Total
110 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2010-3763 | 1 Mantisbt | 1 Mantisbt | 2024-11-21 | 4.3 MEDIUM | N/A |
| Cross-site scripting (XSS) vulnerability in core/summary_api.php in MantisBT before 1.2.3 allows remote attackers to inject arbitrary web script or HTML via the Summary field, a different vector than CVE-2010-3303. | |||||
| CVE-2010-3303 | 1 Mantisbt | 1 Mantisbt | 2024-11-21 | 3.5 LOW | N/A |
| Multiple cross-site scripting (XSS) vulnerabilities in MantisBT before 1.2.3 allow remote authenticated administrators to inject arbitrary web script or HTML via (1) a plugin name, related to manage_plugin_uninstall.php; (2) an enumeration value or (3) a String value of a custom field, related to core/cfdefs/cfdef_standard.php; or a (4) project or (5) category name to print_all_bug_page_word.php. | |||||
| CVE-2010-2802 | 1 Mantisbt | 1 Mantisbt | 2024-11-21 | 3.5 LOW | N/A |
| Cross-site scripting (XSS) vulnerability in MantisBT before 1.2.2 allows remote authenticated users to inject arbitrary web script or HTML via an HTML document with a .gif filename extension, related to inline attachments. | |||||
| CVE-2010-2574 | 1 Mantisbt | 1 Mantisbt | 2024-11-21 | 2.1 LOW | N/A |
| Cross-site scripting (XSS) vulnerability in manage_proj_cat_add.php in MantisBT 1.2.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the name parameter in an Add Category action. | |||||
| CVE-2008-3102 | 1 Mantisbt | 1 Mantisbt | 2024-11-21 | 5.0 MEDIUM | N/A |
| Mantis 1.1.x through 1.1.2 and 1.2.x through 1.2.0a2 does not set the secure flag for the session cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie. | |||||
| CVE-2018-6382 | 1 Mantisbt | 1 Mantisbt | 2024-08-05 | 2.1 LOW | 3.3 LOW |
| MantisBT 2.10.0 allows local users to conduct SQL Injection attacks via the vendor/adodb/adodb-php/server.php sql parameter in a request to the 127.0.0.1 IP address. NOTE: the vendor disputes the significance of this report because server.php is intended to execute arbitrary SQL statements on behalf of authenticated users from 127.0.0.1, and the issue does not have an authentication bypass | |||||
| CVE-2023-44394 | 1 Mantisbt | 1 Mantisbt | 2024-02-28 | N/A | 4.3 MEDIUM |
| MantisBT is an open source bug tracker. Due to insufficient access-level checks on the Wiki redirection page, any user can reveal private Projects' names, by accessing wiki.php with sequentially incremented IDs. This issue has been addressed in commit `65c44883f` which has been included in release `2.258`. Users are advised to upgrade. Users unable to upgrade should disable wiki integration ( `$g_wiki_enable = OFF;`). | |||||
| CVE-2023-22476 | 1 Mantisbt | 1 Mantisbt | 2024-02-28 | N/A | 4.3 MEDIUM |
| Mantis Bug Tracker (MantisBT) is an open source issue tracker. In versions prior to 2.25.6, due to insufficient access-level checks, any logged-in user allowed to perform Group Actions can access to the _Summary_ field of private Issues (i.e. having Private view status, or belonging to a private Project) via a crafted `bug_arr[]` parameter in *bug_actiongroup_ext.php*. This issue is fixed in version 2.25.6. There are no workarounds. | |||||
| CVE-2022-28508 | 1 Mantisbt | 1 Mantisbt | 2024-02-28 | 4.3 MEDIUM | 6.1 MEDIUM |
| An XSS issue was discovered in browser_search_plugin.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field. | |||||
| CVE-2022-26144 | 1 Mantisbt | 1 Mantisbt | 2024-02-28 | 4.3 MEDIUM | 6.1 MEDIUM |
| An XSS issue was discovered in MantisBT before 2.25.3. Improper escaping of a Plugin name allows execution of arbitrary code (if CSP allows it) in manage_plugin_page.php and manage_plugin_uninstall.php when a crafted plugin is installed. | |||||
| CVE-2021-43257 | 1 Mantisbt | 1 Mantisbt | 2024-02-28 | 6.0 MEDIUM | 7.8 HIGH |
| Lack of Neutralization of Formula Elements in the CSV API of MantisBT before 2.25.3 allows an unprivileged attacker to execute code or gain access to information when a user opens the csv_export.php generated CSV file in Excel. | |||||
| CVE-2022-33910 | 1 Mantisbt | 1 Mantisbt | 2024-02-28 | 3.5 LOW | 5.4 MEDIUM |
| An XSS vulnerability in MantisBT before 2.25.5 allows remote attackers to attach crafted SVG documents to issue reports or bugnotes. When a user or an admin clicks on the attachment, file_download.php opens the SVG document in a browser tab instead of downloading it as a file, causing the JavaScript code to execute. | |||||
| CVE-2021-33557 | 1 Mantisbt | 1 Mantisbt | 2024-02-28 | 4.3 MEDIUM | 6.1 MEDIUM |
| An XSS issue was discovered in manage_custom_field_edit_page.php in MantisBT before 2.25.2. Unescaped output of the return parameter allows an attacker to inject code into a hidden input field. | |||||
| CVE-2020-29603 | 2 Mantisbt, Microsoft | 2 Mantisbt, Windows | 2024-02-28 | 4.0 MEDIUM | 4.3 MEDIUM |
| In manage_proj_edit_page.php in MantisBT before 2.24.4, any unprivileged logged-in user can retrieve Private Projects' names via the manage_proj_edit_page.php project_id parameter, without having access to them. | |||||
| CVE-2020-25830 | 1 Mantisbt | 1 Mantisbt | 2024-02-28 | 3.5 LOW | 4.8 MEDIUM |
| An issue was discovered in MantisBT before 2.24.3. Improper escaping of a custom field's name allows an attacker to inject HTML and, if CSP settings permit, achieve execution of arbitrary JavaScript when attempting to update said custom field via bug_actiongroup_page.php. | |||||
| CVE-2020-35849 | 1 Mantisbt | 1 Mantisbt | 2024-02-28 | 5.0 MEDIUM | 7.5 HIGH |
| An issue was discovered in MantisBT before 2.24.4. An incorrect access check in bug_revision_view_page.php allows an unprivileged attacker to view the Summary field of private issues, as well as bugnotes revisions, gaining access to potentially confidential information via the bugnote_id parameter. | |||||
| CVE-2020-35571 | 1 Mantisbt | 1 Mantisbt | 2024-02-28 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in MantisBT through 2.24.3. In the helper_ensure_confirmed call in manage_custom_field_update.php, the custom field name is not sanitized. This may be problematic depending on CSP settings. | |||||
| CVE-2020-25781 | 1 Mantisbt | 1 Mantisbt | 2024-02-28 | 4.0 MEDIUM | 4.3 MEDIUM |
| An issue was discovered in file_download.php in MantisBT before 2.24.3. Users without access to view private issue notes are able to download the (supposedly private) attachments linked to these notes by accessing the corresponding file download URL directly. | |||||
| CVE-2009-20001 | 1 Mantisbt | 1 Mantisbt | 2024-02-28 | 5.5 MEDIUM | 8.1 HIGH |
| An issue was discovered in MantisBT before 2.24.5. It associates a unique cookie string with each user. This string is not reset upon logout (i.e., the user session is still considered valid and active), allowing an attacker who somehow gained access to a user's cookie to login as them. | |||||
| CVE-2020-28413 | 1 Mantisbt | 1 Mantisbt | 2024-02-28 | 4.0 MEDIUM | 6.5 MEDIUM |
| In MantisBT 2.24.3, SQL Injection can occur in the parameter "access" of the mc_project_get_users function through the API SOAP. | |||||