Page 2 of 30 results (0.004 seconds)

CVSS: 6.8EPSS: 1%CPEs: 9EXPL: 1

CVE-2006-1577

https://notcve.org/view.php?id=CVE-2006-1577

02 Apr 2006 — Multiple cross-site scripting (XSS) vulnerabilities in view_all_set.php in Mantis 1.0.1, 1.0.0rc5, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) start_day, (2) start_year, and (3) start_month parameters. • http://pridels0.blogspot.com/2006/03/mantis-xss-vuln.html •

CVSS: 9.1EPSS: 1%CPEs: 61EXPL: 1

CVE-2006-0840

https://notcve.org/view.php?id=CVE-2006-0840

22 Feb 2006 — manage_user_page.php in Mantis 1.00rc4 and earlier does not properly handle a sort parameter containing a ' (quote) character, which allows remote attackers to trigger a SQL error that may be repeatedly reported to a user who makes subsequent web accesses with the MANTIS_MANAGE_COOKIE cookie. NOTE: this issue might be the same as vector 2 in CVE-2005-4519. • http://morph3us.org/advisories/20060214-mantis-100rc4.txt •

CVSS: 6.1EPSS: 12%CPEs: 61EXPL: 3

CVE-2006-0841 – Mantis Bug Tracker 0.x/1.0 - 'manage_user_page.php?sort' Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2006-0841

22 Feb 2006 — Multiple cross-site scripting (XSS) vulnerabilities in Mantis 1.00rc4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) hide_status, (2) handler_id, (3) user_monitor, (4) reporter_id, (5) view_type, (6) show_severity, (7) show_category, (8) show_status, (9) show_resolution, (10) show_build, (11) show_profile, (12) show_priority, (13) highlight_changed, (14) relationship_type, and (15) relationship_bug parameters in (a) view_all_set.php; the (16) sort parameter in (b) mana... • https://www.exploit-db.com/exploits/27229 •

CVSS: 6.1EPSS: 0%CPEs: 30EXPL: 0

CVE-2006-0664

https://notcve.org/view.php?id=CVE-2006-0664

13 Feb 2006 — Cross-site scripting (XSS) vulnerability in config_defaults_inc.php in Mantis before 1.0 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. An original vendor bug report is referenced, but not accessible to the general public. • http://secunia.com/advisories/21400 •

CVSS: 10.0EPSS: 0%CPEs: 30EXPL: 0

CVE-2006-0665

https://notcve.org/view.php?id=CVE-2006-0665

13 Feb 2006 — Unspecified vulnerability in (1) query_store.php and (2) manage_proj_create.php in Mantis before 1.0.0 has unknown impact and attack vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. An original vendor bug report is referenced, but not accessible to the general public. • http://secunia.com/advisories/21400 •

CVSS: 9.8EPSS: 8%CPEs: 8EXPL: 6

CVE-2006-0146 – Simplog 0.9.2 - 's' Remote Command Execution

https://notcve.org/view.php?id=CVE-2006-0146

09 Jan 2006 — The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PHPOpenChat, (7) MAXdev MD-Pro, and (8) MediaBeez, when the MySQL root password is empty, allows remote attackers to execute arbitrary SQL commands via the sql parameter. • https://www.exploit-db.com/exploits/1663 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 9.8EPSS: 21%CPEs: 7EXPL: 5

CVE-2006-0147 – Simplog 0.9.2 - 's' Remote Command Execution

https://notcve.org/view.php?id=CVE-2006-0147

09 Jan 2006 — Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PhpOpenChat, possibly (7) MAXdev MD-Pro, and (8) Simplog, allows remote attackers to execute arbitrary PHP functions via the do parameter, which is saved in a variable that is then executed as a function, as demonstrated using phpinfo. • https://www.exploit-db.com/exploits/1663 •

CVSS: 9.8EPSS: 2%CPEs: 65EXPL: 1

CVE-2005-4519

https://notcve.org/view.php?id=CVE-2005-4519

28 Dec 2005 — Multiple SQL injection vulnerabilities in the manage user page (manage_user_page.php) in Mantis 1.0.0rc3 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) prefix and (2) sort parameters to the manage user page (manage_user_page.php), or (3) the sort parameter to view_all_set.php. • http://secunia.com/advisories/18181 •

CVSS: 9.8EPSS: 1%CPEs: 6EXPL: 1

CVE-2005-4520

https://notcve.org/view.php?id=CVE-2005-4520

28 Dec 2005 — Unspecified "port injection" vulnerabilities in filters in Mantis 1.0.0rc3 and earlier have unknown impact and attack vectors. NOTE: due to a lack of relevant details in the vendor changelog, which is the source of this description, it is unclear whether this is a duplicate of another CVE. • http://secunia.com/advisories/18181 •

CVSS: 5.3EPSS: 1%CPEs: 6EXPL: 1

CVE-2005-4521

https://notcve.org/view.php?id=CVE-2005-4521

28 Dec 2005 — CRLF injection vulnerability in Mantis 1.0.0rc3 and earlier allows remote attackers to modify HTTP headers and conduct HTTP response splitting attacks via (1) the return parameter in login_cookie_test.php and (2) ref parameter in login_select_proj_page.php. • http://secunia.com/advisories/18181 •