Vboctor

**Name of the Vulnerable Software and Affected Versions** MantisBT versions prior to 2.26.2 **Description** The issue affects MantisBT, an open source issue tracker, where an issue referencing a note from another issue that the user does not have access to becomes hyperlinked. Although clicking the link results in an access denied error, some information remains accessible via the link, link label, and tooltip. This can lead to the disclosure of the note's existence, the note author's name, the note creation timestamp, and the issue ID the note belongs to. **Recommendations** For versions prior to 2.26.2, update to version 2.26.2 to resolve the issue. As a temporary workaround, consider restricting access to hyperlinked notes to minimize the risk of information disclosure.

**Name of the Vulnerable Software and Affected Versions** MantisBT versions prior to 2.1.1 **Description** A cross-site scripting (XSS) issue exists due to insufficient protection of the web page structure. This allows a remote attacker to inject arbitrary HTML or JavaScript code by modifying the `window title` in the application configuration, which requires administrator access rights or alteration of the system configuration file (config inc.php). **Recommendations** For versions prior to 2.1.1, update to version 2.1.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the MantisBT configuration management pages to prevent unauthorized modifications to the `window title` setting.