mantis - security update

Fixed packages 1

Vulnerabilities 21

• Unscored —
  CVE-2013-1811

  An access control issue in MantisBT before 1.2.13 allows users with "Reporter" permissions to change any issue to "New".

  mantis mantis
  Nov 7, 2019
• Unscored —
  CVE-2013-1934

  A cross-site scripting (XSS) vulnerability in the configuration report page (adm_config_report.php) in MantisBT 1.2.0rc…

  mantisbt mantisbt
  Oct 31, 2019
• Unscored —
  CVE-2013-4460

  Cross-site scripting (XSS) vulnerability in account_sponsor_page.php in MantisBT 1.0.0 through 1.2.15 allows remote aut…

  Jan 10, 2014
• Unscored —
  CVE-2014-6316

  core/string_api.php in MantisBT before 1.2.18 does not properly categorize URLs when running under the web root, which …

  Dec 12, 2014
• Unscored —
  CVE-2014-6387

  gpc_api.php in MantisBT 1.2.17 and earlier allows remote attackers to bypass authenticated via a password starting will…

  Oct 22, 2014
• Unscored —
  CVE-2014-7146 Public exploit EPSS 51%

  The XmlImportExport plugin in MantisBT 1.2.17 and earlier allows remote attackers to execute arbitrary PHP code via a c…

  Nov 18, 2014
• Unscored —
  CVE-2014-8553

  The mci_account_get_array_by_id function in api/soap/mc_account_api.php in MantisBT before 1.2.18 allows remote attacke…

  Dec 17, 2014
• Unscored —
  CVE-2014-8554

  SQL injection vulnerability in the mc_project_get_attachments function in api/soap/mc_project_api.php in MantisBT befor…

  Nov 13, 2014
• Unscored —
  CVE-2014-8598 Public exploit EPSS 38%

  The XML Import/Export plugin in MantisBT 1.2.x does not restrict access, which allows remote attackers to (1) upload ar…

  Nov 18, 2014
• Unscored —
  CVE-2014-8986

  Cross-site scripting (XSS) vulnerability in the selection list in the filters in the Configuration Report page (adm_con…

  Nov 24, 2014
• Unscored —
  CVE-2014-8988

  MantisBT before 1.2.18 allows remote authenticated users to bypass the $g_download_attachments_threshold and $g_view_at…

  Nov 24, 2014
• Unscored —
  CVE-2014-9089

  Multiple SQL injection vulnerabilities in view_all_bug_page.php in MantisBT before 1.2.18 allow remote attackers to exe…

  Nov 28, 2014
• Unscored —
  CVE-2014-9117

  MantisBT before 1.2.18 uses the public_key parameter value as the key to the CAPTCHA answer, which allows remote attack…

  Dec 6, 2014
• Unscored —
  CVE-2014-9269

  Cross-site scripting (XSS) vulnerability in helper_api.php in MantisBT 1.1.0a1 through 1.2.x before 1.2.18, when Extend…

  Jan 9, 2015
• Unscored —
  CVE-2014-9270

  Cross-site scripting (XSS) vulnerability in the projax_array_serialize_for_autocomplete function in core/projax_api.php…

  Dec 8, 2014
• Unscored —
  CVE-2014-9271

  Cross-site scripting (XSS) vulnerability in file_download.php in MantisBT before 1.2.18 allows remote authenticated use…

  Jan 9, 2015
• Unscored —
  CVE-2014-9272

  The string_insert_href function in MantisBT 1.2.0a1 through 1.2.x before 1.2.18 does not properly validate the URL prot…

  Jan 9, 2015
• Unscored —
  CVE-2014-9280

  The current_user_get_bug_filter function in core/current_user_api.php in MantisBT before 1.2.18 allows remote attackers…

  Dec 8, 2014
• Unscored —
  CVE-2014-9281

  Cross-site scripting (XSS) vulnerability in admin/copy_field.php in MantisBT before 1.2.18 allows remote attackers to i…

  Dec 9, 2014
• Unscored —
  CVE-2014-9388

  bug_report.php in MantisBT before 1.2.18 allows remote attackers to assign arbitrary issues via the handler_id paramete…

  Dec 17, 2014
• Unscored —
  CVE-2014-9506

  MantisBT before 1.2.18 does not properly check permissions when sending an email that indicates when a monitored issue …

  Jan 4, 2015