Mantisbt

CVE-2012-1122 Jun 29, 19:55 LOW POC PATCH Monitor

bug_actiongroup.php in MantisBT before 1.2.9 does not properly check the report_bug_threshold permission of the receiving project when moving a bug report, which allows remote authenticated users. Rated low severity (CVSS 3.6), this vulnerability is remotely exploitable. Public exploit code available.

CVE-2012-1121 Jun 29, 19:55 MEDIUM POC PATCH This Month

MantisBT before 1.2.9 does not properly check permissions, which allows remote authenticated users with manager privileges to (1) modify or (2) delete global categories. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable. Public exploit code available.

CVE-2012-1120 Jun 29, 19:55 LOW PATCH Monitor

The SOAP API in MantisBT before 1.2.9 does not properly enforce the bugnote_allow_user_edit_delete and delete_bug_threshold permissions, which allows remote authenticated users with read and write. Rated low severity (CVSS 3.6), this vulnerability is remotely exploitable.

CVE-2012-1119 Jun 29, 19:55 MEDIUM POC PATCH This Month

MantisBT before 1.2.9 does not audit when users copy or clone a bug report, which makes it easier for remote attackers to copy bug reports without detection. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

CVE-2012-1118 Jun 29, 19:55 MEDIUM POC PATCH This Month

The access_has_bug_level function in core/access_api.php in MantisBT before 1.2.9 does not properly restrict access when the private_bug_view_threshold is set to an array, which allows remote. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available.

CVE-2012-2692 Jun 17, 03:41 LOW PATCH Monitor

MantisBT before 1.2.11 does not check the delete_attachments_threshold permission when form_security_validation is set to OFF, which allows remote authenticated users with certain privileges to. Rated low severity (CVSS 3.6), this vulnerability is remotely exploitable.

CVE-2012-2691 Jun 17, 03:41 HIGH POC PATCH This Week

The mc_issue_note_update function in the SOAP API in MantisBT before 1.2.11 does not properly check privileges, which allows remote attackers with bug reporting privileges to edit arbitrary bugnotes. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.