1167 matches found
Design/Logic Flaw
viewallbugpage.php in MantisBT 2.10.0-development before 2018-02-02 allows remote attackers to discover the full path via an invalid filter parameter, related to a filterensurevalidfilter call in currentuserapi.php...
CVE-2018-6526
viewallbugpage.php in MantisBT 2.10.0-development before 2018-02-02 allows remote attackers to discover the full path via an invalid filter parameter, related to a filterensurevalidfilter call in currentuserapi.php...
CVE-2018-6526
viewallbugpage.php in MantisBT 2.10.0-development before 2018-02-02 allows remote attackers to discover the full path via an invalid filter parameter, related to a filterensurevalidfilter call in currentuserapi.php...
CVE-2018-6526
CVE-2018-6526 affects MantisBT; path disclosure in view_all_bug_page.php (2.10.0-development before 2018-02-02) via an invalid filter parameter tied to filter_ensure_valid_filter in current_user_api.php. The vulnerability allows remote attackers to discover the full filesystem path. Affected comp...
CVE-2018-6526
viewallbugpage.php in MantisBT 2.10.0-development before 2018-02-02 allows remote attackers to discover the full path via an invalid filter parameter, related to a filterensurevalidfilter call in currentuserapi.php...
MantisBT SQL Injection Vulnerability (CNVD-2018-03423)
MantisBT is a Web-based open source defect tracking system of the MantisBT team . The system provides project management and defect tracking services in the form of Web operations. A security vulnerability exists in MantisBT version 2.10.0. A local attacker can exploit this vulnerability to condu...
Sql injection
DISPUTED MantisBT 2.10.0 allows local users to conduct SQL Injection attacks via the vendor/adodb/adodb-php/server.php sql parameter in a request to the 127.0.0.1 IP address. NOTE: the vendor disputes the significance of this report because server.php is intended to execute arbitrary SQL statemen...
CVE-2018-6382
MantisBT 2.10.0 allows local users to conduct SQL Injection attacks via the vendor/adodb/adodb-php/server.php sql parameter in a request to the 127.0.0.1 IP address. NOTE: the vendor disputes the significance of this report because server.php is intended to execute arbitrary SQL statements on...
CVE-2018-6382
MantisBT 2.10.0 allows local users to conduct SQL Injection attacks via the vendor/adodb/adodb-php/server.php sql parameter in a request to the 127.0.0.1 IP address. NOTE: the vendor disputes the significance of this report because server.php is intended to execute arbitrary SQL statements on...
CVE-2018-6382
MantisBT 2.10.0 is affected by a local SQL injection via the vendor/adodb/adodb-php/server.php sql parameter accessible to 127.0.0.1. The issue is described as exploitable by local users; vendor notes no authentication bypass and disputes the report’s significance. OpenVAS entries for both Window...
CVE-2018-6382
MantisBT 2.10.0 allows local users to conduct SQL Injection attacks via the vendor/adodb/adodb-php/server.php sql parameter in a request to the 127.0.0.1 IP address. NOTE: the vendor disputes the significance of this report because server.php is intended to execute arbitrary SQL statements on...
PT-2018-17520 · Mantisbt · Mantisbt
Name of the Vulnerable Software and Affected Versions: MantisBT version 2.10.0 Description: The issue allows local users to conduct SQL Injection attacks via the sql parameter in a request to the server.php endpoint, accessible from the 127.0.0.1 IP address. It is worth noting that the vendor...
MantisBT Security Bypass Vulnerability (CNVD-2017-33719)
MantisBT is a Web-based open source defect tracking system of the MantisBT team . The system provides project management and defect tracking services in the form of Web operations. A security vulnerability exists in versions of MantisBT prior to 1.2.19. An attacker can exploit the vulnerability t...
CVE-2014-9624
CAPTCHA bypass vulnerability in MantisBT before 1.2.19...
CVE-2014-9624
CAPTCHA bypass vulnerability in MantisBT before 1.2.19...
Design/Logic Flaw
CAPTCHA bypass vulnerability in MantisBT before 1.2.19...
CVE-2014-9624
CVE-2014-9624 affects MantisBT versions earlier than 1.2.19, where a CAPTCHA bypass vulnerability exists. Multiple sources (CNVD-2017-33719, UB Ubuntu CVE page, NVD entry) describe that an attacker can bypass CAPTCHA testing by obtaining unlimited CAPTCHA samples with perturbations for the same c...
CVE-2014-9624
CAPTCHA bypass vulnerability in MantisBT before 1.2.19...
MantisBT 1.2.13 - 1.2.19 'adm_config_report.php' XSS Vulnerability - Windows
MantisBT is prone to a cross-site scripting XSS vulnerability. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software...
MantisBT 1.2.13 - 1.2.19 'adm_config_report.php' XSS Vulnerability - Linux
MantisBT is prone to a cross-site scripting XSS vulnerability. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software...