SQL injection vulnerability in the mcprojectgetattachments function in api/soap/mcprojectapi.php in MantisBT before 1.2.18 allows remote attackers to execute arbitrary SQL commands via the projectid parameter. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-1609.
The XmlImportExport plugin in MantisBT 1.2.17 and earlier allows remote attackers to execute arbitrary PHP code via a crafted (1) description field or (2) issuelink attribute in an XML file, which is not properly handled when executing the pregreplace function with the e modifier.
Multiple SQL injection vulnerabilities in viewallbugpage.php in MantisBT before 1.2.18 allow remote attackers to execute arbitrary SQL commands via the (1) sort or (2) dir parameter to viewallset.php.
The currentusergetbugfilter function in core/currentuserapi.php in MantisBT before 1.2.18 allows remote attackers to execute arbitrary PHP code via the filter parameter.
The XML Import/Export plugin in MantisBT 1.2.x does not restrict access, which allows remote attackers to (1) upload arbitrary XML files via the import page or (2) obtain sensitive information via the export page. NOTE: this issue can be combined with CVE-2014-7146 to execute arbitrary PHP code.
Cross-site scripting (XSS) vulnerability in MantisBT 1.2.13 and later before 1.2.20.
core/stringapi.php in MantisBT before 1.2.18 does not properly categorize URLs when running under the web root, which allows remote attackers to conduct open redirect and phishing attacks via a crafted URL in the return parameter to loginpage.php.
The stringsanitizeurl function in core/stringapi.php in MantisBT 1.2.0a3 through 1.2.18 uses an incorrect regular expression, which allows remote attackers to conduct open redirect and phishing attacks via a URL with a ":/" (colon slash) separator in the return parameter to loginpage.php, a different vulnerability than CVE-2014-6316.
Cross-site scripting (XSS) vulnerability in filedownload.php in MantisBT before 1.2.18 allows remote authenticated users to inject arbitrary web script or HTML via a Flash file with an image extension, related to inline attachments, as demonstrated by a .swf.jpeg filename.
gpcapi.php in MantisBT 1.2.17 and earlier allows remote attackers to bypass authenticated via a password starting will a null byte, which triggers an unauthenticated bind.
The printtestresult function in admin/upgradeunattended.php in MantisBT 1.1.0a3 through 1.2.x before 1.2.18 allows remote attackers to obtain database credentials via a URL in the hostname parameter and reading the parameters in the response sent to the URL.
MantisBT before 1.2.18 uses the publickey parameter value as the key to the CAPTCHA answer, which allows remote attackers to bypass the CAPTCHA protection mechanism by leveraging knowledge of a CAPTCHA answer for a publickey parameter value, as demonstrated by E4652 for the publickey value 0.
bugreport.php in MantisBT before 1.2.18 allows remote attackers to assign arbitrary issues via the handlerid parameter.
The mciaccountgetarraybyid function in api/soap/mcaccountapi.php in MantisBT before 1.2.18 allows remote attackers to obtain sensitive information via a (1) mcprojectgetusers, (2) mcissueget, (3) mcfiltergetissues, or (4) mcprojectgetissues SOAP request.
Cross-site scripting (XSS) vulnerability in the projaxarrayserializeforautocomplete function in core/projaxapi.php in MantisBT 1.1.0a3 through 1.2.17 allows remote attackers to inject arbitrary web script or HTML via the "profile/Platform" field.
Cross-site scripting (XSS) vulnerability in admin/copyfield.php in MantisBT before 1.2.18 allows remote attackers to inject arbitrary web script or HTML via the destid field.
The stringinserthref function in MantisBT 1.2.0a1 through 1.2.x before 1.2.18 does not properly validate the URL protocol, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the javascript:// protocol.
MantisBT before 1.2.18 allows remote authenticated users to bypass the $gdownloadattachmentsthreshold and $gviewattachmentsthreshold restrictions and read attachments for private projects by leveraging access to a project that does not restrict access to attachments and a request to the download URL.
Cross-site scripting (XSS) vulnerability in the selection list in the filters in the Configuration Report page (admconfigreport.php) in MantisBT 1.2.13 through 1.2.17 allows remote administrators to inject arbitrary web script or HTML via a crafted config option, a different vulnerability than CVE-2014-8987.
Cross-site scripting (XSS) vulnerability in the "set configuration" box in the Configuration Report page (admconfigreport.php) in MantisBT 1.2.13 through 1.2.17 allows remote administrators to inject arbitrary web script or HTML via the configoption parameter, a different vulnerability than CVE-2014-8986.
Cross-site scripting (XSS) vulnerability in helperapi.php in MantisBT 1.1.0a1 through 1.2.x before 1.2.18, when Extended project browser is enabled, allows remote attackers to inject arbitrary web script or HTML via the project cookie.