1167 matches found
CVE-2014-9388
bugreport.php in MantisBT before 1.2.18 allows remote attackers to assign arbitrary issues via the handlerid parameter...
Code injection
bugreport.php in MantisBT before 1.2.18 allows remote attackers to assign arbitrary issues via the handlerid parameter...
Cross site request forgery (csrf)
The mciaccountgetarraybyid function in api/soap/mcaccountapi.php in MantisBT before 1.2.18 allows remote attackers to obtain sensitive information via a 1 mcprojectgetusers, 2 mcissueget, 3 mcfiltergetissues, or 4 mcprojectgetissues SOAP request...
CVE-2014-8553
The mciaccountgetarraybyid function in api/soap/mcaccountapi.php in MantisBT before 1.2.18 allows remote attackers to obtain sensitive information via a 1 mcprojectgetusers, 2 mcissueget, 3 mcfiltergetissues, or 4 mcprojectgetissues SOAP request...
CVE-2014-8553
Affected software: MantisBT 1.2.x before 1.2.18. Vulnerability: information disclosure via SOAP requests (mc_project_get_users, mc_issue_get, mc_filter_get_issues, mc_project_get_issues) caused by mci_account_get_array_by_id in api/soap/mc_account_api.php. Impact: potential exposure of sensitive ...
CVE-2014-8553
The mciaccountgetarraybyid function in api/soap/mcaccountapi.php in MantisBT before 1.2.18 allows remote attackers to obtain sensitive information via a 1 mcprojectgetusers, 2 mcissueget, 3 mcfiltergetissues, or 4 mcprojectgetissues SOAP request...
CVE-2014-9388
CVE-2014-9388 affects MantisBT prior to 1.2.18, where bug_report.php can allow remote attackers to assign arbitrary issues via the handler_id parameter. This is a behavioral flaw in the issue assignment flow, enabling potential misrouting or manipulation of issues without authentication beyond th...
CVE-2014-9388
bugreport.php in MantisBT before 1.2.18 allows remote attackers to assign arbitrary issues via the handlerid parameter...
Fedora 21 : mantis-1.2.17-4.fc21 (2014-15142)
fix CVE-2014-7146, CVE-2014-8598 1162046 fix CVE-2014-8554 1159295 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing...
CVE-2014-6316
core/stringapi.php in MantisBT before 1.2.18 does not properly categorize URLs when running under the web root, which allows remote attackers to conduct open redirect and phishing attacks via a crafted URL in the return parameter to loginpage.php...
Open redirect
core/stringapi.php in MantisBT before 1.2.18 does not properly categorize URLs when running under the web root, which allows remote attackers to conduct open redirect and phishing attacks via a crafted URL in the return parameter to loginpage.php...
CVE-2014-6316
core/stringapi.php in MantisBT before 1.2.18 does not properly categorize URLs when running under the web root, which allows remote attackers to conduct open redirect and phishing attacks via a crafted URL in the return parameter to loginpage.php...
CVE-2014-6316
core/stringapi.php in MantisBT before 1.2.18 does not properly categorize URLs when running under the web root, which allows remote attackers to conduct open redirect and phishing attacks via a crafted URL in the return parameter to loginpage.php...
CVE-2014-6316
CVE-2014-6316 affects MantisBT 1.2.x (before 1.2.18); core/string_api.php fails to properly categorize URLs when running under the web root, enabling open redirects and potential phishing via a crafted URL placed in the return parameter to login_page.php. The issue is described in public advisori...
CVE-2014-9281
Cross-site scripting XSS vulnerability in admin/copyfield.php in MantisBT before 1.2.18 allows remote attackers to inject arbitrary web script or HTML via the destid field...
CVE-2014-9281
Cross-site scripting XSS vulnerability in admin/copyfield.php in MantisBT before 1.2.18 allows remote attackers to inject arbitrary web script or HTML via the destid field...
Cross site scripting
Cross-site scripting XSS vulnerability in admin/copyfield.php in MantisBT before 1.2.18 allows remote attackers to inject arbitrary web script or HTML via the destid field...
CVE-2014-9281
Cross-site scripting XSS vulnerability in admin/copyfield.php in MantisBT before 1.2.18 allows remote attackers to inject arbitrary web script or HTML via the destid field...
CVE-2014-9281
CVE-2014-9281 is an XSS in MantisBT prior to 1.2.18 via dest_id in admin/copy_field.php, allowing remote script/HTML injection. Affects MantisBT 1.2.x before 1.2.18; remediation is to upgrade to 1.2.18 or apply patches. Exploitation status is not provided in the available documents.