Page 2 of 26 results (0.005 seconds)

CVSS: 6.8EPSS: 1%CPEs: 9EXPL: 1

CVE-2006-1577

https://notcve.org/view.php?id=CVE-2006-1577

02 Apr 2006 — Multiple cross-site scripting (XSS) vulnerabilities in view_all_set.php in Mantis 1.0.1, 1.0.0rc5, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) start_day, (2) start_year, and (3) start_month parameters. • http://pridels0.blogspot.com/2006/03/mantis-xss-vuln.html •

CVSS: 9.1EPSS: 1%CPEs: 61EXPL: 1

CVE-2006-0840

https://notcve.org/view.php?id=CVE-2006-0840

22 Feb 2006 — manage_user_page.php in Mantis 1.00rc4 and earlier does not properly handle a sort parameter containing a ' (quote) character, which allows remote attackers to trigger a SQL error that may be repeatedly reported to a user who makes subsequent web accesses with the MANTIS_MANAGE_COOKIE cookie. NOTE: this issue might be the same as vector 2 in CVE-2005-4519. • http://morph3us.org/advisories/20060214-mantis-100rc4.txt •

CVSS: 6.1EPSS: 12%CPEs: 61EXPL: 3

CVE-2006-0841 – Mantis Bug Tracker 0.x/1.0 - 'manage_user_page.php?sort' Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2006-0841

22 Feb 2006 — Multiple cross-site scripting (XSS) vulnerabilities in Mantis 1.00rc4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) hide_status, (2) handler_id, (3) user_monitor, (4) reporter_id, (5) view_type, (6) show_severity, (7) show_category, (8) show_status, (9) show_resolution, (10) show_build, (11) show_profile, (12) show_priority, (13) highlight_changed, (14) relationship_type, and (15) relationship_bug parameters in (a) view_all_set.php; the (16) sort parameter in (b) mana... • https://www.exploit-db.com/exploits/27229 •

CVSS: 6.1EPSS: 0%CPEs: 30EXPL: 0

CVE-2006-0664

https://notcve.org/view.php?id=CVE-2006-0664

13 Feb 2006 — Cross-site scripting (XSS) vulnerability in config_defaults_inc.php in Mantis before 1.0 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. An original vendor bug report is referenced, but not accessible to the general public. • http://secunia.com/advisories/21400 •

CVSS: 10.0EPSS: 0%CPEs: 30EXPL: 0

CVE-2006-0665

https://notcve.org/view.php?id=CVE-2006-0665

13 Feb 2006 — Unspecified vulnerability in (1) query_store.php and (2) manage_proj_create.php in Mantis before 1.0.0 has unknown impact and attack vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. An original vendor bug report is referenced, but not accessible to the general public. • http://secunia.com/advisories/21400 •

CVSS: 9.8EPSS: 8%CPEs: 8EXPL: 6

CVE-2006-0146 – Simplog 0.9.2 - 's' Remote Command Execution

https://notcve.org/view.php?id=CVE-2006-0146

09 Jan 2006 — The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PHPOpenChat, (7) MAXdev MD-Pro, and (8) MediaBeez, when the MySQL root password is empty, allows remote attackers to execute arbitrary SQL commands via the sql parameter. • https://www.exploit-db.com/exploits/1663 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 9.8EPSS: 21%CPEs: 7EXPL: 5

CVE-2006-0147 – Simplog 0.9.2 - 's' Remote Command Execution

https://notcve.org/view.php?id=CVE-2006-0147

09 Jan 2006 — Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PhpOpenChat, possibly (7) MAXdev MD-Pro, and (8) Simplog, allows remote attackers to execute arbitrary PHP functions via the do parameter, which is saved in a variable that is then executed as a function, as demonstrated using phpinfo. • https://www.exploit-db.com/exploits/1663 •

CVSS: 9.8EPSS: 2%CPEs: 65EXPL: 1

CVE-2005-4519

https://notcve.org/view.php?id=CVE-2005-4519

28 Dec 2005 — Multiple SQL injection vulnerabilities in the manage user page (manage_user_page.php) in Mantis 1.0.0rc3 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) prefix and (2) sort parameters to the manage user page (manage_user_page.php), or (3) the sort parameter to view_all_set.php. • http://secunia.com/advisories/18181 •

CVSS: 7.5EPSS: 0%CPEs: 65EXPL: 1

CVE-2005-4523

https://notcve.org/view.php?id=CVE-2005-4523

28 Dec 2005 — Mantis 1.0.0rc3 and earlier discloses private bugs via public RSS feeds, which allows remote attackers to obtain sensitive information. • http://secunia.com/advisories/18181 •

CVSS: 6.1EPSS: 4%CPEs: 65EXPL: 2

CVE-2005-4238 – Mantis Bug Tracker 0.x/1.0 - 'View_filters_page.php' Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2005-4238

14 Dec 2005 — Cross-site scripting (XSS) vulnerability in view_filters_page.php in Mantis 1.0.0rc3 and earlier allows remote attackers to inject arbitrary web script or HTML via the target_field parameter. • https://www.exploit-db.com/exploits/26798 •