CVE-2017-12062

An XSS issue was discovered in manageuserpage.php in MantisBT 2.x before 2.5.2. The 'filter' field is not sanitized before being rendered in the Manage User page, allowing remote attackers to execute arbitrary JavaScript code if CSP is disabled...

CVE-2017-12062: Improper Neutralization of Input During Web Page Generation

An XSS issue was discovered in manageuserpage.php in MantisBT 2.x before 2.5.2. The 'filter' field is not sanitized before being rendered in the Manage User page, allowing remote attackers to execute arbitrary JavaScript code if CSP is disabled...

CVE-2014-9573: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in manageuserpage.php in MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 allows remote administrators with FILE privileges to execute arbitrary SQL commands via the MANTISMANAGEUSERSCOOKIE cookie...

Debian DSA-1133-1 : mantis - missing input sanitising

Several remote vulnerabilities have been discovered in the Mantis bug tracking system, which may lead to the execution of arbitrary web script. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2006-0664 A cross-site scripting vulnerability was discovered ...

CVE-2006-0841: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in Mantis 1.00rc4 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 hidestatus, 2 handlerid, 3 usermonitor, 4 reporterid, 5 viewtype, 6 showseverity, 7 showcategory, 8 showstatus, 9 showresolution, 10 showbuild, 1...

CVE-2006-0840: Undefined Security Weakness

manageuserpage.php in Mantis 1.00rc4 and earlier does not properly handle a sort parameter containing a ' quote character, which allows remote attackers to trigger a SQL error that may be repeatedly reported to a user who makes subsequent web accesses with the MANTISMANAGECOOKIE cookie. NOTE: thi...

CVE-2005-4519: Undefined Security Weakness

Multiple SQL injection vulnerabilities in the manage user page manageuserpage.php in Mantis 1.0.0rc3 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 prefix and 2 sort parameters to the manage user page manageuserpage.php, or 3 the sort parameter to viewallset.php...