mantisbt/mantisbt Security Advisories for 2.24.4 (14)
-
[MEDIUM] MantisBT vulnerable to information disclosure with user profiles
PKSA-9rc9-dxmv-6ty7 CVE-2024-45792 GHSA-h5q3-fjp4-2x7r
Affected version: <=2.26.3
Reported by:
GitHub -
[MEDIUM] Mantis Bug Tracker (MantisBT) vulnerable to cross-site scripting
PKSA-s5w7-qrwt-4ggd CVE-2024-34081 GHSA-wgx7-jp56-65mq
Affected version: <2.26.2
Reported by:
GitHub -
[MEDIUM] MantisBT Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
PKSA-sqwp-pr85-66jc CVE-2024-34080 GHSA-99jc-wqmr-ff2q
Affected version: <2.26.2
Reported by:
GitHub -
[HIGH] Mantis Bug Tracker (MantisBT) allows user account takeover in the signup/reset password process
PKSA-vn99-1c14-x82z CVE-2024-34077 GHSA-93x3-m7pw-ppqm
Affected version: <=2.26.1
Reported by:
GitHub -
[HIGH] MantisBT Host Header Injection vulnerability
PKSA-h79w-zb4t-bjtf CVE-2024-23830 GHSA-mcqj-7p29-9528
Affected version: <2.26.1
Reported by:
GitHub -
[MEDIUM] MantisBT may disclose project names to unauthorized users
PKSA-v5jj-zbts-m2nv CVE-2023-44394 GHSA-v642-mh27-8j6m
Affected version: <=2.25.7
Reported by:
GitHub -
[MEDIUM] MantisBT may expose private issues' summaries to unauthorized users
PKSA-dj4p-kydz-sr1n CVE-2023-22476 GHSA-hf4x-6h87-hm79
Affected version: <=2.25.5
Reported by:
GitHub -
[MEDIUM] MantisBT XSS through crafted SVG documents in file_download.php
PKSA-4vhk-bvmc-ws85 CVE-2022-33910 GHSA-qghg-v7xv-q98q
Affected version: <2.25.5
Reported by:
GitHub -
[MEDIUM] MantisBT allows XSS in manage_custom_field_edit_page.php
PKSA-db2k-fbvq-zkwt CVE-2021-33557 GHSA-52cx-vphc-jmjm
Affected version: <=2.25.1
Reported by:
GitHub -
[MEDIUM] MantisBT XSS in manage_custom_field_update.php
PKSA-3369-tnqk-b63p CVE-2020-35571 GHSA-cvrm-cr3m-qj92
Affected version: <=2.24.5
Reported by:
GitHub -
[MEDIUM] MantisBT vulnerable to XSS via unescaped output in browser_search_plugin.php
PKSA-q51k-ffgd-45fg CVE-2022-28508 GHSA-wfg2-2wmw-6894
Affected version: <=2.25.2
Reported by:
GitHub -
[HIGH] MantisBT Insufficient Session Expiration cookie string not reset after logout
PKSA-45gx-2q1r-69kb CVE-2009-20001 GHSA-jm72-67rm-763j
Affected version: <=2.24.4
Reported by:
GitHub -
[HIGH] MantisBT CSV Injection unprivileged user access in csv_export.php
PKSA-666f-jmzg-3cj8 CVE-2021-43257 GHSA-rg8f-5p7x-m6wv
Affected version: <=2.25.2
Reported by:
GitHub -
[MEDIUM] MantisBT vulnerable to XSS due to improper escape in manage_plugin_page.php and manage_plugin_uninstall.php
PKSA-9cw5-6275-ghwx CVE-2022-26144 GHSA-rqgj-rqfr-5j6f
Affected version: <=2.25.2
Reported by:
GitHub