Vulnerabilities > Mantisbt > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-01-29 | CVE-2020-29604 | Missing Authorization vulnerability in Mantisbt An issue was discovered in MantisBT before 2.24.4. | 4.0 |
| 2021-01-29 | CVE-2020-29603 | Insecure Storage of Sensitive Information vulnerability in Mantisbt In manage_proj_edit_page.php in MantisBT before 2.24.4, any unprivileged logged-in user can retrieve Private Projects' names via the manage_proj_edit_page.php project_id parameter, without having access to them. | 4.0 |
| 2021-01-18 | CVE-2020-36192 | Unspecified vulnerability in Mantisbt Source Integration An issue was discovered in the Source Integration plugin before 2.4.1 for MantisBT. | 5.0 |
| 2020-12-30 | CVE-2020-28413 | SQL Injection vulnerability in Mantisbt 2.24.3 In MantisBT 2.24.3, SQL Injection can occur in the parameter "access" of the mc_project_get_users function through the API SOAP. | 4.0 |
| 2020-12-30 | CVE-2020-35849 | Incorrect Authorization vulnerability in Mantisbt An issue was discovered in MantisBT before 2.24.4. | 5.0 |
| 2020-09-30 | CVE-2020-25781 | Incorrect Authorization vulnerability in Mantisbt An issue was discovered in file_download.php in MantisBT before 2.24.3. | 4.0 |
| 2020-03-19 | CVE-2019-15539 | Cross-site Scripting vulnerability in Mantisbt The proj_doc_edit_page.php Project Documentation feature in MantisBT before 2.21.3 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings permit it) after uploading an attachment with a crafted filename. | 4.3 |
| 2020-02-13 | CVE-2020-8981 | Cross-site Scripting vulnerability in Mantisbt Source Integration A cross-site scripting (XSS) vulnerability was discovered in the Source Integration plugin before 1.6.2 and 2.x before 2.3.1 for MantisBT. | 4.3 |
| 2019-11-09 | CVE-2009-2802 | Cross-site Scripting vulnerability in Mantisbt 1.2.0/1.2.1 MantisBT 1.2.x before 1.2.2 insecurely handles attachments and MIME types. | 4.3 |
| 2019-11-07 | CVE-2013-1811 | Improper Input Validation vulnerability in multiple products An access control issue in MantisBT before 1.2.13 allows users with "Reporter" permissions to change any issue to "New". | 4.0 |