Vulnerabilities (CVE)

Filtered by vendor Mantisbt Subscribe
Filtered by product Mantisbt
Total 110 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2014-9271 2 Debian, Mantisbt 2 Debian Linux, Mantisbt 2023-12-10 4.3 MEDIUM 5.4 MEDIUM
Cross-site scripting (XSS) vulnerability in file_download.php in MantisBT before 1.2.18 allows remote authenticated users to inject arbitrary web script or HTML via a Flash file with an image extension, related to inline attachments, as demonstrated by a .swf.jpeg filename.
CVE-2014-9388 1 Mantisbt 1 Mantisbt 2023-12-10 5.0 MEDIUM N/A
bug_report.php in MantisBT before 1.2.18 allows remote attackers to assign arbitrary issues via the handler_id parameter.
CVE-2014-9506 1 Mantisbt 1 Mantisbt 2023-12-10 3.5 LOW N/A
MantisBT before 1.2.18 does not properly check permissions when sending an email that indicates when a monitored issue is related to another issue, which allows remote authenticated users to obtain sensitive information about restricted issues.
CVE-2014-6387 1 Mantisbt 1 Mantisbt 2023-12-10 5.0 MEDIUM N/A
gpc_api.php in MantisBT 1.2.17 and earlier allows remote attackers to bypass authenticated via a password starting will a null byte, which triggers an unauthenticated bind.
CVE-2014-9571 1 Mantisbt 1 Mantisbt 2023-12-10 4.3 MEDIUM N/A
Cross-site scripting (XSS) vulnerability in admin/install.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote attackers to inject arbitrary web script or HTML via the (1) admin_username or (2) admin_password parameter.
CVE-2012-2691 1 Mantisbt 1 Mantisbt 2023-12-10 7.5 HIGH N/A
The mc_issue_note_update function in the SOAP API in MantisBT before 1.2.11 does not properly check privileges, which allows remote attackers with bug reporting privileges to edit arbitrary bugnotes via a SOAP request.
CVE-2012-1120 1 Mantisbt 1 Mantisbt 2023-12-10 3.6 LOW N/A
The SOAP API in MantisBT before 1.2.9 does not properly enforce the bugnote_allow_user_edit_delete and delete_bug_threshold permissions, which allows remote authenticated users with read and write SOAP API privileges to delete arbitrary bug reports and bug notes.
CVE-2012-5522 1 Mantisbt 1 Mantisbt 2023-12-10 5.5 MEDIUM N/A
MantisBT before 1.2.12 does not use an expected default value during decisions about whether a user may modify the status of a bug, which allows remote authenticated users to bypass intended access restrictions and make status changes by leveraging a blank value for a per-status setting.
CVE-2012-2692 1 Mantisbt 1 Mantisbt 2023-12-10 3.6 LOW N/A
MantisBT before 1.2.11 does not check the delete_attachments_threshold permission when form_security_validation is set to OFF, which allows remote authenticated users with certain privileges to bypass intended access restrictions and delete arbitrary attachments.
CVE-2012-5523 1 Mantisbt 1 Mantisbt 2023-12-10 5.5 MEDIUM N/A
core/email_api.php in MantisBT before 1.2.12 does not properly manage the sending of e-mail notifications about restricted bugs, which might allow remote authenticated users to obtain sensitive information by adding a note to a bug before losing permission to view that bug.
CVE-2012-1123 1 Mantisbt 1 Mantisbt 2023-12-10 7.5 HIGH N/A
The mci_check_login function in api/soap/mc_api.php in the SOAP API in MantisBT before 1.2.9 allows remote attackers to bypass authentication via a null password.
CVE-2012-1118 1 Mantisbt 1 Mantisbt 2023-12-10 4.3 MEDIUM N/A
The access_has_bug_level function in core/access_api.php in MantisBT before 1.2.9 does not properly restrict access when the private_bug_view_threshold is set to an array, which allows remote attackers to bypass intended restrictions and perform certain operations on private bug reports.
CVE-2012-1119 1 Mantisbt 1 Mantisbt 2023-12-10 6.4 MEDIUM N/A
MantisBT before 1.2.9 does not audit when users copy or clone a bug report, which makes it easier for remote attackers to copy bug reports without detection.
CVE-2012-1122 1 Mantisbt 1 Mantisbt 2023-12-10 3.6 LOW N/A
bug_actiongroup.php in MantisBT before 1.2.9 does not properly check the report_bug_threshold permission of the receiving project when moving a bug report, which allows remote authenticated users with the report_bug_threshold and move_bug_threshold privileges for a project to bypass intended access restrictions and move bug reports to a different project.
CVE-2012-1121 1 Mantisbt 1 Mantisbt 2023-12-10 4.9 MEDIUM N/A
MantisBT before 1.2.9 does not properly check permissions, which allows remote authenticated users with manager privileges to (1) modify or (2) delete global categories.
CVE-2013-4460 1 Mantisbt 1 Mantisbt 2023-12-10 3.5 LOW N/A
Cross-site scripting (XSS) vulnerability in account_sponsor_page.php in MantisBT 1.0.0 through 1.2.15 allows remote authenticated users to inject arbitrary web script or HTML via a project name.
CVE-2010-4349 1 Mantisbt 1 Mantisbt 2023-12-10 5.0 MEDIUM N/A
admin/upgrade_unattended.php in MantisBT before 1.2.4 allows remote attackers to obtain sensitive information via an invalid db_type parameter, which reveals the installation path in an error message, related to an unsafe call by MantisBT to a function in the ADOdb Library for PHP.
CVE-2011-3358 1 Mantisbt 1 Mantisbt 2023-12-10 4.3 MEDIUM N/A
Multiple cross-site scripting (XSS) vulnerabilities in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the (1) os, (2) os_build, or (3) platform parameter to (a) bug_report_page.php or (b) bug_update_advanced_page.php, related to use of the Projax library.
CVE-2011-3755 1 Mantisbt 1 Mantisbt 2023-12-10 5.0 MEDIUM N/A
MantisBT 1.2.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by view_all_inc.php and certain other files.
CVE-2011-2938 1 Mantisbt 1 Mantisbt 2023-12-10 4.3 MEDIUM N/A
Multiple cross-site scripting (XSS) vulnerabilities in filter_api.php in MantisBT before 1.2.7 allow remote attackers to inject arbitrary web script or HTML via a parameter, as demonstrated by the project_id parameter to search.php.