SQL injection vulnerability in the mcprojectgetattachments function in api/soap/mcprojectapi.php in MantisBT before 1.2.18 allows remote attackers to execute arbitrary SQL commands via the projectid parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1609.
Directory traversal vulnerability in bugactiongroupextpage.php in MantisBT before 1.2.8 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the action parameter, related to bugactiongrouppage.php.
core/emailapi.php in MantisBT before 1.2.12 does not properly manage the sending of e-mail notifications about restricted bugs, which might allow remote authenticated users to obtain sensitive information by adding a note to a bug before losing permission to view that bug.
MantisBT before 1.2.12 does not use an expected default value during decisions about whether a user may modify the status of a bug, which allows remote authenticated users to bypass intended access restrictions and make status changes by leveraging a blank value for a per-status setting.
Directory traversal vulnerability in admin/upgradeunattended.php in MantisBT before 1.2.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the dbtype parameter, related to an unsafe call by MantisBT to a function in the ADOdb Library for PHP.
admin/upgradeunattended.php in MantisBT before 1.2.4 allows remote attackers to obtain sensitive information via an invalid dbtype parameter, which reveals the installation path in an error message, related to an unsafe call by MantisBT to a function in the ADOdb Library for PHP.
Multiple cross-site scripting (XSS) vulnerabilities in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the (1) os, (2) osbuild, or (3) platform parameter to (a) bugreportpage.php or (b) bugupdateadvancedpage.php, related to use of the Projax library.
A local file inclusion/path traversal vulnerability and XSS flaw was found in the Mantis bug tracker version 1.2.7 [1],[2].
[1] https://www.htbridge.ch/advisory/multiplevulnerabilitiesinmantisbt.html [2] https://github.com/mantisbt/mantisbt/commit/a7eacc181185eff1dd7bd8ceaa34a91cf86cc298
Cross-site scripting (XSS) vulnerability in bugactiongroupextpage.php in MantisBT before 1.2.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter, related to bugactiongrouppage.php, a different vulnerability than CVE-2011-3357.
Multiple cross-site scripting (XSS) vulnerabilities in filterapi.php in MantisBT before 1.2.7 allow remote attackers to inject arbitrary web script or HTML via a parameter, as demonstrated by the projectid parameter to search.php.
Cross-site scripting (XSS) vulnerability in admin/upgradeunattended.php in MantisBT before 1.2.4 allows remote attackers to inject arbitrary web script or HTML via the dbtype parameter, related to an unsafe call by MantisBT to a function in the ADOdb Library for PHP.
Multiple cross-site scripting (XSS) vulnerabilities in MantisBT before 1.2.3 allow remote authenticated administrators to inject arbitrary web script or HTML via (1) a plugin name, related to managepluginuninstall.php; (2) an enumeration value or (3) a String value of a custom field, related to core/cfdefs/cfdefstandard.php; or a (4) project or (5) category name to printallbugpageword.php.