MA
Product
mantisbt
140
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 4High 16Medium 65Low 1
Watch
Add mantisbt to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2014-9270 | – | Dec 8 | Cross-site scripting (XSS) vulnerability in the projax_array_serialize_for_autocomplete function in core/projax_api.php in MantisBT 1.1.0a3 through 1.2.17 allows remote attackers… Affected: 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; +34 more |
| CVE-2014-9117 | – | Dec 6 | MantisBT before 1.2.18 uses the public_key parameter value as the key to the CAPTCHA answer, which allows remote attackers to bypass the CAPTCHA protection mechanism by leveraging… Affected: through 1.2.17 |
| CVE-2014-9089 | – | Nov 28 | Multiple SQL injection vulnerabilities in view_all_bug_page.php in MantisBT before 1.2.18 allow remote attackers to execute arbitrary SQL commands via the (1) sort or (2) dir… Affected: through 1.2.17 |
| CVE-2014-8988 | – | Nov 24 | MantisBT before 1.2.18 allows remote authenticated users to bypass the $g_download_attachments_threshold and $g_view_attachments_threshold restrictions and read attachments for… Affected: 1.2.17 |
| CVE-2014-8986 | – | Nov 24 | Cross-site scripting (XSS) vulnerability in the selection list in the filters in the Configuration Report page (adm_config_report.php) in MantisBT 1.2.13 through 1.2.17 allows… Affected: 1.2.13; 1.2.14; 1.2.15; 1.2.16; 1.2.17 |
| CVE-2014-8598 | – | Nov 18 | The XML Import/Export plugin in MantisBT 1.2.x does not restrict access, which allows remote attackers to (1) upload arbitrary XML files via the import page or (2) obtain… Affected: through 1.2.17 |
| CVE-2014-7146 | – | Nov 18 | The XmlImportExport plugin in MantisBT 1.2.17 and earlier allows remote attackers to execute arbitrary PHP code via a crafted (1) description field or (2) issuelink attribute in… Affected: 1.2.17 |
| CVE-2014-8554 | – | Nov 13 | SQL injection vulnerability in the mc_project_get_attachments function in api/soap/mc_project_api.php in MantisBT before 1.2.18 allows remote attackers to execute arbitrary SQL… Affected: through 1.2.17; 0.18.0; 0.19.0; 0.19.0; 0.19.0; 0.19.0; +34 more |
| CVE-2014-6387 | – | Oct 22 | gpc_api.php in MantisBT 1.2.17 and earlier allows remote attackers to bypass authenticated via a password starting will a null byte, which triggers an unauthenticated bind Affected: through 1.2.17; 1.2.0; 1.2.0; 1.2.0; 1.2.0; 1.2.0; +17 more |
| CVE-2013-1883 | – | May 27 | Mantis Bug Tracker (aka MantisBT) 1.2.12 before 1.2.15 allows remote attackers to cause a denial of service (resource consumption) via a filter using a criteria, text search, and… Affected: 1.2.12; 1.2.13; 1.2.14 |
| CVE-2013-1810 | – | May 15 | Multiple cross-site scripting (XSS) vulnerabilities in core/summary_api.php in MantisBT 1.2.12 allow remote authenticated users with manager or administrator permissions to inject… Affected: 1.2.12 |
| CVE-2013-0197 | – | May 15 | Cross-site scripting (XSS) vulnerability in the filter_draw_selection_area2 function in core/filter_api.php in MantisBT 1.2.12 before 1.2.13 allows remote attackers to inject… Affected: 1.2.12; 1.2.13 |
| CVE-2014-1609 | – | Mar 20 | Multiple SQL injection vulnerabilities in MantisBT before 1.2.16 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to the (1)… Affected: through 1.2.15; 1.2.0; 1.2.0; 1.2.0; 1.2.0; 1.2.0; +14 more |
| CVE-2014-1608 | – | Mar 18 | SQL injection vulnerability in the mci_file_get function in api/soap/mc_file_api.php in MantisBT before 1.2.16 allows remote attackers to execute arbitrary SQL commands via a… Affected: through 1.2.15; 1.2.0; 1.2.0; 1.2.0; 1.2.0; 1.2.0; +14 more |
| CVE-2014-2238 | – | Mar 5 | SQL injection vulnerability in the manage configuration page (adm_config_report.php) in MantisBT 1.2.13 through 1.2.16 allows remote authenticated administrators to execute… Affected: 1.2.13; 1.2.14; 1.2.15; 1.2.16 |
| CVE-2013-4460 | – | Jan 10 | Cross-site scripting (XSS) vulnerability in account_sponsor_page.php in MantisBT 1.0.0 through 1.2.15 allows remote authenticated users to inject arbitrary web script or HTML via… Affected: 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; 1.0.0; +34 more |
| CVE-2012-5523 | – | Nov 16 | core/email_api.php in MantisBT before 1.2.12 does not properly manage the sending of e-mail notifications about restricted bugs, which might allow remote authenticated users to… Affected: through 1.2.11; 0.18.0; 0.19.0; 0.19.0; 0.19.0; 0.19.0; +34 more |
| CVE-2012-5522 | – | Nov 16 | MantisBT before 1.2.12 does not use an expected default value during decisions about whether a user may modify the status of a bug, which allows remote authenticated users to… Affected: through 1.2.11; 0.18.0; 0.19.0; 0.19.0; 0.19.0; 0.19.0; +34 more |
| CVE-2012-1123 | – | Jun 29 | The mci_check_login function in api/soap/mc_api.php in the SOAP API in MantisBT before 1.2.9 allows remote attackers to bypass authentication via a null password Affected: through 1.2.8; 0.18.0; 0.19.0; 0.19.0; 0.19.0; 0.19.0; +34 more |
| CVE-2012-1122 | – | Jun 29 | bug_actiongroup.php in MantisBT before 1.2.9 does not properly check the report_bug_threshold permission of the receiving project when moving a bug report, which allows remote… Affected: through 1.2.8; 0.18.0; 0.19.0; 0.19.0; 0.19.0a1; 0.19.0a2; +34 more |
| CVE-2012-1121 | – | Jun 29 | MantisBT before 1.2.9 does not properly check permissions, which allows remote authenticated users with manager privileges to (1) modify or (2) delete global categories Affected: through 1.2.8; 0.18.0; 0.19.0; 0.19.0; 0.19.0; 0.19.0; +34 more |
| CVE-2012-1120 | – | Jun 29 | The SOAP API in MantisBT before 1.2.9 does not properly enforce the bugnote_allow_user_edit_delete and delete_bug_threshold permissions, which allows remote authenticated users… Affected: through 1.2.8; 0.18.0; 0.19.0; 0.19.0; 0.19.0; 0.19.0; +34 more |
| CVE-2012-1119 | – | Jun 29 | MantisBT before 1.2.9 does not audit when users copy or clone a bug report, which makes it easier for remote attackers to copy bug reports without detection Affected: through 1.2.8; 0.18.0; 0.19.0; 0.19.0; 0.19.0; 0.19.0; +34 more |
| CVE-2012-1118 | – | Jun 29 | The access_has_bug_level function in core/access_api.php in MantisBT before 1.2.9 does not properly restrict access when the private_bug_view_threshold is set to an array, which… Affected: through 1.2.8; 0.18.0; 0.19.0; 0.19.0; 0.19.0a1; 0.19.0a2; +34 more |
| CVE-2012-2692 | – | Jun 17 | MantisBT before 1.2.11 does not check the delete_attachments_threshold permission when form_security_validation is set to OFF, which allows remote authenticated users with certain… Affected: through 1.2.10; 0.18.0; 0.19.0; 0.19.0; 0.19.0; 0.19.0; +34 more |
| CVE-2012-2691 | – | Jun 17 | The mc_issue_note_update function in the SOAP API in MantisBT before 1.2.11 does not properly check privileges, which allows remote attackers with bug reporting privileges to edit… Affected: through 1.2.10; 0.18.0; 0.19.0; 0.19.0; 0.19.0; 0.19.0; +34 more |
| CVE-2011-3755 | – | Sep 23 | MantisBT 1.2.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as… Affected: 1.2.4 |
| CVE-2011-3578 | – | Sep 21 | Cross-site scripting (XSS) vulnerability in bug_actiongroup_ext_page.php in MantisBT before 1.2.8 allows remote attackers to inject arbitrary web script or HTML via the action… Affected: through 1.2.7; 0.19.3; 0.19.4; 1.0.0; 1.0.1; 1.0.2; +21 more |
| CVE-2011-3358 | – | Sep 21 | Multiple cross-site scripting (XSS) vulnerabilities in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the (1) os, (2) os_build, or (3)… Affected: through 1.2.7; 0.19.3; 0.19.4; 1.0.0; 1.0.1; 1.0.2; +21 more |
| CVE-2011-3357 | – | Sep 21 | Directory traversal vulnerability in bug_actiongroup_ext_page.php in MantisBT before 1.2.8 allows remote attackers to include and execute arbitrary local files via a Affected: through 1.2.7; 0.19.3; 0.19.4; 1.0.0; 1.0.1; 1.0.2; +21 more |
| CVE-2011-3356 | – | Sep 21 | Multiple cross-site scripting (XSS) vulnerabilities in config_defaults_inc.php in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the… Affected: through 1.2.7; 0.19.3; 0.19.4; 1.0.0; 1.0.1; 1.0.2; +21 more |
| CVE-2011-2938 | – | Sep 21 | Multiple cross-site scripting (XSS) vulnerabilities in filter_api.php in MantisBT before 1.2.7 allow remote attackers to inject arbitrary web script or HTML via a parameter, as… Affected: through 1.2.6; 0.19.3; 0.19.4; 1.0.0; 1.0.1; 1.0.2; +20 more |
| CVE-2010-4350 | – | Jan 3 | Directory traversal vulnerability in admin/upgrade_unattended.php in MantisBT before 1.2.4 allows remote attackers to include and execute arbitrary local files via a Affected: through 1.2.3; 0.18.0; 0.19.0; 0.19.0; 0.19.0a1; 0.19.0a2; +33 more |
| CVE-2010-4349 | – | Jan 3 | admin/upgrade_unattended.php in MantisBT before 1.2.4 allows remote attackers to obtain sensitive information via an invalid db_type parameter, which reveals the installation path… Affected: through 1.2.3; 0.18.0; 0.19.0; 0.19.0; 0.19.0a1; 0.19.0a2; +33 more |
| CVE-2010-4348 | – | Jan 3 | Cross-site scripting (XSS) vulnerability in admin/upgrade_unattended.php in MantisBT before 1.2.4 allows remote attackers to inject arbitrary web script or HTML via the db_type… Affected: through 1.2.3; 0.18.0; 0.19.0; 0.19.0; 0.19.0a1; 0.19.0a2; +33 more |
| CVE-2010-3763 | – | Oct 5 | Cross-site scripting (XSS) vulnerability in core/summary_api.php in MantisBT before 1.2.3 allows remote attackers to inject arbitrary web script or HTML via the Summary field, a… Affected: through 1.2.2; 0.18.0; 0.19.0; 0.19.0; 0.19.0a1; 0.19.0a2; +32 more |
| CVE-2010-3303 | – | Oct 5 | Multiple cross-site scripting (XSS) vulnerabilities in MantisBT before 1.2.3 allow remote authenticated administrators to inject arbitrary web script or HTML via (1) a plugin… Affected: through 1.2.2; 0.18.0; 0.19.0; 0.19.0; 0.19.0a1; 0.19.0a2; +32 more |
| CVE-2010-2802 | – | Sep 7 | Cross-site scripting (XSS) vulnerability in MantisBT before 1.2.2 allows remote authenticated users to inject arbitrary web script or HTML via an HTML document with a .gif… Affected: through 1.2.1; 0.18.0; 0.19.0; 0.19.0; 0.19.0a1; 0.19.0a2; +31 more |
| CVE-2010-2574 | – | Aug 10 | Cross-site scripting (XSS) vulnerability in manage_proj_cat_add.php in MantisBT 1.2.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the… Affected: 1.2.2 |
| CVE-2008-3102 | – | Sep 24 | Mantis 1.1.x through 1.1.2 and 1.2.x through 1.2.0a2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http… Affected: 1.1.0; 1.1.1; 1.1.2; 1.2.0a1; 1.2.0a2 |