Show filters
164 Total Results
Displaying 151-160 of 164
Sort by:
Attacker Value
Unknown
CVE-2005-2557
Disclosure Date: September 28, 2005 (last updated February 22, 2025)
Cross-site scripting (XSS) vulnerability in view_all_set.php in Mantis 0.19.0a1 through 1.0.0a3 allows remote attackers to inject arbitrary web script or HTML via the dir parameter, as identified by bug#0005959, and a different vulnerability than CVE-2005-3090.
0
Attacker Value
Unknown
CVE-2005-2556
Disclosure Date: August 24, 2005 (last updated February 22, 2025)
core/database_api.php in Mantis 0.19.0a1 through 1.0.0a3, with register_globals enabled, allows remote attackers to connect to internal databases by modifying the g_db_type variable and monitoring the speed of responses, as identified by bug#0005956.
0
Attacker Value
Unknown
CVE-2004-1730
Disclosure Date: December 31, 2004 (last updated February 22, 2025)
Cross-site scripting (XSS) vulnerability in Mantis bugtracker allows remote attackers to inject arbitrary web script or HTML via (1) the return parameter to login_page.php, (2) e-mail field in signup.php, (3) action parameter to login_select_proj_page.php, or (4) hide_status parameter to view_all_set.php.
0
Attacker Value
Unknown
CVE-2004-1734
Disclosure Date: December 31, 2004 (last updated February 22, 2025)
PHP remote file inclusion vulnerability in Mantis 0.19.0a allows remote attackers to execute arbitrary PHP code by modifying the (1) t_core_path parameter to bug_api.php or (2) t_core_dir parameter to relationship_api.php to reference a URL on a remote web server that contains the code.
0
Attacker Value
Unknown
CVE-2004-2666
Disclosure Date: December 31, 2004 (last updated February 22, 2025)
Mantis before 20041016 provides a complete Issue History (Bug History) in the web interface regardless of view_history_threshold, which allows remote attackers to obtain sensitive information (private bug details) by visiting a bug's web page.
0
Attacker Value
Unknown
CVE-2004-1731
Disclosure Date: August 20, 2004 (last updated February 22, 2025)
signup_page.php in Mantis bugtracker allows remote attackers to send e-mail bombs by creating multiple users and providing the same e-mail address.
0
Attacker Value
Unknown
CVE-2003-0499
Disclosure Date: August 07, 2003 (last updated February 22, 2025)
Mantis 0.17.5 and earlier stores its database password in cleartext in a world-readable configuration file, which allows local users to perform unauthorized database operations.
0
Attacker Value
Unknown
CVE-2002-1112
Disclosure Date: October 04, 2002 (last updated February 22, 2025)
Mantis before 0.17.4 allows remote attackers to list project bugs without authentication by modifying the cookie that is used by the "View Bugs" page.
0
Attacker Value
Unknown
CVE-2002-1110
Disclosure Date: October 04, 2002 (last updated February 22, 2025)
Multiple SQL injection vulnerabilities in Mantis 0.17.2 and earlier, when running without magic_quotes_gpc enabled, allows remote attackers to gain privileges or perform unauthorized database operations via modified form fields, e.g. to account_update.php.
0
Attacker Value
Unknown
CVE-2002-1113
Disclosure Date: October 04, 2002 (last updated February 22, 2025)
summary_graph_functions.php in Mantis 0.17.3 and earlier allows remote attackers to execute arbitrary PHP code by modifying the g_jpgraph_path parameter to reference the location of the PHP code.
0
