CVE-2014-9269

Cross-site scripting XSS vulnerability in helperapi.php in MantisBT 1.1.0a1 through 1.2.x before 1.2.18, when Extended project browser is enabled, allows remote attackers to inject arbitrary web script or HTML via the project cookie...

CVE-2014-9269

CVE-2014-9269 affects MantisBT, specifically the helper_api.php component. When Extended project browser is enabled, it allows remote attackers to inject arbitrary web script or HTML via the project cookie, enabling a cross-site scripting (XSS) vulnerability in MantisBT 1.1.0a1 through 1.2.x befo...

MantisBT 1.2.13 - 1.2.17 'adm_config_report.php' XSS Vulnerability

MantisBT is prone to a cross-site scripting XSS vulnerability. Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software...

MantisBT Information Disclosure Vulnerability

MantisBT is a popular web-based bug tracking system. Versions prior to MantisBT 1.2.18 failed to properly check permissions when monitoring an issue related to another issue sending an email, allowing remote authenticated users to access sensitive information about restricted issues...

CVE-2014-9506

MantisBT before 1.2.18 does not properly check permissions when sending an email that indicates when a monitored issue is related to another issue, which allows remote authenticated users to obtain sensitive information about restricted issues...

Design/Logic Flaw

MantisBT before 1.2.18 does not properly check permissions when sending an email that indicates when a monitored issue is related to another issue, which allows remote authenticated users to obtain sensitive information about restricted issues...

CVE-2014-9506

Affected software: MantisBT before 1.2.18. Issue: Inadequate permission checking when sending an email that indicates a monitored issue is related to another issue, enabling remote authenticated users to access information about restricted issues. Impact: Information disclosure of restricted issu...

CVE-2014-9506

MantisBT before 1.2.18 does not properly check permissions when sending an email that indicates when a monitored issue is related to another issue, which allows remote authenticated users to obtain sensitive information about restricted issues...

CVE-2014-9388

bugreport.php in MantisBT before 1.2.18 allows remote attackers to assign arbitrary issues via the handlerid parameter...

CVE-2014-8553

The mciaccountgetarraybyid function in api/soap/mcaccountapi.php in MantisBT before 1.2.18 allows remote attackers to obtain sensitive information via a 1 mcprojectgetusers, 2 mcissueget, 3 mcfiltergetissues, or 4 mcprojectgetissues SOAP request...

CVE-2014-8553

The mciaccountgetarraybyid function in api/soap/mcaccountapi.php in MantisBT before 1.2.18 allows remote attackers to obtain sensitive information via a 1 mcprojectgetusers, 2 mcissueget, 3 mcfiltergetissues, or 4 mcprojectgetissues SOAP request...

Code injection

bugreport.php in MantisBT before 1.2.18 allows remote attackers to assign arbitrary issues via the handlerid parameter...

Cross site request forgery (csrf)

The mciaccountgetarraybyid function in api/soap/mcaccountapi.php in MantisBT before 1.2.18 allows remote attackers to obtain sensitive information via a 1 mcprojectgetusers, 2 mcissueget, 3 mcfiltergetissues, or 4 mcprojectgetissues SOAP request...

CVE-2014-9388

bugreport.php in MantisBT before 1.2.18 allows remote attackers to assign arbitrary issues via the handlerid parameter...

CVE-2014-8553

Affected software: MantisBT 1.2.x before 1.2.18. Vulnerability: information disclosure via SOAP requests (mc_project_get_users, mc_issue_get, mc_filter_get_issues, mc_project_get_issues) caused by mci_account_get_array_by_id in api/soap/mc_account_api.php. Impact: potential exposure of sensitive ...

CVE-2014-8553

The mciaccountgetarraybyid function in api/soap/mcaccountapi.php in MantisBT before 1.2.18 allows remote attackers to obtain sensitive information via a 1 mcprojectgetusers, 2 mcissueget, 3 mcfiltergetissues, or 4 mcprojectgetissues SOAP request...

CVE-2014-9388

CVE-2014-9388 affects MantisBT prior to 1.2.18, where bug_report.php can allow remote attackers to assign arbitrary issues via the handler_id parameter. This is a behavioral flaw in the issue assignment flow, enabling potential misrouting or manipulation of issues without authentication beyond th...

CVE-2014-9388

bugreport.php in MantisBT before 1.2.18 allows remote attackers to assign arbitrary issues via the handlerid parameter...

Fedora 21 : mantis-1.2.17-4.fc21 (2014-15142)

fix CVE-2014-7146, CVE-2014-8598 1162046 fix CVE-2014-8554 1159295 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...

CVE-2014-6316

core/stringapi.php in MantisBT before 1.2.18 does not properly categorize URLs when running under the web root, which allows remote attackers to conduct open redirect and phishing attacks via a crafted URL in the return parameter to loginpage.php...