantisBT before 2.24.5. It associates a unique cookie string with each user. This string is not reset upon logout (i.e., the user session is still considered valid and active), allowing an attacker who somehow gained access to a user's cookie to login as them.