CVSS: 7.5EPSS: 1%CPEs: 21EXPL: 1CVE-2014-1608
https://notcve.org/view.php?id=CVE-2014-1608
SQL injection vulnerability in the mci_file_get function in api/soap/mc_file_api.php in MantisBT before 1.2.16 allows remote attackers to execute arbitrary SQL commands via a crafted envelope tag in a mc_issue_attachment_get SOAP request. Vulnerabilidad de inyección SQL en la función mci_file_get en api/soap/mc_file_api.php en MantisBT anterior a 1.2.16 permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de una etiqueta envolvente manipulada en una solicitud mc_issue_attachment_get SOAP. • http://osvdb.org/103118 http://secunia.com/advisories/61432 http://www.debian.org/security/2014/dsa-3030 http://www.mantisbt.org/bugs/view.php?id=16879 http://www.ocert.org/advisories/ocert-2014-001.html http://www.securityfocus.com/bid/65445 https://bugzilla.redhat.com/show_bug.cgi?id=1063111 https://github.com/mantisbt/mantisbt/commit/00b4c17088fa56594d85fe46b6c6057bb3421102 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 3.5EPSS: 0%CPEs: 55EXPL: 1CVE-2013-4460
https://notcve.org/view.php?id=CVE-2013-4460
Cross-site scripting (XSS) vulnerability in account_sponsor_page.php in MantisBT 1.0.0 through 1.2.15 allows remote authenticated users to inject arbitrary web script or HTML via a project name. Vulnerabilidad cross-site scripting (XSS) en account_sponsor_page.php de MantisBT 1.0.0 hasta 1.2.15 permite a usuarios remotos autenticados inyectar script web o HTML de forma arbitraria a través de un nombre de proyecto. • http://osvdb.org/98823 http://seclists.org/oss-sec/2013/q4/168 http://secunia.com/advisories/55305 http://www.mantisbt.org/bugs/view.php?id=16513 https://github.com/mantisbt/mantisbt/commit/0002d106a6cd35cb0a6fe03246531a4e3f32c9d0#diff-4122320b011a3291cd45da074a867076 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 62EXPL: 0CVE-2012-5522
https://notcve.org/view.php?id=CVE-2012-5522
MantisBT before 1.2.12 does not use an expected default value during decisions about whether a user may modify the status of a bug, which allows remote authenticated users to bypass intended access restrictions and make status changes by leveraging a blank value for a per-status setting. MantisBT antes de v1.2.12 no utiliza un valor por defecto esperado durante las decisiones sobre si un usuario puede modificar el estado de un bug, lo que permite a usuarios remotos autenticados eludir restricciones de acceso y hacer cambios en el estado al aprovecharse de un valor en blanco para un configuración "por-estado". • http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092926.html http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093063.html http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093064.html http://openwall.com/lists/oss-security/2012/11/14/1 http://www.mantisbt.org/bugs/changelog_page.php?version_id=150 http://www.mantisbt.org/bugs/view.php?id=14496 http://www.securityfocus.com/bid/56520 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.5EPSS: 0%CPEs: 62EXPL: 0CVE-2012-5523
https://notcve.org/view.php?id=CVE-2012-5523
core/email_api.php in MantisBT before 1.2.12 does not properly manage the sending of e-mail notifications about restricted bugs, which might allow remote authenticated users to obtain sensitive information by adding a note to a bug before losing permission to view that bug. core/email_api.php en MantisBT antes de v1.2.12 no gestiona adecuadamente el envío de notificaciones por correo electrónico sobre bugs restringidos, lo que podría permitir a usuarios remotos autenticados obtener información confidencial mediante la adición de una nota a un error antes de perder el permiso para ver ese error. • http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092926.html http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093063.html http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093064.html http://openwall.com/lists/oss-security/2012/11/14/1 http://www.mantisbt.org/bugs/changelog_page.php?version_id=150 http://www.mantisbt.org/bugs/view.php?id=14704 http://www.securityfocus.com/bid/56520 https://exchange.xforce.ibmcloud.com/vulnerabi • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 3.6EPSS: 0%CPEs: 48EXPL: 0CVE-2012-2692
https://notcve.org/view.php?id=CVE-2012-2692
MantisBT before 1.2.11 does not check the delete_attachments_threshold permission when form_security_validation is set to OFF, which allows remote authenticated users with certain privileges to bypass intended access restrictions and delete arbitrary attachments. MantisBT anterior a v1.2.11 no comprueba el permiso delete_attachments_threshold form_security_validation cuando está en OFF, lo que permite a usuarios remotos autenticados con ciertos privilegios eludir las restricciones de acceso previstas y eliminar archivos adjuntos arbitrarios. • http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092926.html http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093063.html http://lists.fedoraproject.org/pipermail/package-announce/2012-November/093064.html http://secunia.com/advisories/51199 http://security.gentoo.org/glsa/glsa-201211-01.xml http://www.mantisbt.org/bugs/changelog_page.php?version_id=148 http://www.mantisbt.org/bugs/view.php?id=14016 http://www.openwall.com/lists/oss-security/2012/ • CWE-264: Permissions, Privileges, and Access Controls •