MA
Product
Mantis
43
CVEs
0
On KEV
–
Max CVSS
0
New 30D
Severity mix
Critical 0High 0Medium 0Low 0
Watch
Add Mantis to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2008-4689 | – | Oct 22 | Mantis before 1.1.3 does not unset the session cookie during logout, which makes it easier for remote attackers to hijack sessions Affected: through 1.1.2; 0.19.3; 0.19.4; 1.0.1; 1.0.2; 1.0.3; +6 more |
| CVE-2008-4688 | – | Oct 22 | core/string_api.php in Mantis before 1.1.3 does not check the privileges of the viewer before composing a link with issue data in the source anchor, which allows remote attackers… Affected: through 1.1.3; 0.19.3; 0.19.4; 1.0.1; 1.0.2; 1.0.3; +7 more |
| CVE-2008-4687 | – | Oct 22 | manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a sort parameter containing PHP sequences, which are processed by… Affected: through 1.1.3; 0.19.3; 0.19.4; 1.0.1; 1.0.2; 1.0.3; +7 more |
| CVE-2008-3333 | – | Jul 27 | Directory traversal vulnerability in core/lang_api.php in Mantis before 1.1.2 allows remote attackers to include and execute arbitrary files via the language parameter to the user… Affected: through 1.1.1; 0.9; 0.9.0; 0.9.1; 0.10; 0.10.0; +34 more |
| CVE-2008-3332 | – | Jul 27 | Eval injection vulnerability in adm_config_set.php in Mantis before 1.1.2 allows remote authenticated administrators to execute arbitrary code via the value parameter Affected: through 1.1.1; 0.9; 0.9.0; 0.9.1; 0.10; 0.10.0; +34 more |
| CVE-2008-3331 | – | Jul 27 | Cross-site scripting (XSS) vulnerability in return_dynamic_filters.php in Mantis before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the filter_target… Affected: through 1.1.1; 0.9; 0.9.0; 0.9.1; 0.10; 0.10.0; +34 more |
| CVE-2008-0404 | – | Jan 23 | Cross-site scripting (XSS) vulnerability in Mantis before 1.1.1 allows remote attackers to inject arbitrary web script or HTML via vectors related to the "Most active bugs"… Affected: through 1.1.0; 0.9; 0.9.1; 0.10; 0.10.1; 0.10.2; +34 more |
| CVE-2007-6611 | – | Jan 3 | Cross-site scripting (XSS) vulnerability in view.php in Mantis before 1.1.0 allows remote attackers to inject arbitrary web script or HTML via a filename, related to… Affected: through 1.1.0a1 |
| CVE-2006-6574 | – | Dec 15 | Mantis before 1.1.0a2 does not implement per-item access control for Issue History (Bug History), which allows remote attackers to obtain sensitive information by reading the… Affected: through 1.1.0a1; 1.0.0; 1.0.0_rc1; 1.0.0_rc2; 1.0.0_rc3; 1.0.0_rc4; +10 more |
| CVE-2006-6515 | – | Dec 14 | Mantis before 1.1.0a2 sets the default value of $g_bug_reminder_threshold to "reporter" instead of a more privileged role, which has unknown impact and attack vectors, possibly… Affected: through 1.1.0a1; 1.0.0; 1.0.0_rc1; 1.0.0_rc2; 1.0.0_rc3; 1.0.0_rc4; +10 more |
| CVE-2006-1577 | – | Apr 2 | Multiple cross-site scripting (XSS) vulnerabilities in view_all_set.php in Mantis 1.0.1, 1.0.0rc5, and earlier allow remote attackers to inject arbitrary web script or HTML via… Affected: 1.0; 1.0.0_rc1; 1.0.0_rc2; 1.0.0_rc3; 1.0.0_rc4; 1.0.0a1; +3 more |
| CVE-2006-0841 | – | Feb 22 | Multiple cross-site scripting (XSS) vulnerabilities in Mantis 1.00rc4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) hide_status, (2)… Affected: 0.9; 0.9.0; 0.9.1; 0.10; 0.10.0; 0.10.1; +34 more |
| CVE-2006-0840 | – | Feb 22 | manage_user_page.php in Mantis 1.00rc4 and earlier does not properly handle a sort parameter containing a ' (quote) character, which allows remote attackers to trigger a SQL error… Affected: through 1.0.0_rc4; 0.9; 0.9.0; 0.9.1; 0.10; 0.10.0; +34 more |
| CVE-2006-0665 | – | Feb 13 | Unspecified vulnerability in (1) query_store.php and (2) manage_proj_create.php in Mantis before 1.0.0 has unknown impact and attack vectors Affected: 0.17.1; 0.17.2; 0.17.3; 0.17.4; 0.17.4a; 0.17.5; +24 more |
| CVE-2006-0664 | – | Feb 13 | Cross-site scripting (XSS) vulnerability in config_defaults_inc.php in Mantis before 1.0 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors Affected: 0.17.1; 0.17.2; 0.17.3; 0.17.4; 0.17.4a; 0.17.5; +24 more |
| CVE-2006-0147 | – | Jan 9 | Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle,… Affected: 0.19.4; 1.0.0_rc4 |
| CVE-2006-0146 | – | Jan 9 | The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PHPOpenChat, (7)… Affected: 0.19.4; 1.0.0_rc4 |
| CVE-2005-4520 | – | Dec 28 | Unspecified "port injection" vulnerabilities in filters in Mantis 1.0.0rc3 and earlier have unknown impact and attack vectors Affected: 1.0.0_rc1; 1.0.0_rc2; 1.0.0_rc3; 1.0.0a1; 1.0.0a2; 1.0.0a3 |
| CVE-2005-4523 | – | Dec 28 | Mantis 1.0.0rc3 and earlier discloses private bugs via public RSS feeds, which allows remote attackers to obtain sensitive information Affected: through 1.0.0_rc3; 0.9; 0.9.1; 0.10; 0.10.1; 0.10.2; +34 more |
| CVE-2005-4522 | – | Dec 28 | Multiple cross-site scripting (XSS) vulnerabilities in the view_filters_page.php filters script in Mantis 1.0.0rc3 and earlier allow remote attackers to inject arbitrary web… Affected: 1.0.0_rc1; 1.0.0_rc2; 1.0.0_rc3; 1.0.0a1; 1.0.0a2; 1.0.0a3 |
| CVE-2005-4519 | – | Dec 28 | Multiple SQL injection vulnerabilities in the manage user page (manage_user_page.php) in Mantis 1.0.0rc3 and earlier allow remote attackers to execute arbitrary SQL commands via… Affected: through 0.19.3; through 1.0.0_rc3; 0.9; 0.9.1; 0.10; 0.10.1; +34 more |
| CVE-2005-4238 | – | Dec 14 | Cross-site scripting (XSS) vulnerability in view_filters_page.php in Mantis 1.0.0rc3 and earlier allows remote attackers to inject arbitrary web script or HTML via the… Affected: 0.9; 0.9.1; 0.10; 0.10.1; 0.10.2; 0.11; +34 more |
| CVE-2005-3337 | – | Oct 27 | Multiple cross-site scripting (XSS) vulnerabilities in Mantis before 0.19.3 allow remote attackers to inject arbitrary web script or HTML via (1) unknown vectors involving… Affected: 0.19.0; 0.19.0_rc1; 0.19.0a1; 0.19.0a2; 0.19.1; 0.19.2; +1 more |
| CVE-2005-3339 | – | Oct 27 | Mantis before 0.19.3 caches the User ID longer than necessary, which has unknown impact and attack vectors Affected: 0.19.0; 0.19.0_rc1; 0.19.0a1; 0.19.0a2; 0.19.1; 0.19.2; +1 more |
| CVE-2005-3338 | – | Oct 27 | Unspecified vulnerability in Mantis before 0.19.3, when using reminders, causes Mantis to display the real email addresses of users Affected: 0.19.0; 0.19.0_rc1; 0.19.0a1; 0.19.0a2; 0.19.1; 0.19.2; +1 more |
| CVE-2005-3336 | – | Oct 27 | SQL injection vulnerability in Mantis 1.0.0RC2 and 0.19.2 allows remote attackers to execute arbitrary SQL commands via unknown vectors Affected: 0.19.2; 1.0.0_rc2 |
| CVE-2005-3335 | – | Oct 27 | PHP file inclusion vulnerability in bug_sponsorship_list_view_inc.php in Mantis 1.0.0RC2 and 0.19.2 allows remote attackers to execute arbitrary PHP code and include arbitrary… Affected: 0.19.2; 1.0.0_rc2 |
| CVE-2005-3090 | – | Sep 28 | Cross-site scripting (XSS) vulnerability in bug_actiongroup_page.php in Mantis 0.19.0a1 through 1.0.0a3 allows remote attackers to inject arbitrary web script or HTML via the… Affected: 0.19.0; 0.19.0_rc1; 0.19.0a1; 0.19.0a2; 0.19.1; 0.19.2; +3 more |
| CVE-2005-3091 | – | Sep 28 | Cross-site scripting (XSS) vulnerability in Mantis before 1.0.0rc1 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors, as identified by… Affected: 0.9.0; 0.9.1; 0.10.0; 0.10.1; 0.10.2; 0.11.0; +34 more |
| CVE-2005-2557 | – | Sep 28 | Cross-site scripting (XSS) vulnerability in view_all_set.php in Mantis 0.19.0a1 through 1.0.0a3 allows remote attackers to inject arbitrary web script or HTML via the dir… Affected: 0.19.0; 0.19.0_rc1; 0.19.0a1; 0.19.0a2; 0.19.1; 0.19.2; +3 more |
| CVE-2005-2556 | – | Aug 24 | core/database_api.php in Mantis 0.19.0a1 through 1.0.0a3, with register_globals enabled, allows remote attackers to connect to internal databases by modifying the g_db_type… Affected: 0.19.0; 0.19.0_rc1; 0.19.0a1; 0.19.0a2; 0.19.1; 0.19.2; +3 more |
| CVE-2004-1734 | – | Dec 31 | PHP remote file inclusion vulnerability in Mantis 0.19.0a allows remote attackers to execute arbitrary PHP code by modifying the (1) t_core_path parameter to bug_api.php or (2)… Affected: 0.19.0a |
| CVE-2004-2666 | – | Dec 31 | Mantis before 20041016 provides a complete Issue History (Bug History) in the web interface regardless of view_history_threshold, which allows remote attackers to obtain sensitive… Affected: 0.9; 0.9.1; 0.10; 0.10.1; 0.10.2; 0.11; +34 more |
| CVE-2004-1730 | – | Dec 31 | Cross-site scripting (XSS) vulnerability in Mantis bugtracker allows remote attackers to inject arbitrary web script or HTML via (1) the return parameter to login_page.php, (2)… Affected: 0.9; 0.9.1; 0.10; 0.10.1; 0.10.2; 0.11; +34 more |
| CVE-2004-1731 | – | Aug 20 | signup_page.php in Mantis bugtracker allows remote attackers to send e-mail bombs by creating multiple users and providing the same e-mail address Affected: 0.9; 0.9.1; 0.10; 0.10.1; 0.10.2; 0.11; +34 more |
| CVE-2003-0499 | – | Aug 7 | Mantis 0.17.5 and earlier stores its database password in cleartext in a world-readable configuration file, which allows local users to perform unauthorized database operations Affected: 0.17.5 |
| CVE-2002-1111 | – | Oct 4 | print_all_bug_page.php in Mantis 0.17.3 and earlier does not verify the limit_reporters option, which allows remote attackers to view bug summaries for bugs that would otherwise… Affected: 0.16.0; 0.16.1; 0.17.0; 0.17.1; 0.17.2; 0.17.3 |
| CVE-2002-1116 | – | Oct 4 | The "View Bugs" page (view_all_bug_page.php) in Mantis 0.17.4a and earlier includes summaries of private bugs for users that do not have access to any projects Affected: 0.17.0; 0.17.1; 0.17.2; 0.17.3; 0.17.4; 0.17.4a |
| CVE-2002-1115 | – | Oct 4 | Mantis 0.17.4a and earlier allows remote attackers to view private bugs by modifying the f_id bug ID parameter to (1) bug_update_advanced_page.php, (2) bug_update_page.php, (3)… Affected: 0.17.0; 0.17.1; 0.17.2; 0.17.3; 0.17.4; 0.17.4a |
| CVE-2002-1114 | – | Oct 4 | config_inc2.php in Mantis before 0.17.4 allows remote attackers to execute arbitrary code or read arbitrary files via the parameters (1) g_bottom_include_page, (2)… Affected: 0.17.0; 0.17.1; 0.17.2; 0.17.3 |
| CVE-2002-1113 | – | Oct 4 | summary_graph_functions.php in Mantis 0.17.3 and earlier allows remote attackers to execute arbitrary PHP code by modifying the g_jpgraph_path parameter to reference the location… Affected: 0.15.3; 0.15.4; 0.15.5; 0.15.6; 0.15.7; 0.15.8; +10 more |
| CVE-2002-1112 | – | Oct 4 | Mantis before 0.17.4 allows remote attackers to list project bugs without authentication by modifying the cookie that is used by the "View Bugs" page Affected: 0.15.3; 0.15.4; 0.15.5; 0.15.6; 0.15.7; 0.15.8; +10 more |
| CVE-2002-1110 | – | Oct 4 | Multiple SQL injection vulnerabilities in Mantis 0.17.2 and earlier, when running without magic_quotes_gpc enabled, allows remote attackers to gain privileges or perform… Affected: 0.15.3; 0.15.4; 0.15.5; 0.15.6; 0.15.7; 0.15.8; +9 more |
Showing 43