mantis: multiple cross-site scripting flaws
| Package(s): | mantis | CVE #(s): | CVE-2010-2574 CVE-2010-3303 | ||||||||||||
| Created: | September 30, 2010 | Updated: | November 9, 2012 | ||||||||||||
| Description: | From the Red Hat bugzilla entries [1, 2]: CVE-2010-2574: Cross-site scripting (XSS) vulnerability in manage_proj_cat_add.php in MantisBT 1.2.2 allows remote authenticated administrators to inject arbitrary web script or HTML via the name parameter in an Add Category action. CVE-2010-3303: XSS vulnerability when uninstalling maliciously named plugins; Multiple XSS issues with custom field enumeration values; XSS issues when using custom field String values; XSS in print_all_bug_page_word.php when printing project and category names | ||||||||||||||
| Alerts: |
| ||||||||||||||