1159 matches found
CVE-2014-9271
Cross-site scripting XSS vulnerability in filedownload.php in MantisBT before 1.2.18 allows remote authenticated users to inject arbitrary web script or HTML via a Flash file with an image extension, related to inline attachments, as demonstrated by a .swf.jpeg filename...
CVE-2014-9271
CVE-2014-9271 affects MantisBT 1.2.x up to 1.2.18. It is a cross-site scripting (XSS) vulnerability in file_download.php that allows an attacker to inject arbitrary web script or HTML via a Flash file with an image extension (e.g., a .swf.jpeg filename) related to inline attachments. Root cause: ...
CVE-2014-9269
Cross-site scripting XSS vulnerability in helperapi.php in MantisBT 1.1.0a1 through 1.2.x before 1.2.18, when Extended project browser is enabled, allows remote attackers to inject arbitrary web script or HTML via the project cookie...
CVE-2014-9272
The stringinserthref function in MantisBT 1.2.0a1 through 1.2.x before 1.2.18 does not properly validate the URL protocol, which allows remote attackers to conduct cross-site scripting XSS attacks via the javascript:// protocol...
MantisBT 1.2.13 - 1.2.17 'adm_config_report.php' XSS Vulnerability
MantisBT is prone to a cross-site scripting XSS vulnerability. Copyright C 2015 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software...
MantisBT Information Disclosure Vulnerability
MantisBT is a popular web-based bug tracking system. Versions prior to MantisBT 1.2.18 failed to properly check permissions when monitoring an issue related to another issue sending an email, allowing remote authenticated users to access sensitive information about restricted issues...
CVE-2014-9506
MantisBT before 1.2.18 does not properly check permissions when sending an email that indicates when a monitored issue is related to another issue, which allows remote authenticated users to obtain sensitive information about restricted issues...
Design/Logic Flaw
MantisBT before 1.2.18 does not properly check permissions when sending an email that indicates when a monitored issue is related to another issue, which allows remote authenticated users to obtain sensitive information about restricted issues...
CVE-2014-9506
MantisBT before 1.2.18 does not properly check permissions when sending an email that indicates when a monitored issue is related to another issue, which allows remote authenticated users to obtain sensitive information about restricted issues...
CVE-2014-9506
Affected software: MantisBT before 1.2.18. Issue: Inadequate permission checking when sending an email that indicates a monitored issue is related to another issue, enabling remote authenticated users to access information about restricted issues. Impact: Information disclosure of restricted issu...
CVE-2014-9388
bugreport.php in MantisBT before 1.2.18 allows remote attackers to assign arbitrary issues via the handlerid parameter...
CVE-2014-8553
The mciaccountgetarraybyid function in api/soap/mcaccountapi.php in MantisBT before 1.2.18 allows remote attackers to obtain sensitive information via a 1 mcprojectgetusers, 2 mcissueget, 3 mcfiltergetissues, or 4 mcprojectgetissues SOAP request...
CVE-2014-9388
bugreport.php in MantisBT before 1.2.18 allows remote attackers to assign arbitrary issues via the handlerid parameter...
Code injection
bugreport.php in MantisBT before 1.2.18 allows remote attackers to assign arbitrary issues via the handlerid parameter...
Cross site request forgery (csrf)
The mciaccountgetarraybyid function in api/soap/mcaccountapi.php in MantisBT before 1.2.18 allows remote attackers to obtain sensitive information via a 1 mcprojectgetusers, 2 mcissueget, 3 mcfiltergetissues, or 4 mcprojectgetissues SOAP request...
CVE-2014-8553
The mciaccountgetarraybyid function in api/soap/mcaccountapi.php in MantisBT before 1.2.18 allows remote attackers to obtain sensitive information via a 1 mcprojectgetusers, 2 mcissueget, 3 mcfiltergetissues, or 4 mcprojectgetissues SOAP request...
CVE-2014-8553
The mciaccountgetarraybyid function in api/soap/mcaccountapi.php in MantisBT before 1.2.18 allows remote attackers to obtain sensitive information via a 1 mcprojectgetusers, 2 mcissueget, 3 mcfiltergetissues, or 4 mcprojectgetissues SOAP request...
CVE-2014-9388
CVE-2014-9388 affects MantisBT prior to 1.2.18, where bug_report.php can allow remote attackers to assign arbitrary issues via the handler_id parameter. This is a behavioral flaw in the issue assignment flow, enabling potential misrouting or manipulation of issues without authentication beyond th...
CVE-2014-8553
Affected software: MantisBT 1.2.x before 1.2.18. Vulnerability: information disclosure via SOAP requests (mc_project_get_users, mc_issue_get, mc_filter_get_issues, mc_project_get_issues) caused by mci_account_get_array_by_id in api/soap/mc_account_api.php. Impact: potential exposure of sensitive ...