Mustafa Hasan

Name of the Vulnerable Software and Affected Versions: MantisBT versions 1.3.14 and earlier, 2.0.0 Description: An issue was discovered in MantisBT where any user with REPORTER access or above can view any private issue's details, including summary, description, steps to reproduce, and additional information, when cloning it by using a crafted request on the "bug report page.php" endpoint and modifying the `m id` parameter. By checking the 'Copy issue notes' and 'Copy attachments' checkboxes and completing the clone operation, this data also becomes public, except for private notes. Recommendations: For MantisBT versions 1.3.14 and earlier, consider restricting access to the "bug report page.php" endpoint until a patch is available. For MantisBT version 2.0.0, avoid using the `m id` parameter in the "bug report page.php" endpoint until the issue is resolved. As a temporary workaround, consider disabling the clone operation for private issues until a patch is available.

Name of the Vulnerable Software and Affected Versions: CMS Made Simple versions prior to 2.2.6 Description: A Cross-Site Request Forgery (CSRF) issue exists in the Admin profile page, which can be exploited via a specially crafted web page. Recommendations: For versions prior to 2.2.6, update to version 2.2.6 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: CMS Made Simple version 2.2.5 Description: The issue allows an authenticated admin with access to the file manager to execute code on the server. This can be exploited via file upload, where an attacker can copy files to any extension, potentially leading to remote code execution. Recommendations: For CMS Made Simple version 2.2.5, consider disabling the file manager feature until a patch is available to prevent potential exploitation. Restrict access to the file upload functionality to minimize the risk of remote code execution.

**Name of the Vulnerable Software and Affected Versions** Firefox versions prior to 51 **Description** The issue allows an attacker to determine the existence of a specifically requested local file due to the double firing of the `onerror` event when the `source` attribute on a `<track>` tag refers to a non-existent file, and the source page is loaded locally. **Recommendations** For versions prior to 51, update to version 51 or later to resolve the issue.