Vulnerabilities > Mantisbt

DATE CVE VULNERABILITY TITLE RISK
2021-01-18 CVE-2020-36192 Unspecified vulnerability in Mantisbt Source Integration
An issue was discovered in the Source Integration plugin before 2.4.1 for MantisBT.
network
low complexity
mantisbt
5.0
2020-12-30 CVE-2020-28413 SQL Injection vulnerability in Mantisbt 2.24.3
In MantisBT 2.24.3, SQL Injection can occur in the parameter "access" of the mc_project_get_users function through the API SOAP.
network
low complexity
mantisbt CWE-89
4.0
2020-12-30 CVE-2020-35849 Incorrect Authorization vulnerability in Mantisbt
An issue was discovered in MantisBT before 2.24.4.
network
low complexity
mantisbt CWE-863
5.0
2020-09-30 CVE-2020-25830 Cross-Site Scripting vulnerability in Mantisbt
An issue was discovered in MantisBT before 2.24.3.
network
mantisbt CWE-79
3.5
2020-09-30 CVE-2020-25781 Incorrect Authorization vulnerability in Mantisbt
An issue was discovered in file_download.php in MantisBT before 2.24.3.
network
low complexity
mantisbt CWE-863
4.0
2020-09-30 CVE-2020-25288 Cross-Site Scripting vulnerability in Mantisbt
An issue was discovered in MantisBT before 2.24.3.
network
mantisbt CWE-79
3.5
2020-08-12 CVE-2020-16266 Cross-Site Scripting vulnerability in Mantisbt
An XSS issue was discovered in MantisBT before 2.24.2.
network
mantisbt CWE-79
3.5
2020-03-19 CVE-2019-15539 Cross-Site Scripting vulnerability in Mantisbt
The proj_doc_edit_page.php Project Documentation feature in MantisBT before 2.21.3 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings permit it) after uploading an attachment with a crafted filename.
network
mantisbt CWE-79
4.3
2020-02-13 CVE-2020-8981 Cross-Site Scripting vulnerability in Mantisbt Source Integration
A cross-site scripting (XSS) vulnerability was discovered in the Source Integration plugin before 1.6.2 and 2.x before 2.3.1 for MantisBT.
network
mantisbt CWE-79
4.3
2019-11-09 CVE-2009-2802 Cross-Site Scripting vulnerability in Mantisbt 1.2.0/1.2.1
MantisBT 1.2.x before 1.2.2 insecurely handles attachments and MIME types.
network
mantisbt CWE-79
4.3