Executive Summary

Informations
Name CVE-2006-0841 First vendor Publication 2006-02-21
Vendor Cve Last vendor Modification 2018-10-18

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Cvss Base Score 4.3 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Multiple cross-site scripting (XSS) vulnerabilities in Mantis 1.00rc4 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) hide_status, (2) handler_id, (3) user_monitor, (4) reporter_id, (5) view_type, (6) show_severity, (7) show_category, (8) show_status, (9) show_resolution, (10) show_build, (11) show_profile, (12) show_priority, (13) highlight_changed, (14) relationship_type, and (15) relationship_bug parameters in (a) view_all_set.php; the (16) sort parameter in (b) manage_user_page.php; the (17) view_type parameter in (c) view_filters_page.php; and the (18) title parameter in (d) proj_doc_delete.php. NOTE: item 17 might be subsumed by CVE-2005-4522.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0841

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 61

OpenVAS Exploits

Date Description
2008-01-17 Name : Debian Security Advisory DSA 1133-1 (mantis)
File : nvt/deb_1133_1.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
23248 Mantis view_all_set.php Multiple Parameter XSS

Mantis contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate the 'hide_status', 'handler_id', 'user_monitor', 'reporter_id', 'view_type', 'show_severity', 'show_category', 'show_status', 'show_resolution', 'show_build', 'show_profile', 'show_priority', 'highlight_changed', 'relationship_type', and 'relationship_bug' variables upon submission to the 'view_all_set.php' script. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.
22487 Mantis manage_user_page.php sort Parameter XSS

Mantis contains a flaw that allows a remote cross site scripting attack. This flaw exists because the application does not validate variables upon submission to the manage_users functionality. This could allow a user to create a specially crafted URL that would execute arbitrary code in a user's browser within the trust relationship between the browser and the server, leading to a loss of integrity.

Nessus® Vulnerability Scanner

Date Description
2006-10-14 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-1133.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source Url
BID http://www.securityfocus.com/bid/16657
BUGTRAQ http://www.securityfocus.com/archive/1/425046/100/0/threaded
DEBIAN http://www.debian.org/security/2006/dsa-1133
MISC http://morph3us.org/advisories/20060214-mantis-100rc4.txt
http://sourceforge.net/project/showfiles.php?group_id=14963&package_id=12...
http://sourceforge.net/project/shownotes.php?release_id=386059&group_id=1...
OSVDB http://www.osvdb.org/22487
http://www.osvdb.org/23248
SECUNIA http://secunia.com/advisories/21400

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
Date Informations
2021-05-04 12:03:44
  • Multiple Updates
2021-04-22 01:04:16
  • Multiple Updates
2020-05-23 00:17:27
  • Multiple Updates
2018-10-18 21:19:59
  • Multiple Updates
2016-06-28 15:37:54
  • Multiple Updates
2016-04-26 14:19:52
  • Multiple Updates
2014-02-17 10:34:46
  • Multiple Updates
2013-05-11 10:50:07
  • Multiple Updates