CVE-2012-1120

The SOAP API in MantisBT before 1.2.9 does not properly enforce the bugnoteallowusereditdelete and deletebugthreshold permissions, which allows remote authenticated users with read and write SOAP API privileges to delete arbitrary bug reports and bug notes...

CVE-2012-1123

The mcichecklogin function in api/soap/mcapi.php in the SOAP API in MantisBT before 1.2.9 allows remote attackers to bypass authentication via a null password...

CVE-2012-1120

The SOAP API in MantisBT before 1.2.9 does not properly enforce the bugnoteallowusereditdelete and deletebugthreshold permissions, which allows remote authenticated users with read and write SOAP API privileges to delete arbitrary bug reports and bug notes...

CVE-2012-1122

bugactiongroup.php in MantisBT before 1.2.9 does not properly check the reportbugthreshold permission of the receiving project when moving a bug report, which allows remote authenticated users with the reportbugthreshold and movebugthreshold privileges for a project to bypass intended access...

CVE-2012-1119

MantisBT before 1.2.9 does not audit when users copy or clone a bug report, which makes it easier for remote attackers to copy bug reports without detection...

CVE-2012-1122

CVE-2012-1122 affects MantisBT prior to 1.2.9. The bug_actiongroup.php check does not properly enforce report_bug_threshold in the receiving project, allowing remote authenticated users with report_bug_threshold and move_bug_threshold for a project to bypass access controls and move a bug report ...

CVE-2012-1123

The mcichecklogin function in api/soap/mcapi.php in the SOAP API in MantisBT before 1.2.9 allows remote attackers to bypass authentication via a null password...

CVE-2012-1121

MantisBT before 1.2.9 does not properly check permissions, which allows remote authenticated users with manager privileges to 1 modify or 2 delete global categories...

CVE-2012-1118

The accesshasbuglevel function in core/accessapi.php in MantisBT before 1.2.9 does not properly restrict access when the privatebugviewthreshold is set to an array, which allows remote attackers to bypass intended restrictions and perform certain operations on private bug reports...

CVE-2012-1119

MantisBT before 1.2.9 does not audit when users copy or clone a bug report, which makes it easier for remote attackers to copy bug reports without detection...

CVE-2012-1119

CVE-2012-1119 affects MantisBT up to version 1.2.9, where there is insufficient auditing when users copy or clone a bug report. This allows remote attackers to copy bug reports without detection. Impact per metric: confidentiality impact none, integrity impact partial, availability impact partial...

PT-2012-3090

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.9 Description The issue concerns the access has bug level function in core/access api.php, which fails to properly restrict access when the private bug view threshold is set to an array. This allows remote...

CVE-2012-1120: Undefined Security Weakness

The SOAP API in MantisBT before 1.2.9 does not properly enforce the bugnoteallowusereditdelete and deletebugthreshold permissions, which allows remote authenticated users with read and write SOAP API privileges to delete arbitrary bug reports and bug notes...

PT-2012-3094

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.9 Description The issue concerns a permission checking flaw in bug actiongroup.php. This flaw allows remote authenticated users with certain privileges to bypass access restrictions and move bug reports to...

PT-2012-3092

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.9 Description The issue concerns the SOAP API in MantisBT, where it fails to properly enforce certain permissions, specifically bugnote allow user edit delete and delete bug threshold. This allows remote...

PT-2012-3093

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.9 Description The issue allows remote authenticated users with manager privileges to modify or delete global categories due to improper permission checks. Recommendations For versions prior to 1.2.9, update to...

CVE-2012-1121: Undefined Security Weakness

MantisBT before 1.2.9 does not properly check permissions, which allows remote authenticated users with manager privileges to 1 modify or 2 delete global categories...

CVE-2012-1119: Undefined Security Weakness

MantisBT before 1.2.9 does not audit when users copy or clone a bug report, which makes it easier for remote attackers to copy bug reports without detection...

PT-2012-3091

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.9 Description The issue makes it easier for remote attackers to copy bug reports without detection because it does not audit when users copy or clone a bug report. Recommendations For versions prior to 1.2.9,...

PT-2012-3095

Name of the Vulnerable Software and Affected Versions MantisBT versions prior to 1.2.9 Description The issue allows remote attackers to bypass authentication. This is due to the mci check login function in the SOAP API, which permits authentication bypass via a null password. Recommendations For...