Page 7 of 78 results (0.008 seconds)

CVSS: 6.4EPSS: 3%CPEs: 59EXPL: 1

CVE-2012-1119

https://notcve.org/view.php?id=CVE-2012-1119

29 Jun 2012 — MantisBT before 1.2.9 does not audit when users copy or clone a bug report, which makes it easier for remote attackers to copy bug reports without detection. MantisBT anteriores a 1.2.9 no audita la acción de un usuario de copiar o clonar un reporte de bug, lo que facilita a atacantes remotos copiar reportes de bug sin detección. • http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092926.html • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 8.1EPSS: 0%CPEs: 59EXPL: 0

CVE-2012-1120

https://notcve.org/view.php?id=CVE-2012-1120

29 Jun 2012 — The SOAP API in MantisBT before 1.2.9 does not properly enforce the bugnote_allow_user_edit_delete and delete_bug_threshold permissions, which allows remote authenticated users with read and write SOAP API privileges to delete arbitrary bug reports and bug notes. La API SOAP de MantisBT anteriores a 1.2.9 no establece adecuadamente los permisos bugnote_allow_user_edit_delete y delete_bug_threshold permissions, lo que permite a usuarios autenticados remotos con privilegios SOAP API de lectura y escritura bor... • http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092926.html • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 6.5EPSS: 1%CPEs: 59EXPL: 1

CVE-2012-1121

https://notcve.org/view.php?id=CVE-2012-1121

29 Jun 2012 — MantisBT before 1.2.9 does not properly check permissions, which allows remote authenticated users with manager privileges to (1) modify or (2) delete global categories. MantisBT anteriores a 1.2.9 no comprueba adecuadamente permisos, lo que permite a usuarios autenticados remotos con privilegios de manager (1) modificar o (2) borrar categorías globales. • http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092926.html • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 8.1EPSS: 1%CPEs: 46EXPL: 1

CVE-2012-1122

https://notcve.org/view.php?id=CVE-2012-1122

29 Jun 2012 — bug_actiongroup.php in MantisBT before 1.2.9 does not properly check the report_bug_threshold permission of the receiving project when moving a bug report, which allows remote authenticated users with the report_bug_threshold and move_bug_threshold privileges for a project to bypass intended access restrictions and move bug reports to a different project. bug_actiongroup.php de MantisBT anteriores a 1.2.9 no comprueba apropiadamente el permiso report_bug_threshold del proyecto destino cuando se mueve un rep... • http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092926.html • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 9.8EPSS: 1%CPEs: 59EXPL: 0

CVE-2012-1123

https://notcve.org/view.php?id=CVE-2012-1123

29 Jun 2012 — The mci_check_login function in api/soap/mc_api.php in the SOAP API in MantisBT before 1.2.9 allows remote attackers to bypass authentication via a null password. La función mci_check_login de api/soap/mc_api.php de la API SOAP de MantisBT anteriores a 1.2.9 permite a atacantes remotos evitar la autenticación a través de una contraseña nula. • http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092926.html • CWE-287: Improper Authentication •

CVSS: 9.8EPSS: 3%CPEs: 60EXPL: 2

CVE-2012-2691

https://notcve.org/view.php?id=CVE-2012-2691

17 Jun 2012 — The mc_issue_note_update function in the SOAP API in MantisBT before 1.2.11 does not properly check privileges, which allows remote attackers with bug reporting privileges to edit arbitrary bugnotes via a SOAP request. La función de mc_issue_note_update en la API SOAP en MantisBT anterior a v1.2.11 no comprueba correctamente los privilegios, lo que permite a atacantes remotos con privilegios de reporte de informes de errores editar bugnotes arbitrarios a través de una solicitud SOAP. • http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092926.html • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 6.5EPSS: 0%CPEs: 48EXPL: 0

CVE-2012-2692

https://notcve.org/view.php?id=CVE-2012-2692

17 Jun 2012 — MantisBT before 1.2.11 does not check the delete_attachments_threshold permission when form_security_validation is set to OFF, which allows remote authenticated users with certain privileges to bypass intended access restrictions and delete arbitrary attachments. MantisBT anterior a v1.2.11 no comprueba el permiso delete_attachments_threshold form_security_validation cuando está en OFF, lo que permite a usuarios remotos autenticados con ciertos privilegios eludir las restricciones de acceso previstas y elim... • http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092926.html • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 6.1EPSS: 1%CPEs: 27EXPL: 8

CVE-2011-3578

https://notcve.org/view.php?id=CVE-2011-3578

21 Sep 2011 — Cross-site scripting (XSS) vulnerability in bug_actiongroup_ext_page.php in MantisBT before 1.2.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter, related to bug_actiongroup_page.php, a different vulnerability than CVE-2011-3357. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en bug_actiongroup_ext_page.php en MantisBT antes de 1.2.8, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro action, r... • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=640297 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 21%CPEs: 26EXPL: 10

CVE-2011-2938 – Mantis Bug Tracker 1.1.8 - Cross-Site Scripting / SQL Injection

https://notcve.org/view.php?id=CVE-2011-2938

21 Sep 2011 — Multiple cross-site scripting (XSS) vulnerabilities in filter_api.php in MantisBT before 1.2.7 allow remote attackers to inject arbitrary web script or HTML via a parameter, as demonstrated by the project_id parameter to search.php. Varias vulnerabilidades de ejecución de comandos en sitios cruzados (XSS) en filter_api.php en MantisBT antes de la versión v1.2.7 permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de un parámetro, tal y como se demuestra por el parámetro project_id... • https://www.exploit-db.com/exploits/36068 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 6.1EPSS: 0%CPEs: 27EXPL: 9

CVE-2011-3356

https://notcve.org/view.php?id=CVE-2011-3356

21 Sep 2011 — Multiple cross-site scripting (XSS) vulnerabilities in config_defaults_inc.php in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO, as demonstrated by the PATH_INFO to (1) manage_config_email_page.php, (2) manage_config_workflow_page.php, or (3) bugs/plugin.php. Múltiples vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en confige_defaults_inc.php en MantisBT antes de v1.2.8, permite a atacantes remotos inyectar secuencias de... • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=640297 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •