Unspecified vulnerability in (1) querystore.php and (2) manageprojcreate.php in Mantis before 1.0.0 has unknown impact and attack vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. An original vendor bug report is referenced, but not accessible to the general public.

Mantis before 1.1.0a2 sets the default value of $gbugreminderthreshold to "reporter" instead of a more privileged role, which has unknown impact and attack vectors, possibly related to frequency of reminders.

Multiple SQL injection vulnerabilities in Mantis 0.17.2 and earlier, when running without magicquotesgpc enabled, allows remote attackers to gain privileges or perform unauthorized database operations via modified form fields, e.g. to accountupdate.php.

manageprojpage.php in Mantis before 1.1.4 allows remote authenticated users to execute arbitrary code via a sort parameter containing PHP sequences, which are processed by createfunction within the multisort function in core/utilityapi.php.

SQL injection vulnerability in Mantis 1.0.0RC2 and 0.19.2 allows remote attackers to execute arbitrary SQL commands via unknown vectors.

PHP file inclusion vulnerability in bugsponsorshiplistviewinc.php in Mantis 1.0.0RC2 and 0.19.2 allows remote attackers to execute arbitrary PHP code and include arbitrary local files via the tcorepath parameter.

Multiple SQL injection vulnerabilities in the manage user page (manageuserpage.php) in Mantis 1.0.0rc3 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) prefix and (2) sort parameters to the manage user page (manageuserpage.php), or (3) the sort parameter to viewallset.php.

core/databaseapi.php in Mantis 0.19.0a1 through 1.0.0a3, with registerglobals enabled, allows remote attackers to connect to internal databases by modifying the gdbtype variable and monitoring the speed of responses, as identified by bug#0005956.

Mantis before 0.19.4 allows remote attackers to bypass the file upload size restriction by modifying the maxfilesize parameter to (1) bugfileadd.php, (2) bugreport.php, (3) bugreportadvancedpage.php, and (4) projdocaddpage.php.

The server.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PHPOpenChat, (7) MAXdev MD-Pro, and (8) MediaBeez, when the MySQL root password is empty, allows remote attackers to execute arbitrary SQL commands via the sql parameter.

Dynamic code evaluation vulnerability in tests/tmssql.php test script in ADOdb for PHP before 4.70, as used in multiple products including (1) Mantis, (2) PostNuke, (3) Moodle, (4) Cacti, (5) Xaraya, (6) PhpOpenChat, possibly (7) MAXdev MD-Pro, and (8) Simplog, allows remote attackers to execute arbitrary PHP functions via the do parameter, which is saved in a variable that is then executed as a function, as demonstrated using phpinfo.

PHP remote file inclusion vulnerability in Mantis 0.19.0a allows remote attackers to execute arbitrary PHP code by modifying the (1) tcorepath parameter to bugapi.php or (2) tcoredir parameter to relationshipapi.php to reference a URL on a remote web server that contains the code.

configinc2.php in Mantis before 0.17.4 allows remote attackers to execute arbitrary code or read arbitrary files via the parameters (1) gbottomincludepage, (2) gtopincludepage, (3) gcssincludefile, (4) gmetaincludefile, or (5) a cookie.

summarygraphfunctions.php in Mantis 0.17.3 and earlier allows remote attackers to execute arbitrary PHP code by modifying the gjpgraphpath parameter to reference the location of the PHP code.

The "View Bugs" page (viewallbugpage.php) in Mantis 0.17.4a and earlier includes summaries of private bugs for users that do not have access to any projects.

Directory traversal vulnerability in core/langapi.php in Mantis before 1.1.2 allows remote attackers to include and execute arbitrary files via the language parameter to the user preferences page (accountprefsupdate.php).

Mantis before 1.1.3 does not unset the session cookie during logout, which makes it easier for remote attackers to hijack sessions.

Mantis before 0.19.3 caches the User ID longer than necessary, which has unknown impact and attack vectors.

Multiple cross-site scripting (XSS) vulnerabilities in viewallset.php in Mantis 1.0.1, 1.0.0rc5, and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) startday, (2) startyear, and (3) startmonth parameters.

Eval injection vulnerability in admconfigset.php in Mantis before 1.1.2 allows remote authenticated administrators to execute arbitrary code via the value parameter.

Unspecified vulnerability in Mantis before 0.19.3, when using reminders, causes Mantis to display the real email addresses of users.

Unspecified "port injection" vulnerabilities in filters in Mantis 1.0.0rc3 and earlier have unknown impact and attack vectors. NOTE: due to a lack of relevant details in the vendor changelog, which is the source of this description, it is unclear whether this is a duplicate of another CVE.

CRLF injection vulnerability in Mantis 1.0.0rc3 and earlier allows remote attackers to modify HTTP headers and conduct HTTP response splitting attacks via (1) the return parameter in logincookietest.php and (2) ref parameter in loginselectprojpage.php.

Mantis 1.0.0rc3 does not properly handle "Make note private" when a bug is being resolved, which has unknown impact and attack vectors, probably related to an information leak.

Mantis 1.0.0rc3 and earlier discloses private bugs via public RSS feeds, which allows remote attackers to obtain sensitive information.

signuppage.php in Mantis bugtracker allows remote attackers to send e-mail bombs by creating multiple users and providing the same e-mail address.

Mantis before 20041016 provides a complete Issue History (Bug History) in the web interface regardless of viewhistorythreshold, which allows remote attackers to obtain sensitive information (private bug details) by visiting a bug's web page.

manageuserpage.php in Mantis 1.00rc4 and earlier does not properly handle a sort parameter containing a ' (quote) character, which allows remote attackers to trigger a SQL error that may be repeatedly reported to a user who makes subsequent web accesses with the MANTISMANAGECOOKIE cookie. NOTE: this issue might be the same as vector 2 in CVE-2005-4519.

Mantis 0.17.4a and earlier allows remote attackers to view private bugs by modifying the fid bug ID parameter to (1) bugupdateadvancedpage.php, (2) bugupdatepage.php, (3) viewbugadvancedpage.php, or (4) viewbugpage.php.

Mantis before 0.17.4 allows remote attackers to list project bugs without authentication by modifying the cookie that is used by the "View Bugs" page.