CVE-2012-2691

The mcissuenoteupdate function in the SOAP API in MantisBT before 1.2.11 does not properly check privileges, which allows remote attackers with bug reporting privileges to edit arbitrary bugnotes via a SOAP request...

CVE-2012-2692

MantisBT before 1.2.11 does not check the deleteattachmentsthreshold permission when formsecurityvalidation is set to OFF, which allows remote authenticated users with certain privileges to bypass intended access restrictions and delete arbitrary attachments...

Cross site request forgery (csrf)

The mcissuenoteupdate function in the SOAP API in MantisBT before 1.2.11 does not properly check privileges, which allows remote attackers with bug reporting privileges to edit arbitrary bugnotes via a SOAP request...

CVE-2012-2692

MantisBT before 1.2.11 does not check the deleteattachmentsthreshold permission when formsecurityvalidation is set to OFF, which allows remote authenticated users with certain privileges to bypass intended access restrictions and delete arbitrary attachments...

Design/Logic Flaw

MantisBT before 1.2.11 does not check the deleteattachmentsthreshold permission when formsecurityvalidation is set to OFF, which allows remote authenticated users with certain privileges to bypass intended access restrictions and delete arbitrary attachments...

CVE-2012-2691

The mcissuenoteupdate function in the SOAP API in MantisBT before 1.2.11 does not properly check privileges, which allows remote attackers with bug reporting privileges to edit arbitrary bugnotes via a SOAP request...

CVE-2012-2692

MantisBT before 1.2.11 does not check the deleteattachmentsthreshold permission when formsecurityvalidation is set to OFF, which allows remote authenticated users with certain privileges to bypass intended access restrictions and delete arbitrary attachments...

CVE-2012-2691

The mcissuenoteupdate function in the SOAP API in MantisBT before 1.2.11 does not properly check privileges, which allows remote attackers with bug reporting privileges to edit arbitrary bugnotes via a SOAP request...

CVE-2012-2692

MantisBT before 1.2.11 does not check the deleteattachmentsthreshold permission when formsecurityvalidation is set to OFF, which allows remote authenticated users with certain privileges to bypass intended access restrictions and delete arbitrary attachments...

CVE-2012-2691

CVE-2012-2691 affects MantisBT (SOAP API) where the mc_issue_note_update function does not properly enforce privileges. As a result, remote attackers with bug reporting privileges could edit arbitrary bugnotes via SOAP requests. The vulnerability is described as code-level privilege check bypass ...

CVE-2012-2691

The mcissuenoteupdate function in the SOAP API in MantisBT before 1.2.11 does not properly check privileges, which allows remote attackers with bug reporting privileges to edit arbitrary bugnotes via a SOAP request...

CVE-2012-2692

MantisBT versions before 1.2.11 are vulnerable: when form_security_validation is OFF, delete_attachments_threshold permission is not enforced, allowing remote authenticated users with certain privileges to delete arbitrary attachments. Root cause: missing permission check in delete path. Impact: ...

CVE-2012-2691: Undefined Security Weakness

The mcissuenoteupdate function in the SOAP API in MantisBT before 1.2.11 does not properly check privileges, which allows remote attackers with bug reporting privileges to edit arbitrary bugnotes via a SOAP request...

PT-2012-4184

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.11 Description The issue concerns a problem with privilege checking in the mc issue note update function within the SOAP API. This allows remote attackers who have bug reporting privileges to edit arbitrary...

PT-2012-4185

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.11 Description The issue allows remote authenticated users with certain privileges to bypass intended access restrictions and delete arbitrary attachments due to a lack of permission check for delete attachments...

CVE-2012-2692: Undefined Security Weakness

MantisBT before 1.2.11 does not check the deleteattachmentsthreshold permission when formsecurityvalidation is set to OFF, which allows remote authenticated users with certain privileges to bypass intended access restrictions and delete arbitrary attachments...

mantis -- multiple vulnerabilities

Mantis reports: Roland Becker and Damien Regad MantisBT developers found that any user able to report issues via the SOAP interface could also modify any bugnotes comments created by other users. In a default/typical MantisBT installation, SOAP API is enabled and any user can sign up to report ne...

Mantisbt < 1.2.4 LFI

LFI on admin/upgradeunattended.php via dbtype Vulnerability Type: Local File Include For the exploit source code contact DSquare Security sales team...

Mantisbt < 1.2.8 LFI

standard LFI via not properly sanatized variables Vulnerability Type: Local File Include For the exploit source code contact DSquare Security sales team...

MantisBT Multiple Local File Include and Cross Site Scripting Vulnerabilities

This host is running MantisBT and is prone to multiple local file include and cross-site scripting vulnerabilities. OpenVAS Vulnerability Test $Id: secpodmantismultlfinxssvuln.nasl 7044 2017-09-01 11:50:59Z teissa $ MantisBT Multiple Local File Include and Cross Site Scripting Vulnerabilities...