MA
Vendor
Mantis
43
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2008-4689 | MA Mantis Mantis | – | Oct 22 | Mantis before 1.1.3 does not unset the session cookie during logout, which makes it easier for remote attackers to hijack sessions |
| CVE-2008-4688 | MA Mantis Mantis | – | Oct 22 | core/string_api.php in Mantis before 1.1.3 does not check the privileges of the viewer before composing a link with issue data in the source anchor, which allows remote attackers… |
| CVE-2008-4687 | MA Mantis Mantis | – | Oct 22 | manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a sort parameter containing PHP sequences, which are processed by… |
| CVE-2008-3333 | MA Mantis Mantis | – | Jul 27 | Directory traversal vulnerability in core/lang_api.php in Mantis before 1.1.2 allows remote attackers to include and execute arbitrary files via the language parameter to the user… |
| CVE-2008-3332 | MA Mantis Mantis | – | Jul 27 | Eval injection vulnerability in adm_config_set.php in Mantis before 1.1.2 allows remote authenticated administrators to execute arbitrary code via the value parameter |
| CVE-2008-3331 | MA Mantis Mantis | – | Jul 27 | Cross-site scripting (XSS) vulnerability in return_dynamic_filters.php in Mantis before 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the filter_target… |
| CVE-2008-0404 | MA Mantis Mantis | – | Jan 23 | Cross-site scripting (XSS) vulnerability in Mantis before 1.1.1 allows remote attackers to inject arbitrary web script or HTML via vectors related to the "Most active bugs"… |
| CVE-2007-6611 | MA Mantis Mantis | – | Jan 3 | Cross-site scripting (XSS) vulnerability in view.php in Mantis before 1.1.0 allows remote attackers to inject arbitrary web script or HTML via a filename, related to… |
| CVE-2006-6574 | MA Mantis Mantis | – | Dec 15 | Mantis before 1.1.0a2 does not implement per-item access control for Issue History (Bug History), which allows remote attackers to obtain sensitive information by reading the… |
| CVE-2006-6515 | MA Mantis Mantis | – | Dec 14 | Mantis before 1.1.0a2 sets the default value of $g_bug_reminder_threshold to "reporter" instead of a more privileged role, which has unknown impact and attack vectors, possibly… |
| CVE-2006-1577 | MA Mantis Mantis | – | Apr 2 | Multiple cross-site scripting (XSS) vulnerabilities in view_all_set.php in Mantis 1.0.1, 1.0.0rc5, and earlier allow remote attackers to inject arbitrary web script or HTML via… |
| CVE-2006-0841 | MA Mantis Mantis | – | Feb 22 | Multiple cross-site scripting (XSS) vulnerabilities in Mantis 1.00rc4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) hide_status, (2)… |
| CVE-2006-0840 | MA Mantis Mantis | – | Feb 22 | manage_user_page.php in Mantis 1.00rc4 and earlier does not properly handle a sort parameter containing a ' (quote) character, which allows remote attackers to trigger a SQL error… |
| CVE-2006-0665 | MA Mantis Mantis | – | Feb 13 | Unspecified vulnerability in (1) query_store.php and (2) manage_proj_create.php in Mantis before 1.0.0 has unknown impact and attack vectors |
| CVE-2006-0664 | MA Mantis Mantis | – | Feb 13 | Cross-site scripting (XSS) vulnerability in config_defaults_inc.php in Mantis before 1.0 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors |
| CVE-2006-0147 | MA Mantis Mantis | – | Jan 9 | Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle,… |
| CVE-2006-0146 | MA Mantis Mantis | – | Jan 9 | The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PHPOpenChat, (7)… |
| CVE-2005-4520 | MA Mantis Mantis | – | Dec 28 | Unspecified "port injection" vulnerabilities in filters in Mantis 1.0.0rc3 and earlier have unknown impact and attack vectors |
| CVE-2005-4523 | MA Mantis Mantis | – | Dec 28 | Mantis 1.0.0rc3 and earlier discloses private bugs via public RSS feeds, which allows remote attackers to obtain sensitive information |
| CVE-2005-4522 | MA Mantis Mantis | – | Dec 28 | Multiple cross-site scripting (XSS) vulnerabilities in the view_filters_page.php filters script in Mantis 1.0.0rc3 and earlier allow remote attackers to inject arbitrary web… |
| CVE-2005-4519 | MA Mantis Mantis | – | Dec 28 | Multiple SQL injection vulnerabilities in the manage user page (manage_user_page.php) in Mantis 1.0.0rc3 and earlier allow remote attackers to execute arbitrary SQL commands via… |
| CVE-2005-4238 | MA Mantis Mantis | – | Dec 14 | Cross-site scripting (XSS) vulnerability in view_filters_page.php in Mantis 1.0.0rc3 and earlier allows remote attackers to inject arbitrary web script or HTML via the… |
| CVE-2005-3337 | MA Mantis Mantis | – | Oct 27 | Multiple cross-site scripting (XSS) vulnerabilities in Mantis before 0.19.3 allow remote attackers to inject arbitrary web script or HTML via (1) unknown vectors involving… |
| CVE-2005-3339 | MA Mantis Mantis | – | Oct 27 | Mantis before 0.19.3 caches the User ID longer than necessary, which has unknown impact and attack vectors |
| CVE-2005-3338 | MA Mantis Mantis | – | Oct 27 | Unspecified vulnerability in Mantis before 0.19.3, when using reminders, causes Mantis to display the real email addresses of users |
| CVE-2005-3336 | MA Mantis Mantis | – | Oct 27 | SQL injection vulnerability in Mantis 1.0.0RC2 and 0.19.2 allows remote attackers to execute arbitrary SQL commands via unknown vectors |
| CVE-2005-3335 | MA Mantis Mantis | – | Oct 27 | PHP file inclusion vulnerability in bug_sponsorship_list_view_inc.php in Mantis 1.0.0RC2 and 0.19.2 allows remote attackers to execute arbitrary PHP code and include arbitrary… |
| CVE-2005-3090 | MA Mantis Mantis | – | Sep 28 | Cross-site scripting (XSS) vulnerability in bug_actiongroup_page.php in Mantis 0.19.0a1 through 1.0.0a3 allows remote attackers to inject arbitrary web script or HTML via the… |
| CVE-2005-3091 | MA Mantis Mantis | – | Sep 28 | Cross-site scripting (XSS) vulnerability in Mantis before 1.0.0rc1 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors, as identified by… |
| CVE-2005-2557 | MA Mantis Mantis | – | Sep 28 | Cross-site scripting (XSS) vulnerability in view_all_set.php in Mantis 0.19.0a1 through 1.0.0a3 allows remote attackers to inject arbitrary web script or HTML via the dir… |
| CVE-2005-2556 | MA Mantis Mantis | – | Aug 24 | core/database_api.php in Mantis 0.19.0a1 through 1.0.0a3, with register_globals enabled, allows remote attackers to connect to internal databases by modifying the g_db_type… |
| CVE-2004-1734 | MA Mantis Mantis | – | Dec 31 | PHP remote file inclusion vulnerability in Mantis 0.19.0a allows remote attackers to execute arbitrary PHP code by modifying the (1) t_core_path parameter to bug_api.php or (2)… |
| CVE-2004-2666 | MA Mantis Mantis | – | Dec 31 | Mantis before 20041016 provides a complete Issue History (Bug History) in the web interface regardless of view_history_threshold, which allows remote attackers to obtain sensitive… |
| CVE-2004-1730 | MA Mantis Mantis | – | Dec 31 | Cross-site scripting (XSS) vulnerability in Mantis bugtracker allows remote attackers to inject arbitrary web script or HTML via (1) the return parameter to login_page.php, (2)… |
| CVE-2004-1731 | MA Mantis Mantis | – | Aug 20 | signup_page.php in Mantis bugtracker allows remote attackers to send e-mail bombs by creating multiple users and providing the same e-mail address |
| CVE-2003-0499 | MA Mantis Mantis | – | Aug 7 | Mantis 0.17.5 and earlier stores its database password in cleartext in a world-readable configuration file, which allows local users to perform unauthorized database operations |
| CVE-2002-1111 | MA Mantis Mantis | – | Oct 4 | print_all_bug_page.php in Mantis 0.17.3 and earlier does not verify the limit_reporters option, which allows remote attackers to view bug summaries for bugs that would otherwise… |
| CVE-2002-1116 | MA Mantis Mantis | – | Oct 4 | The "View Bugs" page (view_all_bug_page.php) in Mantis 0.17.4a and earlier includes summaries of private bugs for users that do not have access to any projects |
| CVE-2002-1115 | MA Mantis Mantis | – | Oct 4 | Mantis 0.17.4a and earlier allows remote attackers to view private bugs by modifying the f_id bug ID parameter to (1) bug_update_advanced_page.php, (2) bug_update_page.php, (3)… |
| CVE-2002-1114 | MA Mantis Mantis | – | Oct 4 | config_inc2.php in Mantis before 0.17.4 allows remote attackers to execute arbitrary code or read arbitrary files via the parameters (1) g_bottom_include_page, (2)… |
| CVE-2002-1113 | MA Mantis Mantis | – | Oct 4 | summary_graph_functions.php in Mantis 0.17.3 and earlier allows remote attackers to execute arbitrary PHP code by modifying the g_jpgraph_path parameter to reference the location… |
| CVE-2002-1112 | MA Mantis Mantis | – | Oct 4 | Mantis before 0.17.4 allows remote attackers to list project bugs without authentication by modifying the cookie that is used by the "View Bugs" page |
| CVE-2002-1110 | MA Mantis Mantis | – | Oct 4 | Multiple SQL injection vulnerabilities in Mantis 0.17.2 and earlier, when running without magic_quotes_gpc enabled, allows remote attackers to gain privileges or perform… |