Search Results (Refine Search)
- Results Type: Overview
- Keyword (text search): cpe:2.3:a:mantisbt:mantisbt:1.0.0:rc5:*:*:*:*:*:*
Vuln ID | Summary | CVSS Severity |
---|---|---|
CVE-2014-9279 |
The print_test_result function in admin/upgrade_unattended.php in MantisBT 1.1.0a3 through 1.2.x before 1.2.18 allows remote attackers to obtain database credentials via a URL in the hostname parameter and reading the parameters in the response sent to the URL. Published: December 08, 2014; 11:59:12 AM -0500 |
V3.x:(not available) V2.0: 5.0 MEDIUM |
CVE-2014-9270 |
Cross-site scripting (XSS) vulnerability in the projax_array_serialize_for_autocomplete function in core/projax_api.php in MantisBT 1.1.0a3 through 1.2.17 allows remote attackers to inject arbitrary web script or HTML via the "profile/Platform" field. Published: December 08, 2014; 11:59:10 AM -0500 |
V3.x:(not available) V2.0: 4.3 MEDIUM |
CVE-2014-8554 |
SQL injection vulnerability in the mc_project_get_attachments function in api/soap/mc_project_api.php in MantisBT before 1.2.18 allows remote attackers to execute arbitrary SQL commands via the project_id parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1609. Published: November 13, 2014; 4:32:11 PM -0500 |
V3.x:(not available) V2.0: 7.5 HIGH |
CVE-2013-4460 |
Cross-site scripting (XSS) vulnerability in account_sponsor_page.php in MantisBT 1.0.0 through 1.2.15 allows remote authenticated users to inject arbitrary web script or HTML via a project name. Published: January 10, 2014; 10:55:03 AM -0500 |
V3.x:(not available) V2.0: 3.5 LOW |
CVE-2012-5523 |
core/email_api.php in MantisBT before 1.2.12 does not properly manage the sending of e-mail notifications about restricted bugs, which might allow remote authenticated users to obtain sensitive information by adding a note to a bug before losing permission to view that bug. Published: November 15, 2012; 7:55:01 PM -0500 |
V3.x:(not available) V2.0: 5.5 MEDIUM |
CVE-2012-5522 |
MantisBT before 1.2.12 does not use an expected default value during decisions about whether a user may modify the status of a bug, which allows remote authenticated users to bypass intended access restrictions and make status changes by leveraging a blank value for a per-status setting. Published: November 15, 2012; 7:55:01 PM -0500 |
V3.x:(not available) V2.0: 5.5 MEDIUM |
CVE-2012-1123 |
The mci_check_login function in api/soap/mc_api.php in the SOAP API in MantisBT before 1.2.9 allows remote attackers to bypass authentication via a null password. Published: June 29, 2012; 3:55:03 PM -0400 |
V3.x:(not available) V2.0: 7.5 HIGH |
CVE-2012-1122 |
bug_actiongroup.php in MantisBT before 1.2.9 does not properly check the report_bug_threshold permission of the receiving project when moving a bug report, which allows remote authenticated users with the report_bug_threshold and move_bug_threshold privileges for a project to bypass intended access restrictions and move bug reports to a different project. Published: June 29, 2012; 3:55:03 PM -0400 |
V3.x:(not available) V2.0: 3.6 LOW |
CVE-2012-1121 |
MantisBT before 1.2.9 does not properly check permissions, which allows remote authenticated users with manager privileges to (1) modify or (2) delete global categories. Published: June 29, 2012; 3:55:03 PM -0400 |
V3.x:(not available) V2.0: 4.9 MEDIUM |
CVE-2012-1120 |
The SOAP API in MantisBT before 1.2.9 does not properly enforce the bugnote_allow_user_edit_delete and delete_bug_threshold permissions, which allows remote authenticated users with read and write SOAP API privileges to delete arbitrary bug reports and bug notes. Published: June 29, 2012; 3:55:02 PM -0400 |
V3.x:(not available) V2.0: 3.6 LOW |
CVE-2012-1119 |
MantisBT before 1.2.9 does not audit when users copy or clone a bug report, which makes it easier for remote attackers to copy bug reports without detection. Published: June 29, 2012; 3:55:02 PM -0400 |
V3.x:(not available) V2.0: 6.4 MEDIUM |
CVE-2012-1118 |
The access_has_bug_level function in core/access_api.php in MantisBT before 1.2.9 does not properly restrict access when the private_bug_view_threshold is set to an array, which allows remote attackers to bypass intended restrictions and perform certain operations on private bug reports. Published: June 29, 2012; 3:55:02 PM -0400 |
V3.x:(not available) V2.0: 4.3 MEDIUM |
CVE-2012-2692 |
MantisBT before 1.2.11 does not check the delete_attachments_threshold permission when form_security_validation is set to OFF, which allows remote authenticated users with certain privileges to bypass intended access restrictions and delete arbitrary attachments. Published: June 16, 2012; 11:41:41 PM -0400 |
V3.x:(not available) V2.0: 3.6 LOW |
CVE-2012-2691 |
The mc_issue_note_update function in the SOAP API in MantisBT before 1.2.11 does not properly check privileges, which allows remote attackers with bug reporting privileges to edit arbitrary bugnotes via a SOAP request. Published: June 16, 2012; 11:41:41 PM -0400 |
V3.x:(not available) V2.0: 7.5 HIGH |
CVE-2010-4350 |
Directory traversal vulnerability in admin/upgrade_unattended.php in MantisBT before 1.2.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the db_type parameter, related to an unsafe call by MantisBT to a function in the ADOdb Library for PHP. Published: January 03, 2011; 3:00:43 PM -0500 |
V3.x:(not available) V2.0: 5.1 MEDIUM |
CVE-2010-4349 |
admin/upgrade_unattended.php in MantisBT before 1.2.4 allows remote attackers to obtain sensitive information via an invalid db_type parameter, which reveals the installation path in an error message, related to an unsafe call by MantisBT to a function in the ADOdb Library for PHP. Published: January 03, 2011; 3:00:43 PM -0500 |
V3.x:(not available) V2.0: 5.0 MEDIUM |
CVE-2010-4348 |
Cross-site scripting (XSS) vulnerability in admin/upgrade_unattended.php in MantisBT before 1.2.4 allows remote attackers to inject arbitrary web script or HTML via the db_type parameter, related to an unsafe call by MantisBT to a function in the ADOdb Library for PHP. Published: January 03, 2011; 3:00:42 PM -0500 |
V3.x:(not available) V2.0: 4.3 MEDIUM |
CVE-2010-3763 |
Cross-site scripting (XSS) vulnerability in core/summary_api.php in MantisBT before 1.2.3 allows remote attackers to inject arbitrary web script or HTML via the Summary field, a different vector than CVE-2010-3303. Published: October 05, 2010; 6:00:06 PM -0400 |
V3.x:(not available) V2.0: 4.3 MEDIUM |
CVE-2010-3303 |
Multiple cross-site scripting (XSS) vulnerabilities in MantisBT before 1.2.3 allow remote authenticated administrators to inject arbitrary web script or HTML via (1) a plugin name, related to manage_plugin_uninstall.php; (2) an enumeration value or (3) a String value of a custom field, related to core/cfdefs/cfdef_standard.php; or a (4) project or (5) category name to print_all_bug_page_word.php. Published: October 05, 2010; 6:00:05 PM -0400 |
V3.x:(not available) V2.0: 3.5 LOW |
CVE-2010-2802 |
Cross-site scripting (XSS) vulnerability in MantisBT before 1.2.2 allows remote authenticated users to inject arbitrary web script or HTML via an HTML document with a .gif filename extension, related to inline attachments. Published: September 07, 2010; 1:00:01 PM -0400 |
V3.x:(not available) V2.0: 3.5 LOW |