Vulnerabilities > Mantisbt
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2014-01-10 | CVE-2013-4460 | Cross-Site Scripting vulnerability in Mantisbt Cross-site scripting (XSS) vulnerability in account_sponsor_page.php in MantisBT 1.0.0 through 1.2.15 allows remote authenticated users to inject arbitrary web script or HTML via a project name. | 3.5 |
| 2012-11-16 | CVE-2012-5523 | Permissions, Privileges, and Access Controls vulnerability in Mantisbt core/email_api.php in MantisBT before 1.2.12 does not properly manage the sending of e-mail notifications about restricted bugs, which might allow remote authenticated users to obtain sensitive information by adding a note to a bug before losing permission to view that bug. | 5.5 |
| 2012-11-16 | CVE-2012-5522 | Permissions, Privileges, and Access Controls vulnerability in Mantisbt MantisBT before 1.2.12 does not use an expected default value during decisions about whether a user may modify the status of a bug, which allows remote authenticated users to bypass intended access restrictions and make status changes by leveraging a blank value for a per-status setting. | 5.5 |
| 2012-06-29 | CVE-2012-1123 | Improper Authentication vulnerability in Mantisbt The mci_check_login function in api/soap/mc_api.php in the SOAP API in MantisBT before 1.2.9 allows remote attackers to bypass authentication via a null password. | 7.5 |
| 2012-06-29 | CVE-2012-1122 | Permissions, Privileges, and Access Controls vulnerability in Mantisbt bug_actiongroup.php in MantisBT before 1.2.9 does not properly check the report_bug_threshold permission of the receiving project when moving a bug report, which allows remote authenticated users with the report_bug_threshold and move_bug_threshold privileges for a project to bypass intended access restrictions and move bug reports to a different project. | 3.6 |
| 2012-06-29 | CVE-2012-1121 | Permissions, Privileges, and Access Controls vulnerability in Mantisbt MantisBT before 1.2.9 does not properly check permissions, which allows remote authenticated users with manager privileges to (1) modify or (2) delete global categories. | 4.9 |
| 2012-06-29 | CVE-2012-1120 | Permissions, Privileges, and Access Controls vulnerability in Mantisbt The SOAP API in MantisBT before 1.2.9 does not properly enforce the bugnote_allow_user_edit_delete and delete_bug_threshold permissions, which allows remote authenticated users with read and write SOAP API privileges to delete arbitrary bug reports and bug notes. | 3.6 |
| 2012-06-29 | CVE-2012-1119 | Permissions, Privileges, and Access Controls vulnerability in Mantisbt MantisBT before 1.2.9 does not audit when users copy or clone a bug report, which makes it easier for remote attackers to copy bug reports without detection. | 6.4 |
| 2012-06-29 | CVE-2012-1118 | Permissions, Privileges, and Access Controls vulnerability in Mantisbt The access_has_bug_level function in core/access_api.php in MantisBT before 1.2.9 does not properly restrict access when the private_bug_view_threshold is set to an array, which allows remote attackers to bypass intended restrictions and perform certain operations on private bug reports. | 4.3 |
| 2012-06-17 | CVE-2012-2692 | Permissions, Privileges, and Access Controls vulnerability in Mantisbt MantisBT before 1.2.11 does not check the delete_attachments_threshold permission when form_security_validation is set to OFF, which allows remote authenticated users with certain privileges to bypass intended access restrictions and delete arbitrary attachments. | 3.6 |