Browse CVEs

MEDIUM 5.0 CVE-2014-9117 MantisBT before 1.2.18 uses the public_key parameter value as the key to the CAPTCHA answer, which allows remote attackers to bypass the CAPTCHA prot… Mantisbt after 1.2.17 Fix from $1,6002014-12-06 MEDIUM 6.4 CVE-2014-8598EPSS 38% The XML Import/Export plugin in MantisBT 1.2.x does not restrict access, which allows remote attackers to (1) upload arbitrary XML files via the impo… Mantisbt after 1.2.17 Fix from $1,6002014-11-18 HIGH 7.5 CVE-2014-7146EPSS 51% The XmlImportExport plugin in MantisBT 1.2.17 and earlier allows remote attackers to execute arbitrary PHP code via a crafted (1) description field o… Mantisbt Patch available Fix from $1,9502014-11-18 HIGH 7.5 CVE-2014-8554 SQL injection vulnerability in the mc_project_get_attachments function in api/soap/mc_project_api.php in MantisBT before 1.2.18 allows remote attacke… Mantisbt after 1.2.17 Fix from $1,9502014-11-13 MEDIUM 5.0 CVE-2014-6387 gpc_api.php in MantisBT 1.2.17 and earlier allows remote attackers to bypass authenticated via a password starting will a null byte, which triggers a… Mantisbt after 1.2.17 Fix from $1,6002014-10-22 MEDIUM 5.0 CVE-2013-1883 Mantis Bug Tracker (aka MantisBT) 1.2.12 before 1.2.15 allows remote attackers to cause a denial of service (resource consumption) via a filter using… Mantisbt Patch available Fix from $1,6002014-05-27 MEDIUM 6.5 CVE-2014-2238EPSS 11% SQL injection vulnerability in the manage configuration page (adm_config_report.php) in MantisBT 1.2.13 through 1.2.16 allows remote authenticated ad… Mantisbt Patch available Fix from $1,6002014-03-05 MEDIUM 5.5 CVE-2012-5522 MantisBT before 1.2.12 does not use an expected default value during decisions about whether a user may modify the status of a bug, which allows remo… Mantisbt after 1.2.11 Fix from $1,6002012-11-16 MEDIUM 5.5 CVE-2012-5523 core/email_api.php in MantisBT before 1.2.12 does not properly manage the sending of e-mail notifications about restricted bugs, which might allow re… Mantisbt after 1.2.11 Fix from $1,6002012-11-16 HIGH 7.5 CVE-2012-1123 The mci_check_login function in api/soap/mc_api.php in the SOAP API in MantisBT before 1.2.9 allows remote attackers to bypass authentication via a n… Mantisbt after 1.2.8 Fix from $1,9502012-06-29 MEDIUM 6.4 CVE-2012-1119 MantisBT before 1.2.9 does not audit when users copy or clone a bug report, which makes it easier for remote attackers to copy bug reports without de… Mantisbt after 1.2.8 Fix from $1,6002012-06-29 HIGH 7.5 CVE-2012-2691 The mc_issue_note_update function in the SOAP API in MantisBT before 1.2.11 does not properly check privileges, which allows remote attackers with bu… Mantisbt after 1.2.10 Fix from $1,9502012-06-17 MEDIUM 5.0 CVE-2011-3755 MantisBT 1.2.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an… Mantisbt No fix yet Fix from $1,6002011-09-23 MEDIUM 6.8 CVE-2011-3357EPSS 9% Directory traversal vulnerability in bug_actiongroup_ext_page.php in MantisBT before 1.2.8 allows remote attackers to include and execute arbitrary l… Mantisbt after 1.2.7 Fix from $1,6002011-09-21 MEDIUM 5.1 CVE-2010-4350EPSS 8% Directory traversal vulnerability in admin/upgrade_unattended.php in MantisBT before 1.2.4 allows remote attackers to include and execute arbitrary l… Mantisbt after 1.2.3 Fix from $1,6002011-01-03 MEDIUM 5.0 CVE-2010-4349EPSS 9% admin/upgrade_unattended.php in MantisBT before 1.2.4 allows remote attackers to obtain sensitive information via an invalid db_type parameter, which… Mantisbt after 1.2.3 Fix from $1,6002011-01-03 MEDIUM 5.0 CVE-2008-3102 Mantis 1.1.x through 1.1.2 and 1.2.x through 1.2.0a2 does not set the secure flag for the session cookie in an https session, which can cause the coo… Mantisbt Mitigation only Fix from $1,6002008-09-24