| Max CVSS | 7.5 | Min CVSS | 3.6 | Total Count | 2 |
| ID | CVSS | Summary | Last (major) update | Published | |
| CVE-2012-1120 | 3.6 |
The SOAP API in MantisBT before 1.2.9 does not properly enforce the bugnote_allow_user_edit_delete and delete_bug_threshold permissions, which allows remote authenticated users with read and write SOAP API privileges to delete arbitrary bug reports a
|
12-01-2021 - 18:05 | 29-06-2012 - 19:55 | |
| CVE-2012-1123 | 7.5 |
The mci_check_login function in api/soap/mc_api.php in the SOAP API in MantisBT before 1.2.9 allows remote attackers to bypass authentication via a null password.
|
12-01-2021 - 18:05 | 29-06-2012 - 19:55 | |
| CVE-2012-1119 | 6.4 |
MantisBT before 1.2.9 does not audit when users copy or clone a bug report, which makes it easier for remote attackers to copy bug reports without detection.
|
12-01-2021 - 18:05 | 29-06-2012 - 19:55 | |
| CVE-2012-1122 | 3.6 |
bug_actiongroup.php in MantisBT before 1.2.9 does not properly check the report_bug_threshold permission of the receiving project when moving a bug report, which allows remote authenticated users with the report_bug_threshold and move_bug_threshold p
|
27-08-2013 - 03:21 | 29-06-2012 - 19:55 | |
| CVE-2012-1118 | 4.3 |
The access_has_bug_level function in core/access_api.php in MantisBT before 1.2.9 does not properly restrict access when the private_bug_view_threshold is set to an array, which allows remote attackers to bypass intended restrictions and perform cert
|
27-08-2013 - 03:21 | 29-06-2012 - 19:55 |