GCVE - cpe:2.3:a:mantisbt:mantisbt:1.2.11:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:mantisbt:mantisbt:1.2.11:*:*:*:*:*:*:*

part: a version: 1.2.11 update: *

Vendor	Mantisbt (`9be8c23a-b549-5ad5-a5b6-9beba90daced`)
Product	Mantisbt (`9ac8dfd9-fe15-55d7-90e0-68973c4eb995`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/mantisbt/mantisbt`	purl2cpe	2026-06-01 10:12:58.632411
`pkg:rpm/opensuse/mantisbt`	purl2cpe	2026-06-01 10:12:58.632413

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2015-1042`	vulnerable	2026-06-08 05:06:24.874722	Details available The string_sanitize_url function in core/string_api.php in MantisBT 1.2.0a3 through 1.2.18 uses an incorrect regular expression, which allows remote attackers to conduct open redirect and phishing attacks via a URL with a ":/" (colon slash) separator in the return parameter to login_page.php, a different vulnerability than CVE-2014-6316. Published: 2015-02-10T20:00:00.000Z Updated: 2024-08-06T04:33:20.326Z Open on db.gcve.eu Reference links https://www.mantisbt.org/bugs/view.php?id=17997 http://www.securitytracker.com/id/1031633 http://www.openwall.com/lists/oss-security/2015/01/10/5 http://www.openwall.com/lists/oss-security/2015/01/11/8 http://seclists.org/fulldisclosure/2015/Jan/110	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-9279`	vulnerable	2026-06-08 05:06:11.312596	Details available The print_test_result function in admin/upgrade_unattended.php in MantisBT 1.1.0a3 through 1.2.x before 1.2.18 allows remote attackers to obtain database credentials via a URL in the hostname parameter and reading the parameters in the response sent to the URL. Published: 2014-12-08T16:00:00.000Z Updated: 2024-08-06T13:40:25.094Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/71359 https://github.com/mantisbt/mantisbt/commit/0826cef8 http://www.mantisbt.org/bugs/view.php?id=17877 http://seclists.org/oss-sec/2014/q4/863 https://exchange.xforce.ibmcloud.com/vulnerabilities/99031	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-9272`	vulnerable	2026-06-08 05:06:11.258542	Details available The string_insert_href function in MantisBT 1.2.0a1 through 1.2.x before 1.2.18 does not properly validate the URL protocol, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the javascript:// protocol. Published: 2015-01-09T18:00:00.000Z Updated: 2024-08-06T13:40:24.349Z Open on db.gcve.eu Reference links https://github.com/mantisbt/mantisbt/commit/05378e00 https://www.mantisbt.org/bugs/view.php?id=17297 http://secunia.com/advisories/62101 http://seclists.org/oss-sec/2014/q4/867 http://seclists.org/oss-sec/2014/q4/902	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-9271`	vulnerable	2026-06-08 05:06:11.257296	Details available Cross-site scripting (XSS) vulnerability in file_download.php in MantisBT before 1.2.18 allows remote authenticated users to inject arbitrary web script or HTML via a Flash file with an image extension, related to inline attachments, as demonstrated by a .swf.jpeg filename. Published: 2015-01-09T18:00:00.000Z Updated: 2024-08-06T13:40:25.100Z Open on db.gcve.eu Reference links http://secunia.com/advisories/62101 http://seclists.org/oss-sec/2014/q4/867 https://www.mantisbt.org/bugs/view.php?id=17874 http://seclists.org/oss-sec/2014/q4/902 http://seclists.org/oss-sec/2014/q4/924	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-9270`	vulnerable	2026-06-08 05:06:11.256027	Details available Cross-site scripting (XSS) vulnerability in the projax_array_serialize_for_autocomplete function in core/projax_api.php in MantisBT 1.1.0a3 through 1.2.17 allows remote attackers to inject arbitrary web script or HTML via the "profile/Platform" field. Published: 2014-12-08T16:00:00.000Z Updated: 2024-08-06T13:40:24.819Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/71372 https://exchange.xforce.ibmcloud.com/vulnerabilities/99037 https://www.mantisbt.org/bugs/view.php?id=17583 http://secunia.com/advisories/62101 http://seclists.org/oss-sec/2014/q4/867	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-9269`	vulnerable	2026-06-08 05:06:11.254532	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-8554`	vulnerable	2026-06-08 05:06:09.319465	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-6387`	vulnerable	2026-06-08 05:05:57.610847	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-1609`	vulnerable	2026-06-08 05:05:25.696861	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-1608`	vulnerable	2026-06-08 05:05:25.694818	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-4460`	vulnerable	2026-06-08 05:04:46.939336	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.