CVE-2012-5522

MantisBT before 1.2.12 does not use an expected default value during decisions about whether a user may modify the status of a bug, which allows remote authenticated users to bypass intended access restrictions and make status changes by leveraging a blank value for a per-status setting...

CVE-2012-5523

core/emailapi.php in MantisBT before 1.2.12 does not properly manage the sending of e-mail notifications about restricted bugs, which might allow remote authenticated users to obtain sensitive information by adding a note to a bug before losing permission to view that bug...

Gentoo Security Advisory GLSA 201211-01 (MantisBT)

The remote host is missing updates announced in advisory GLSA 201211-01. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

CVE-2012-5522: Undefined Security Weakness

MantisBT before 1.2.12 does not use an expected default value during decisions about whether a user may modify the status of a bug, which allows remote authenticated users to bypass intended access restrictions and make status changes by leveraging a blank value for a per-status setting...

CVE-2012-5523: Undefined Security Weakness

core/emailapi.php in MantisBT before 1.2.12 does not properly manage the sending of e-mail notifications about restricted bugs, which might allow remote authenticated users to obtain sensitive information by adding a note to a bug before losing permission to view that bug...

CVE-2012-5522

MantisBT before 1.2.12 does not use an expected default value during decisions about whether a user may modify the status of a bug, which allows remote authenticated users to bypass intended access restrictions and make status changes by leveraging a blank value for a per-status setting...

Gentoo Security Advisory GLSA 201211-01 (MantisBT)

The remote host is missing updates announced in advisory GLSA 201211-01. SPDX-FileCopyrightText: 2012 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR GPL-3.0-only...

PT-2012-6003

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.12 Description The issue concerns the management of e-mail notifications about restricted bugs. It might allow remote authenticated users to obtain sensitive information by adding a note to a bug before losing...

PT-2012-6002

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.12 Description The issue allows remote authenticated users to bypass intended access restrictions and make status changes by leveraging a blank value for a per-status setting. This occurs because MantisBT does no...

CVE-2012-5523

CVE-2012-5523 affects MantisBT prior to 1.2.12. The issue is in the email_api.php component where email notification sending is not correctly handled for bugs with restricted visibility, enabling a remote authenticated user to gain access to sensitive information by adding a note before losing pe...

GLSA-201211-01 : MantisBT: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201211-01 MantisBT: Multiple vulnerabilities Multiple vulnerabilities have been discovered in MantisBT. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could exploit these vulnerabilities...

MantisBT: Multiple vulnerabilities

Background MantisBT is a PHP/MySQL/Web based bugtracking system. Description Multiple vulnerabilities have been discovered in MantisBT. Please review the CVE identifiers referenced below for details. Impact A remote attacker could exploit these vulnerabilities to conduct directory traversal...

CVE-2012-1121

MantisBT before 1.2.9 does not properly check permissions, which allows remote authenticated users with manager privileges to 1 modify or 2 delete global categories...

CVE-2012-1122

bugactiongroup.php in MantisBT before 1.2.9 does not properly check the reportbugthreshold permission of the receiving project when moving a bug report, which allows remote authenticated users with the reportbugthreshold and movebugthreshold privileges for a project to bypass intended access...

CVE-2012-1123

The mcichecklogin function in api/soap/mcapi.php in the SOAP API in MantisBT before 1.2.9 allows remote attackers to bypass authentication via a null password...

CVE-2012-1119

MantisBT before 1.2.9 does not audit when users copy or clone a bug report, which makes it easier for remote attackers to copy bug reports without detection...

CVE-2012-1120

The SOAP API in MantisBT before 1.2.9 does not properly enforce the bugnoteallowusereditdelete and deletebugthreshold permissions, which allows remote authenticated users with read and write SOAP API privileges to delete arbitrary bug reports and bug notes...

CVE-2012-1118

The accesshasbuglevel function in core/accessapi.php in MantisBT before 1.2.9 does not properly restrict access when the privatebugviewthreshold is set to an array, which allows remote attackers to bypass intended restrictions and perform certain operations on private bug reports...

Design/Logic Flaw

The accesshasbuglevel function in core/accessapi.php in MantisBT before 1.2.9 does not properly restrict access when the privatebugviewthreshold is set to an array, which allows remote attackers to bypass intended restrictions and perform certain operations on private bug reports...

Code injection

The SOAP API in MantisBT before 1.2.9 does not properly enforce the bugnoteallowusereditdelete and deletebugthreshold permissions, which allows remote authenticated users with read and write SOAP API privileges to delete arbitrary bug reports and bug notes...