Vulnerabilities (CVE)

Filtered by vendor Mantisbt Subscribe
Total 108 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2013-1930 2 Fedoraproject, Mantisbt 2 Fedora, Mantisbt 2019-11-07 4.0 MEDIUM 4.3 MEDIUM
MantisBT 1.2.12 before 1.2.15 allows authenticated users to by the workflow restriction and close issues.
CVE-2013-1931 2 Fedoraproject, Mantisbt 2 Fedora, Mantisbt 2019-11-07 4.3 MEDIUM 6.1 MEDIUM
A cross-site scripting (XSS) vulnerability in MantisBT 1.2.14 allows remote attackers to inject arbitrary web script or HTML via a version, related to deleting a version.
CVE-2013-1932 1 Mantisbt 1 Mantisbt 2019-11-06 3.5 LOW 5.4 MEDIUM
A cross-site scripting (XSS) vulnerability in the configuration report page (adm_config_report.php) in MantisBT 1.2.13 allows remote authenticated users to inject arbitrary web script or HTML via a project name.
CVE-2013-1934 2 Debian, Mantisbt 2 Debian Linux, Mantisbt 2019-11-01 3.5 LOW 5.4 MEDIUM
A cross-site scripting (XSS) vulnerability in the configuration report page (adm_config_report.php) in MantisBT 1.2.0rc1 before 1.2.14 allows remote authenticated users to inject arbitrary web script or HTML via a complex value.
CVE-2019-15074 1 Mantisbt 1 Mantisbt 2019-09-04 6.8 MEDIUM 9.6 CRITICAL
The Timeline feature in my_view_page.php in MantisBT through 2.21.1 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings permit it) after uploading an attachment with a crafted filename. The code is executed for any user having visibility to the issue, whenever My View Page is displayed.
CVE-2018-16514 1 Mantisbt 1 Mantisbt 2019-06-21 2.6 LOW 4.7 MEDIUM
A cross-site scripting (XSS) vulnerability in the View Filters page (view_filters_page.php) and Edit Filter page (manage_filter_edit_page.php) in MantisBT 2.1.0 through 2.17.0 allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted PATH_INFO. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-13055.
CVE-2018-9839 1 Mantisbt 1 Mantisbt 2019-06-09 4.0 MEDIUM 6.5 MEDIUM
An issue was discovered in MantisBT through 1.3.14, and 2.0.0. Using a crafted request on bug_report_page.php (modifying the 'm_id' parameter), any user with REPORTER access or above is able to view any private issue's details (summary, description, steps to reproduce, additional information) when cloning it. By checking the 'Copy issue notes' and 'Copy attachments' checkboxes and completing the clone operation, this data also becomes public (except private notes).
CVE-2017-6799 1 Mantisbt 1 Mantisbt 2019-03-19 4.3 MEDIUM 6.1 MEDIUM
A cross-site scripting (XSS) vulnerability in view_filters_page.php in MantisBT before 2.2.1 allows remote attackers to inject arbitrary JavaScript via the 'view_type' parameter.
CVE-2017-6797 1 Mantisbt 1 Mantisbt 2019-03-19 4.3 MEDIUM 6.1 MEDIUM
A cross-site scripting (XSS) vulnerability in bug_change_status_page.php in MantisBT before 1.3.7 and 2.x before 2.2.1 allows remote attackers to inject arbitrary JavaScript via the 'action_type' parameter.
CVE-2018-6382 1 Mantisbt 1 Mantisbt 2019-03-04 2.1 LOW 3.3 LOW
** DISPUTED ** MantisBT 2.10.0 allows local users to conduct SQL Injection attacks via the vendor/adodb/adodb-php/server.php sql parameter in a request to the 127.0.0.1 IP address. NOTE: the vendor disputes the significance of this report because server.php is intended to execute arbitrary SQL statements on behalf of authenticated users from 127.0.0.1, and the issue does not have an authentication bypass.
CVE-2018-17782 1 Mantisbt 1 Mantisbt 2018-12-07 3.5 LOW 5.4 MEDIUM
A cross-site scripting (XSS) vulnerability in the Manage Filters page (manage_filter_page.php) in MantisBT 2.1.0 through 2.17.1 allows remote attackers (if access rights permit it) to inject arbitrary code (if CSP settings permit it) through a crafted project name.
CVE-2018-17783 1 Mantisbt 1 Mantisbt 2018-12-07 3.5 LOW 5.4 MEDIUM
A cross-site scripting (XSS) vulnerability in the Edit Filter page (manage_filter_edit page.php) in MantisBT 2.1.0 through 2.17.1 allows remote attackers (if access rights permit it) to inject arbitrary code (if CSP settings permit it) through a crafted project name.
CVE-2008-3102 1 Mantisbt 1 Mantisbt 2018-10-11 5.0 MEDIUM N/A
Mantis 1.1.x through 1.1.2 and 1.2.x through 1.2.0a2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
CVE-2010-2574 1 Mantisbt 1 Mantisbt 2018-10-10 2.1 LOW N/A
Cross-site scripting (XSS) vulnerability in manage_proj_cat_add.php in MantisBT 1.2.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the name parameter in an Add Category action.
CVE-2011-3357 1 Mantisbt 1 Mantisbt 2018-10-09 6.8 MEDIUM N/A
Directory traversal vulnerability in bug_actiongroup_ext_page.php in MantisBT before 1.2.8 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the action parameter, related to bug_actiongroup_page.php.
CVE-2011-3358 1 Mantisbt 1 Mantisbt 2018-10-09 4.3 MEDIUM N/A
Multiple cross-site scripting (XSS) vulnerabilities in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the (1) os, (2) os_build, or (3) platform parameter to (a) bug_report_page.php or (b) bug_update_advanced_page.php, related to use of the Projax library.
CVE-2011-3578 1 Mantisbt 1 Mantisbt 2018-10-09 4.3 MEDIUM N/A
Cross-site scripting (XSS) vulnerability in bug_actiongroup_ext_page.php in MantisBT before 1.2.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter, related to bug_actiongroup_page.php, a different vulnerability than CVE-2011-3357.
CVE-2011-3356 1 Mantisbt 1 Mantisbt 2018-10-09 4.3 MEDIUM N/A
Multiple cross-site scripting (XSS) vulnerabilities in config_defaults_inc.php in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO, as demonstrated by the PATH_INFO to (1) manage_config_email_page.php, (2) manage_config_workflow_page.php, or (3) bugs/plugin.php.
CVE-2018-13055 1 Mantisbt 1 Mantisbt 2018-10-04 4.3 MEDIUM 6.1 MEDIUM
A cross-site scripting (XSS) vulnerability in the View Filters page (view_filters_page.php) in MantisBT 2.1.0 through 2.15.0 allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted PATH_INFO.
CVE-2018-14504 1 Mantisbt 1 Mantisbt 2018-10-02 4.3 MEDIUM 6.1 MEDIUM
An issue was discovered in manage_filter_edit_page.php in MantisBT 2.x through 2.15.0. A cross-site scripting (XSS) vulnerability in the Edit Filter page allows execution of arbitrary code (if CSP settings permit it) when displaying a filter with a crafted name (e.g., 'foobar" onclick="alert(1)').