CVSS: 9.8EPSS: 0%CPEs: 21EXPL: 1CVE-2014-1609 – Debian Security Advisory 3030-1
https://notcve.org/view.php?id=CVE-2014-1609
09 Feb 2014 — Multiple SQL injection vulnerabilities in MantisBT before 1.2.16 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to the (1) mc_project_get_attachments function in api/soap/mc_project_api.php; the (2) news_get_limited_rows function in core/news_api.php; the (3) summary_print_by_enum, (4) summary_print_by_age, (5) summary_print_by_developer, (6) summary_print_by_reporter, or (7) summary_print_by_category function in core/summary_api.php; the (8) create_bug_enum_summary or (... • http://secunia.com/advisories/61432 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.4EPSS: 0%CPEs: 55EXPL: 1CVE-2013-4460
https://notcve.org/view.php?id=CVE-2013-4460
10 Jan 2014 — Cross-site scripting (XSS) vulnerability in account_sponsor_page.php in MantisBT 1.0.0 through 1.2.15 allows remote authenticated users to inject arbitrary web script or HTML via a project name. Vulnerabilidad cross-site scripting (XSS) en account_sponsor_page.php de MantisBT 1.0.0 hasta 1.2.15 permite a usuarios remotos autenticados inyectar script web o HTML de forma arbitraria a través de un nombre de proyecto. • http://osvdb.org/98823 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 62EXPL: 0CVE-2012-5522
https://notcve.org/view.php?id=CVE-2012-5522
16 Nov 2012 — MantisBT before 1.2.12 does not use an expected default value during decisions about whether a user may modify the status of a bug, which allows remote authenticated users to bypass intended access restrictions and make status changes by leveraging a blank value for a per-status setting. MantisBT antes de v1.2.12 no utiliza un valor por defecto esperado durante las decisiones sobre si un usuario puede modificar el estado de un bug, lo que permite a usuarios remotos autenticados eludir restricciones de acces... • http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092926.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.5EPSS: 0%CPEs: 62EXPL: 0CVE-2012-5523
https://notcve.org/view.php?id=CVE-2012-5523
16 Nov 2012 — core/email_api.php in MantisBT before 1.2.12 does not properly manage the sending of e-mail notifications about restricted bugs, which might allow remote authenticated users to obtain sensitive information by adding a note to a bug before losing permission to view that bug. core/email_api.php en MantisBT antes de v1.2.12 no gestiona adecuadamente el envío de notificaciones por correo electrónico sobre bugs restringidos, lo que podría permitir a usuarios remotos autenticados obtener información confidencial ... • http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092926.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 3%CPEs: 60EXPL: 2CVE-2012-2691
https://notcve.org/view.php?id=CVE-2012-2691
17 Jun 2012 — The mc_issue_note_update function in the SOAP API in MantisBT before 1.2.11 does not properly check privileges, which allows remote attackers with bug reporting privileges to edit arbitrary bugnotes via a SOAP request. La función de mc_issue_note_update en la API SOAP en MantisBT anterior a v1.2.11 no comprueba correctamente los privilegios, lo que permite a atacantes remotos con privilegios de reporte de informes de errores editar bugnotes arbitrarios a través de una solicitud SOAP. • http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092926.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.5EPSS: 0%CPEs: 48EXPL: 0CVE-2012-2692
https://notcve.org/view.php?id=CVE-2012-2692
17 Jun 2012 — MantisBT before 1.2.11 does not check the delete_attachments_threshold permission when form_security_validation is set to OFF, which allows remote authenticated users with certain privileges to bypass intended access restrictions and delete arbitrary attachments. MantisBT anterior a v1.2.11 no comprueba el permiso delete_attachments_threshold form_security_validation cuando está en OFF, lo que permite a usuarios remotos autenticados con ciertos privilegios eludir las restricciones de acceso previstas y elim... • http://lists.fedoraproject.org/pipermail/package-announce/2012-November/092926.html • CWE-264: Permissions, Privileges, and Access Controls •