CVE-2011-2938

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Multiple cross-site scripting (XSS) vulnerabilities in filter_api.php in MantisBT before 1.2.7 allow remote attackers to inject arbitrary web script or HTML via a parameter, as demonstrated by the project_id parameter to search.php.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.fedoraproject.org/pipermail/package-announce/2011-September/066061.htmlExploit, Patch
http://packetstormsecurity.org/files/104149Exploit
http://secunia.com/advisories/51199
http://security.gentoo.org/glsa/glsa-201211-01.xml
http://securityreason.com/securityalert/8391
http://www.mantisbt.org/bugs/view.php?id=13245Exploit
http://www.openwall.com/lists/oss-security/2011/08/18/7Exploit, Patch
http://www.openwall.com/lists/oss-security/2011/08/19/16Exploit, Patch
http://www.securityfocus.com/bid/49235Exploit
https://bugs.gentoo.org/show_bug.cgi?id=379739Exploit, Patch
https://bugs.launchpad.net/ubuntu/+source/mantis/+bug/828857Exploit, Patch
https://bugzilla.redhat.com/show_bug.cgi?id=731777Exploit, Patch
https://github.com/mantisbt/mantisbt/commit/317f3db3a3c68775de3acf3b15f55b1e3c18f93bPatch
http://lists.fedoraproject.org/pipermail/package-announce/2011-September/066061.htmlExploit, Patch
http://packetstormsecurity.org/files/104149Exploit
http://secunia.com/advisories/51199
http://security.gentoo.org/glsa/glsa-201211-01.xml
http://securityreason.com/securityalert/8391
http://www.mantisbt.org/bugs/view.php?id=13245Exploit
http://www.openwall.com/lists/oss-security/2011/08/18/7Exploit, Patch
http://www.openwall.com/lists/oss-security/2011/08/19/16Exploit, Patch
http://www.securityfocus.com/bid/49235Exploit
https://bugs.gentoo.org/show_bug.cgi?id=379739Exploit, Patch
https://bugs.launchpad.net/ubuntu/+source/mantis/+bug/828857Exploit, Patch
https://bugzilla.redhat.com/show_bug.cgi?id=731777Exploit, Patch
https://github.com/mantisbt/mantisbt/commit/317f3db3a3c68775de3acf3b15f55b1e3c18f93bPatch

Timeline

Published: Sep 21, 2011
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-29395.1Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allo CVE-2011-29409.3stunnel 4.40 and 4.41 might allow remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via unspe CVE-2011-29415.8Open redirect vulnerability in Red Hat JBoss Enterprise Portal Platform before 5.2.0 allows remote attackers to redirect users to arbitrary CVE-2011-29426.8A certain Red Hat patch to the __br_deliver function in net/bridge/br_forward.c in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL CVE-2011-29434.3The irc_msg_who function in msgs.c in the IRC protocol plugin in libpurple 2.8.0 through 2.9.0 in Pidgin before 2.10.0 does not properly val CVE-2011-29447.5SQL injection vulnerability in login.php in MegaLab The Uploader before 2.0.5 allows remote attackers to execute arbitrary SQL commands via CVE-2011-29459.3Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5 and RealPlayer SP 1.0 through 1.1.5 allows CVE-2011-294610.0Unspecified vulnerability in an ActiveX control in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5, RealPlayer SP 1.0 th CVE-2011-29474.3Cross-zone scripting vulnerability in the RealPlayer ActiveX control in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5 CVE-2011-29489.3RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5, RealPlayer SP 1.0 through 1.1.5, RealPlayer Enterprise 2.0 through 2.1.CVE-2011-29499.3Heap-based buffer overflow in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5, RealPlayer SP 1.0 through 1.1.5, and Real CVE-2011-29509.3Heap-based buffer overflow in qcpfformat.dll in RealNetworks RealPlayer 11.0 through 11.1 and 14.0.0 through 14.0.5 and RealPlayer SP 1.0 th