CVE-2013-4460

Cross-site scripting XSS vulnerability in accountsponsorpage.php in MantisBT 1.0.0 through 1.2.15 allows remote authenticated users to inject arbitrary web script or HTML via a project name...

CVE-2013-4460

CVE-2013-4460: XSS in MantisBT 1.0.0–1.2.15 via project name in account_sponsor_page.php. Remote authenticated users could inject arbitrary web script/HTML. CVSS v2 base score 3.5 (LOW). No exploitation details provided in the connected documents. No remediation/version_fix information is specifi...

MantisBT 1.2.12 - 1.2.14 Multiple Vulnerabilities

According to its version number, the MantisBT install hosted on the remote web server is affected by multiple vulnerabilities: - A flaw exists in the 'filterapi.php' script when conducting a search query on the View Issues page. Combining filter criteria could lead to a denial of service...

MantisBT 1.2.x < 1.2.14 adm_config_report.php Multiple Parameter XSS

According to its version number, the MantisBT install hosted on the remote web server is affected by multiple cross-site scripting vulnerabilities : - A flaw exists in on the Configuration Report page in the 'admconfigreport.php' script. CVE-2013-1932 - A flaw exists because the application fails...

MantisBT < 1.2.12 Multiple Vulnerabilities

According to its version number, the MantisBT install hosted on the remote web server is affected by multiple vulnerabilities : - The application is affected by an information disclosure vulnerability due to a flaw in using default values to determine if a user has sufficient privileges to modify...

MantisBT 1.2.x < 1.2.13 Multiple Vulnerabilities

According to its version number, the MantisBT install hosted on the remote web server is affected by multiple vulnerabilities : - Version 1.2.12 of the application is affected by a cross-site scripting XSS vulnerability because the 'search.php' script fails to properly sanitize user-supplied inpu...

MantisBT search.php match_type Parameter XSS

The version of MantisBT installed on the remote host fails to properly sanitize user-supplied input to the 'matchtype' parameter of the 'search.php' script before using it to generate dynamic HTML output. An attacker may be able to leverage this to inject arbitrary HTML and script code into a...

MantisBT CVE-2013-1934 HTML Injection Vulnerability

Description MantisBT is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied data. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based...

CVE-2012-5523

core/emailapi.php in MantisBT before 1.2.12 does not properly manage the sending of e-mail notifications about restricted bugs, which might allow remote authenticated users to obtain sensitive information by adding a note to a bug before losing permission to view that bug...

CVE-2012-5522

MantisBT before 1.2.12 does not use an expected default value during decisions about whether a user may modify the status of a bug, which allows remote authenticated users to bypass intended access restrictions and make status changes by leveraging a blank value for a per-status setting...

Design/Logic Flaw

MantisBT before 1.2.12 does not use an expected default value during decisions about whether a user may modify the status of a bug, which allows remote authenticated users to bypass intended access restrictions and make status changes by leveraging a blank value for a per-status setting...

CVE-2012-5522

MantisBT before 1.2.12 does not use an expected default value during decisions about whether a user may modify the status of a bug, which allows remote authenticated users to bypass intended access restrictions and make status changes by leveraging a blank value for a per-status setting...

CVE-2012-5523

core/emailapi.php in MantisBT before 1.2.12 does not properly manage the sending of e-mail notifications about restricted bugs, which might allow remote authenticated users to obtain sensitive information by adding a note to a bug before losing permission to view that bug...

Design/Logic Flaw

core/emailapi.php in MantisBT before 1.2.12 does not properly manage the sending of e-mail notifications about restricted bugs, which might allow remote authenticated users to obtain sensitive information by adding a note to a bug before losing permission to view that bug...

CVE-2012-5522

MantisBT

CVE-2012-5522

MantisBT before 1.2.12 does not use an expected default value during decisions about whether a user may modify the status of a bug, which allows remote authenticated users to bypass intended access restrictions and make status changes by leveraging a blank value for a per-status setting...

CVE-2012-5523

core/emailapi.php in MantisBT before 1.2.12 does not properly manage the sending of e-mail notifications about restricted bugs, which might allow remote authenticated users to obtain sensitive information by adding a note to a bug before losing permission to view that bug...

CVE-2012-5523

CVE-2012-5523 affects MantisBT prior to 1.2.12. The issue is in the email_api.php component where email notification sending is not correctly handled for bugs with restricted visibility, enabling a remote authenticated user to gain access to sensitive information by adding a note before losing pe...

Gentoo Security Advisory GLSA 201211-01 (MantisBT)

The remote host is missing updates announced in advisory GLSA 201211-01. SPDX-FileCopyrightText: 2012 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR GPL-3.0-only...

Gentoo Security Advisory GLSA 201211-01 (MantisBT)

The remote host is missing updates announced in advisory GLSA 201211-01. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...