|
2019-11-09
|
CVE-2009-2802 |
MantisBT 1.2.x before 1.2.2 insecurely handles attachments and MIME types. Arbitrary inline attachment rendering could lead to cross-domain scripting or other browser attacks. |
Mantisbt
|
N/A
|
|
|
2019-11-07
|
CVE-2013-1811 |
An access control issue in MantisBT before 1.2.13 allows users with "Reporter" permissions to change any issue to "New". |
Debian_linux,
Mantisbt
|
N/A
|
|
|
2019-10-31
|
CVE-2013-1930 |
MantisBT 1.2.12 before 1.2.15 allows authenticated users to by the workflow restriction and close issues. |
Fedora,
Mantisbt
|
N/A
|
|
|
2019-10-31
|
CVE-2013-1931 |
A cross-site scripting (XSS) vulnerability in MantisBT 1.2.14 allows remote attackers to inject arbitrary web script or HTML via a version, related to deleting a version. |
Fedora,
Mantisbt
|
N/A
|
|
|
2019-10-31
|
CVE-2013-1932 |
A cross-site scripting (XSS) vulnerability in the configuration report page (adm_config_report.php) in MantisBT 1.2.13 allows remote authenticated users to inject arbitrary web script or HTML via a project name. |
Mantisbt
|
N/A
|
|
|
2019-10-31
|
CVE-2013-1934 |
A cross-site scripting (XSS) vulnerability in the configuration report page (adm_config_report.php) in MantisBT 1.2.0rc1 before 1.2.14 allows remote authenticated users to inject arbitrary web script or HTML via a complex value. |
Debian_linux,
Mantisbt
|
N/A
|
|
|
2019-10-09
|
CVE-2019-15715 |
MantisBT before 1.3.20 and 2.22.1 allows Post Authentication Command Injection, leading to Remote Code Execution. |
Mantisbt
|
N/A
|
|
|
2019-08-21
|
CVE-2019-15074 |
The Timeline feature in my_view_page.php in MantisBT through 2.21.1 has a stored cross-site scripting (XSS) vulnerability, allowing execution of arbitrary code (if CSP settings permit it) after uploading an attachment with a crafted filename. The code is executed for any user having visibility to the issue, whenever My View Page is displayed. |
Mantisbt
|
9.6
|
|
|
2019-06-20
|
CVE-2018-16514 |
A cross-site scripting (XSS) vulnerability in the View Filters page (view_filters_page.php) and Edit Filter page (manage_filter_edit_page.php) in MantisBT 2.1.0 through 2.17.0 allows remote attackers to inject arbitrary code (if CSP settings permit it) through a crafted PATH_INFO. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-13055. |
Mantisbt
|
4.7
|
|
|
2019-06-06
|
CVE-2018-9839 |
An issue was discovered in MantisBT through 1.3.14, and 2.0.0. Using a crafted request on bug_report_page.php (modifying the 'm_id' parameter), any user with REPORTER access or above is able to view any private issue's details (summary, description, steps to reproduce, additional information) when cloning it. By checking the 'Copy issue notes' and 'Copy attachments' checkboxes and completing the clone operation, this data also becomes public (except private notes). |
Mantisbt
|
6.5
|
|