bug_actiongroup.php in MantisBT before 1.2.9 does not properly check the report_bug_threshold permission of the receiving project when moving a bug report, which allows remote authenticated users. Rated low severity (CVSS 3.6), this vulnerability is remotely exploitable. Public exploit code available.
slapd in OpenLDAP before 2.4.30 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via an LDAP search query with attrsOnly set to true, which causes empty. Rated low severity (CVSS 2.6), this vulnerability is remotely exploitable. Epss exploitation probability 12.7% and no vendor patch available.
The SOAP API in MantisBT before 1.2.9 does not properly enforce the bugnote_allow_user_edit_delete and delete_bug_threshold permissions, which allows remote authenticated users with read and write. Rated low severity (CVSS 3.6), this vulnerability is remotely exploitable.
Wicd before 1.7.1 saves sensitive information in log files in /var/log/wicd, which allows context-dependent attackers to obtain passwords and other sensitive information. Rated low severity (CVSS 2.1), this vulnerability is low attack complexity. No vendor patch available.
The fpm exporter in Revelation 0.4.13-2 and earlier encrypts the version number but not the password when exporting a file, which might allow local users to obtain sensitive information. Rated low severity (CVSS 2.1), this vulnerability is low attack complexity. No vendor patch available.
virt-edit in libguestfs before 1.18.0 does not preserve the permissions from the original file and saves the new file with world-readable permissions when editing, which might allow local guest users. Rated low severity (CVSS 2.1), this vulnerability is low attack complexity. No vendor patch available.