SQL injection vulnerability in the mcprojectgetattachments function in api/soap/mcprojectapi.php in MantisBT before 1.2.18 allows remote attackers to execute arbitrary SQL commands via the projectid parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1609.
Directory traversal vulnerability in bugactiongroupextpage.php in MantisBT before 1.2.8 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the action parameter, related to bugactiongrouppage.php.
The stringsanitizeurl function in core/stringapi.php in MantisBT 1.2.0a3 through 1.2.18 uses an incorrect regular expression, which allows remote attackers to conduct open redirect and phishing attacks via a URL with a ":/" (colon slash) separator in the return parameter to loginpage.php, a different vulnerability than CVE-2014-6316.
core/emailapi.php in MantisBT before 1.2.12 does not properly manage the sending of e-mail notifications about restricted bugs, which might allow remote authenticated users to obtain sensitive information by adding a note to a bug before losing permission to view that bug.
MantisBT before 1.2.12 does not use an expected default value during decisions about whether a user may modify the status of a bug, which allows remote authenticated users to bypass intended access restrictions and make status changes by leveraging a blank value for a per-status setting.
Cross-site scripting (XSS) vulnerability in filedownload.php in MantisBT before 1.2.18 allows remote authenticated users to inject arbitrary web script or HTML via a Flash file with an image extension, related to inline attachments, as demonstrated by a .swf.jpeg filename.
A cross-site scripting (XSS) vulnerability in the configuration report page (admconfigreport.php) in MantisBT 1.2.0rc1 before 1.2.14 allows remote authenticated users to inject arbitrary web script or HTML via a complex value.
Directory traversal vulnerability in admin/upgradeunattended.php in MantisBT before 1.2.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the dbtype parameter, related to an unsafe call by MantisBT to a function in the ADOdb Library for PHP.
gpcapi.php in MantisBT 1.2.17 and earlier allows remote attackers to bypass authenticated via a password starting will a null byte, which triggers an unauthenticated bind.
The printtestresult function in admin/upgradeunattended.php in MantisBT 1.1.0a3 through 1.2.x before 1.2.18 allows remote attackers to obtain database credentials via a URL in the hostname parameter and reading the parameters in the response sent to the URL.
admin/upgradeunattended.php in MantisBT before 1.2.4 allows remote attackers to obtain sensitive information via an invalid dbtype parameter, which reveals the installation path in an error message, related to an unsafe call by MantisBT to a function in the ADOdb Library for PHP.
Multiple cross-site scripting (XSS) vulnerabilities in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the (1) os, (2) osbuild, or (3) platform parameter to (a) bugreportpage.php or (b) bugupdateadvancedpage.php, related to use of the Projax library.
A local file inclusion/path traversal vulnerability and XSS flaw was found in the Mantis bug tracker version 1.2.7 [1],[2].
[1] https://www.htbridge.ch/advisory/multiplevulnerabilitiesinmantisbt.html [2] https://github.com/mantisbt/mantisbt/commit/a7eacc181185eff1dd7bd8ceaa34a91cf86cc298
Cross-site scripting (XSS) vulnerability in bugactiongroupextpage.php in MantisBT before 1.2.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter, related to bugactiongrouppage.php, a different vulnerability than CVE-2011-3357.
Cross-site scripting (XSS) vulnerability in the projaxarrayserializeforautocomplete function in core/projaxapi.php in MantisBT 1.1.0a3 through 1.2.17 allows remote attackers to inject arbitrary web script or HTML via the "profile/Platform" field.
The stringinserthref function in MantisBT 1.2.0a1 through 1.2.x before 1.2.18 does not properly validate the URL protocol, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the javascript:// protocol.
Multiple cross-site scripting (XSS) vulnerabilities in filterapi.php in MantisBT before 1.2.7 allow remote attackers to inject arbitrary web script or HTML via a parameter, as demonstrated by the projectid parameter to search.php.
Cross-site scripting (XSS) vulnerability in admin/upgradeunattended.php in MantisBT before 1.2.4 allows remote attackers to inject arbitrary web script or HTML via the dbtype parameter, related to an unsafe call by MantisBT to a function in the ADOdb Library for PHP.
Cross-site scripting (XSS) vulnerability in accountsponsorpage.php in MantisBT 1.0.0 through 1.2.15 allows remote authenticated users to inject arbitrary web script or HTML via a project name.
Multiple cross-site scripting (XSS) vulnerabilities in MantisBT before 1.2.3 allow remote authenticated administrators to inject arbitrary web script or HTML via (1) a plugin name, related to managepluginuninstall.php; (2) an enumeration value or (3) a String value of a custom field, related to core/cfdefs/cfdefstandard.php; or a (4) project or (5) category name to printallbugpageword.php.
Cross-site scripting (XSS) vulnerability in helperapi.php in MantisBT 1.1.0a1 through 1.2.x before 1.2.18, when Extended project browser is enabled, allows remote attackers to inject arbitrary web script or HTML via the project cookie.