Vulnerabilities > Mantisbt > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2014-03-05 | CVE-2014-2238 | SQL Injection vulnerability in Mantisbt SQL injection vulnerability in the manage configuration page (adm_config_report.php) in MantisBT 1.2.13 through 1.2.16 allows remote authenticated administrators to execute arbitrary SQL commands via the filter_config_id parameter. | 6.5 |
| 2012-11-16 | CVE-2012-5523 | Permissions, Privileges, and Access Controls vulnerability in Mantisbt core/email_api.php in MantisBT before 1.2.12 does not properly manage the sending of e-mail notifications about restricted bugs, which might allow remote authenticated users to obtain sensitive information by adding a note to a bug before losing permission to view that bug. | 5.5 |
| 2012-11-16 | CVE-2012-5522 | Permissions, Privileges, and Access Controls vulnerability in Mantisbt MantisBT before 1.2.12 does not use an expected default value during decisions about whether a user may modify the status of a bug, which allows remote authenticated users to bypass intended access restrictions and make status changes by leveraging a blank value for a per-status setting. | 5.5 |
| 2012-06-29 | CVE-2012-1121 | Permissions, Privileges, and Access Controls vulnerability in Mantisbt MantisBT before 1.2.9 does not properly check permissions, which allows remote authenticated users with manager privileges to (1) modify or (2) delete global categories. | 4.9 |
| 2012-06-29 | CVE-2012-1119 | Permissions, Privileges, and Access Controls vulnerability in Mantisbt MantisBT before 1.2.9 does not audit when users copy or clone a bug report, which makes it easier for remote attackers to copy bug reports without detection. | 6.4 |
| 2012-06-29 | CVE-2012-1118 | Permissions, Privileges, and Access Controls vulnerability in Mantisbt The access_has_bug_level function in core/access_api.php in MantisBT before 1.2.9 does not properly restrict access when the private_bug_view_threshold is set to an array, which allows remote attackers to bypass intended restrictions and perform certain operations on private bug reports. | 4.3 |
| 2011-09-23 | CVE-2011-3755 | Information Exposure vulnerability in Mantisbt 1.2.4 MantisBT 1.2.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by view_all_inc.php and certain other files. | 5.0 |
| 2011-09-21 | CVE-2011-3578 | Cross-Site Scripting vulnerability in Mantisbt Cross-site scripting (XSS) vulnerability in bug_actiongroup_ext_page.php in MantisBT before 1.2.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter, related to bug_actiongroup_page.php, a different vulnerability than CVE-2011-3357. | 4.3 |
| 2011-09-21 | CVE-2011-3358 | Cross-Site Scripting vulnerability in Mantisbt Multiple cross-site scripting (XSS) vulnerabilities in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the (1) os, (2) os_build, or (3) platform parameter to (a) bug_report_page.php or (b) bug_update_advanced_page.php, related to use of the Projax library. | 4.3 |
| 2011-09-21 | CVE-2011-3357 | Path Traversal vulnerability in Mantisbt Directory traversal vulnerability in bug_actiongroup_ext_page.php in MantisBT before 1.2.8 allows remote attackers to include and execute arbitrary local files via a .. | 6.8 |