Mantisbt : Security Vulnerabilities, CVEs, Published In 2011
MantisBT 1.2.4 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by view_all_inc.php and certain other files.
Max CVSS
5.0
EPSS Score
0.52%
Published
2011-09-23
Updated
2013-08-27
Cross-site scripting (XSS) vulnerability in bug_actiongroup_ext_page.php in MantisBT before 1.2.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter, related to bug_actiongroup_page.php, a different vulnerability than CVE-2011-3357.
Max CVSS
4.3
EPSS Score
0.45%
Published
2011-09-21
Updated
2018-10-09
Multiple cross-site scripting (XSS) vulnerabilities in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the (1) os, (2) os_build, or (3) platform parameter to (a) bug_report_page.php or (b) bug_update_advanced_page.php, related to use of the Projax library.
Max CVSS
4.3
EPSS Score
0.33%
Published
2011-09-21
Updated
2018-10-09
Directory traversal vulnerability in bug_actiongroup_ext_page.php in MantisBT before 1.2.8 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the action parameter, related to bug_actiongroup_page.php.
Max CVSS
6.8
EPSS Score
1.00%
Published
2011-09-21
Updated
2018-10-09
Multiple cross-site scripting (XSS) vulnerabilities in config_defaults_inc.php in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO, as demonstrated by the PATH_INFO to (1) manage_config_email_page.php, (2) manage_config_workflow_page.php, or (3) bugs/plugin.php.
Max CVSS
4.3
EPSS Score
0.33%
Published
2011-09-21
Updated
2018-10-09
Multiple cross-site scripting (XSS) vulnerabilities in filter_api.php in MantisBT before 1.2.7 allow remote attackers to inject arbitrary web script or HTML via a parameter, as demonstrated by the project_id parameter to search.php.
Max CVSS
4.3
EPSS Score
1.25%
Published
2011-09-21
Updated
2013-08-27
Directory traversal vulnerability in admin/upgrade_unattended.php in MantisBT before 1.2.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the db_type parameter, related to an unsafe call by MantisBT to a function in the ADOdb Library for PHP.
Max CVSS
5.1
EPSS Score
2.44%
Published
2011-01-03
Updated
2013-08-27
admin/upgrade_unattended.php in MantisBT before 1.2.4 allows remote attackers to obtain sensitive information via an invalid db_type parameter, which reveals the installation path in an error message, related to an unsafe call by MantisBT to a function in the ADOdb Library for PHP.
Max CVSS
5.0
EPSS Score
0.67%
Published
2011-01-03
Updated
2017-08-17
Cross-site scripting (XSS) vulnerability in admin/upgrade_unattended.php in MantisBT before 1.2.4 allows remote attackers to inject arbitrary web script or HTML via the db_type parameter, related to an unsafe call by MantisBT to a function in the ADOdb Library for PHP.
Max CVSS
4.3
EPSS Score
0.48%
Published
2011-01-03
Updated
2013-08-27
9 vulnerabilities found