Mantis 0.17.5 and earlier stores its database password in cleartext in a world-readable configuration file, which allows local users to perform unauthorized database operations.
Mantis before 1.1.0a2 sets the default value of $gbugreminderthreshold to "reporter" instead of a more privileged role, which has unknown impact and attack vectors, possibly related to frequency of reminders.
Mantis before 1.1.0a2 does not implement per-item access control for Issue History (Bug History), which allows remote attackers to obtain sensitive information by reading the Change column, as demonstrated by the Change column of a custom field.
Mantis 0.17.4a and earlier allows remote attackers to view private bugs by modifying the fid bug ID parameter to (1) bugupdateadvancedpage.php, (2) bugupdatepage.php, (3) viewbugadvancedpage.php, or (4) viewbugpage.php.
configinc2.php in Mantis before 0.17.4 allows remote attackers to execute arbitrary code or read arbitrary files via the parameters (1) gbottomincludepage, (2) gtopincludepage, (3) gcssincludefile, (4) gmetaincludefile, or (5) a cookie.
Mantis before 0.17.4 allows remote attackers to list project bugs without authentication by modifying the cookie that is used by the "View Bugs" page.
printallbugpage.php in Mantis 0.17.3 and earlier does not verify the limitreporters option, which allows remote attackers to view bug summaries for bugs that would otherwise be restricted.
Multiple SQL injection vulnerabilities in Mantis 0.17.2 and earlier, when running without magicquotesgpc enabled, allows remote attackers to gain privileges or perform unauthorized database operations via modified form fields, e.g. to accountupdate.php.
summarygraphfunctions.php in Mantis 0.17.3 and earlier allows remote attackers to execute arbitrary PHP code by modifying the gjpgraphpath parameter to reference the location of the PHP code.
The "View Bugs" page (viewallbugpage.php) in Mantis 0.17.4a and earlier includes summaries of private bugs for users that do not have access to any projects.
Mantis before 20041016 provides a complete Issue History (Bug History) in the web interface regardless of viewhistorythreshold, which allows remote attackers to obtain sensitive information (private bug details) by visiting a bug's web page.
PHP remote file inclusion vulnerability in Mantis 0.19.0a allows remote attackers to execute arbitrary PHP code by modifying the (1) tcorepath parameter to bugapi.php or (2) tcoredir parameter to relationshipapi.php to reference a URL on a remote web server that contains the code.
signuppage.php in Mantis bugtracker allows remote attackers to send e-mail bombs by creating multiple users and providing the same e-mail address.
Cross-site scripting (XSS) vulnerability in Mantis bugtracker allows remote attackers to inject arbitrary web script or HTML via (1) the return parameter to loginpage.php, (2) e-mail field in signup.php, (3) action parameter to loginselectprojpage.php, or (4) hidestatus parameter to viewallset.php.
Unspecified "port injection" vulnerabilities in filters in Mantis 1.0.0rc3 and earlier have unknown impact and attack vectors. NOTE: due to a lack of relevant details in the vendor changelog, which is the source of this description, it is unclear whether this is a duplicate of another CVE.
CRLF injection vulnerability in Mantis 1.0.0rc3 and earlier allows remote attackers to modify HTTP headers and conduct HTTP response splitting attacks via (1) the return parameter in logincookietest.php and (2) ref parameter in loginselectprojpage.php.
Multiple SQL injection vulnerabilities in the manage user page (manageuserpage.php) in Mantis 1.0.0rc3 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) prefix and (2) sort parameters to the manage user page (manageuserpage.php), or (3) the sort parameter to viewallset.php.
Mantis 1.0.0rc3 does not properly handle "Make note private" when a bug is being resolved, which has unknown impact and attack vectors, probably related to an information leak.
Mantis 1.0.0rc3 and earlier discloses private bugs via public RSS feeds, which allows remote attackers to obtain sensitive information.
Mantis before 0.19.4 allows remote attackers to bypass the file upload size restriction by modifying the maxfilesize parameter to (1) bugfileadd.php, (2) bugreport.php, (3) bugreportadvancedpage.php, and (4) projdocaddpage.php.
Multiple cross-site scripting (XSS) vulnerabilities in the viewfilterspage.php filters script in Mantis 1.0.0rc3 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) viewtype and (2) targetfield parameters.
Cross-site scripting (XSS) vulnerability in viewfilterspage.php in Mantis 1.0.0rc3 and earlier allows remote attackers to inject arbitrary web script or HTML via the targetfield parameter.
Mantis before 0.19.3 caches the User ID longer than necessary, which has unknown impact and attack vectors.
Multiple cross-site scripting (XSS) vulnerabilities in Mantis before 0.19.3 allow remote attackers to inject arbitrary web script or HTML via (1) unknown vectors involving Javascript and (2) mantis/viewallset.php.
SQL injection vulnerability in Mantis 1.0.0RC2 and 0.19.2 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
Unspecified vulnerability in Mantis before 0.19.3, when using reminders, causes Mantis to display the real email addresses of users.
PHP file inclusion vulnerability in bugsponsorshiplistviewinc.php in Mantis 1.0.0RC2 and 0.19.2 allows remote attackers to execute arbitrary PHP code and include arbitrary local files via the tcorepath parameter.
Cross-site scripting (XSS) vulnerability in Mantis before 1.0.0rc1 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors, as identified by bug#0005751 "thraxisp".
Cross-site scripting (XSS) vulnerability in bugactiongrouppage.php in Mantis 0.19.0a1 through 1.0.0a3 allows remote attackers to inject arbitrary web script or HTML via the summary of the bug, which is not quoted when viewallbugpage.php is used to delete the bug, as identified by bug#0006002, a different vulnerability than CVE-2005-2557.
Cross-site scripting (XSS) vulnerability in viewallset.php in Mantis 0.19.0a1 through 1.0.0a3 allows remote attackers to inject arbitrary web script or HTML via the dir parameter, as identified by bug#0005959, and a different vulnerability than CVE-2005-3090.