Vulnerabilities > Mantisbt > Mantisbt > 1.2.5
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2012-06-29 | CVE-2012-1120 | Permissions, Privileges, and Access Controls vulnerability in Mantisbt The SOAP API in MantisBT before 1.2.9 does not properly enforce the bugnote_allow_user_edit_delete and delete_bug_threshold permissions, which allows remote authenticated users with read and write SOAP API privileges to delete arbitrary bug reports and bug notes. | 3.6 |
| 2012-06-29 | CVE-2012-1119 | Permissions, Privileges, and Access Controls vulnerability in Mantisbt MantisBT before 1.2.9 does not audit when users copy or clone a bug report, which makes it easier for remote attackers to copy bug reports without detection. | 6.4 |
| 2012-06-29 | CVE-2012-1118 | Permissions, Privileges, and Access Controls vulnerability in Mantisbt The access_has_bug_level function in core/access_api.php in MantisBT before 1.2.9 does not properly restrict access when the private_bug_view_threshold is set to an array, which allows remote attackers to bypass intended restrictions and perform certain operations on private bug reports. | 4.3 |
| 2012-06-17 | CVE-2012-2692 | Permissions, Privileges, and Access Controls vulnerability in Mantisbt MantisBT before 1.2.11 does not check the delete_attachments_threshold permission when form_security_validation is set to OFF, which allows remote authenticated users with certain privileges to bypass intended access restrictions and delete arbitrary attachments. | 3.6 |
| 2012-06-17 | CVE-2012-2691 | Permissions, Privileges, and Access Controls vulnerability in Mantisbt The mc_issue_note_update function in the SOAP API in MantisBT before 1.2.11 does not properly check privileges, which allows remote attackers with bug reporting privileges to edit arbitrary bugnotes via a SOAP request. | 7.5 |
| 2011-09-21 | CVE-2011-3578 | Cross-Site Scripting vulnerability in Mantisbt Cross-site scripting (XSS) vulnerability in bug_actiongroup_ext_page.php in MantisBT before 1.2.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter, related to bug_actiongroup_page.php, a different vulnerability than CVE-2011-3357. | 4.3 |
| 2011-09-21 | CVE-2011-3358 | Cross-Site Scripting vulnerability in Mantisbt Multiple cross-site scripting (XSS) vulnerabilities in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the (1) os, (2) os_build, or (3) platform parameter to (a) bug_report_page.php or (b) bug_update_advanced_page.php, related to use of the Projax library. | 4.3 |
| 2011-09-21 | CVE-2011-3357 | Path Traversal vulnerability in Mantisbt Directory traversal vulnerability in bug_actiongroup_ext_page.php in MantisBT before 1.2.8 allows remote attackers to include and execute arbitrary local files via a .. | 6.8 |
| 2011-09-21 | CVE-2011-3356 | Cross-Site Scripting vulnerability in Mantisbt Multiple cross-site scripting (XSS) vulnerabilities in config_defaults_inc.php in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO, as demonstrated by the PATH_INFO to (1) manage_config_email_page.php, (2) manage_config_workflow_page.php, or (3) bugs/plugin.php. | 4.3 |
| 2011-09-21 | CVE-2011-2938 | Cross-Site Scripting vulnerability in Mantisbt Multiple cross-site scripting (XSS) vulnerabilities in filter_api.php in MantisBT before 1.2.7 allow remote attackers to inject arbitrary web script or HTML via a parameter, as demonstrated by the project_id parameter to search.php. | 4.3 |