1160 matches found
Gentoo Security Advisory GLSA 201211-01 (MantisBT)
The remote host is missing updates announced in advisory GLSA 201211-01. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...
CVE-2012-5523
CVE-2012-5523 affects MantisBT prior to 1.2.12. The issue is in the email_api.php component where email notification sending is not correctly handled for bugs with restricted visibility, enabling a remote authenticated user to gain access to sensitive information by adding a note before losing pe...
Gentoo Security Advisory GLSA 201211-01 (MantisBT)
The remote host is missing updates announced in advisory GLSA 201211-01. SPDX-FileCopyrightText: 2012 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR GPL-3.0-only...
GLSA-201211-01 : MantisBT: Multiple vulnerabilities
The remote host is affected by the vulnerability described in GLSA-201211-01 MantisBT: Multiple vulnerabilities Multiple vulnerabilities have been discovered in MantisBT. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could exploit these vulnerabilities...
MantisBT: Multiple vulnerabilities
Background MantisBT is a PHP/MySQL/Web based bugtracking system. Description Multiple vulnerabilities have been discovered in MantisBT. Please review the CVE identifiers referenced below for details. Impact A remote attacker could exploit these vulnerabilities to conduct directory traversal...
CVE-2012-1122
bugactiongroup.php in MantisBT before 1.2.9 does not properly check the reportbugthreshold permission of the receiving project when moving a bug report, which allows remote authenticated users with the reportbugthreshold and movebugthreshold privileges for a project to bypass intended access...
CVE-2012-1121
MantisBT before 1.2.9 does not properly check permissions, which allows remote authenticated users with manager privileges to 1 modify or 2 delete global categories...
CVE-2012-1123
The mcichecklogin function in api/soap/mcapi.php in the SOAP API in MantisBT before 1.2.9 allows remote attackers to bypass authentication via a null password...
CVE-2012-1120
The SOAP API in MantisBT before 1.2.9 does not properly enforce the bugnoteallowusereditdelete and deletebugthreshold permissions, which allows remote authenticated users with read and write SOAP API privileges to delete arbitrary bug reports and bug notes...
CVE-2012-1119
MantisBT before 1.2.9 does not audit when users copy or clone a bug report, which makes it easier for remote attackers to copy bug reports without detection...
CVE-2012-1118
The accesshasbuglevel function in core/accessapi.php in MantisBT before 1.2.9 does not properly restrict access when the privatebugviewthreshold is set to an array, which allows remote attackers to bypass intended restrictions and perform certain operations on private bug reports...
CVE-2012-1121
MantisBT before 1.2.9 does not properly check permissions, which allows remote authenticated users with manager privileges to 1 modify or 2 delete global categories...
CVE-2012-1119
MantisBT before 1.2.9 does not audit when users copy or clone a bug report, which makes it easier for remote attackers to copy bug reports without detection...
Design/Logic Flaw
MantisBT before 1.2.9 does not audit when users copy or clone a bug report, which makes it easier for remote attackers to copy bug reports without detection...
Code injection
The SOAP API in MantisBT before 1.2.9 does not properly enforce the bugnoteallowusereditdelete and deletebugthreshold permissions, which allows remote authenticated users with read and write SOAP API privileges to delete arbitrary bug reports and bug notes...
Design/Logic Flaw
bugactiongroup.php in MantisBT before 1.2.9 does not properly check the reportbugthreshold permission of the receiving project when moving a bug report, which allows remote authenticated users with the reportbugthreshold and movebugthreshold privileges for a project to bypass intended access...
CVE-2012-1120
The SOAP API in MantisBT before 1.2.9 does not properly enforce the bugnoteallowusereditdelete and deletebugthreshold permissions, which allows remote authenticated users with read and write SOAP API privileges to delete arbitrary bug reports and bug notes...
Design/Logic Flaw
The accesshasbuglevel function in core/accessapi.php in MantisBT before 1.2.9 does not properly restrict access when the privatebugviewthreshold is set to an array, which allows remote attackers to bypass intended restrictions and perform certain operations on private bug reports...