CVE-2005-2557

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Cross-site scripting (XSS) vulnerability in view_all_set.php in Mantis 0.19.0a1 through 1.0.0a3 allows remote attackers to inject arbitrary web script or HTML via the dir parameter, as identified by bug#0005959, and a different vulnerability than CVE-2005-3090.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://marc.info/?l=bugtraq&m=112786017426276&w=2
http://secunia.com/advisories/16506
http://www.debian.org/security/2005/dsa-778Patch, Vendor Advisory
http://www.gentoo.org/security/en/glsa/glsa-200509-16.xmlPatch, Vendor Advisory
http://www.mantisbt.org/changelog.php
http://www.securityfocus.com/bid/14604Exploit, Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/21958
http://marc.info/?l=bugtraq&m=112786017426276&w=2
http://secunia.com/advisories/16506
http://www.debian.org/security/2005/dsa-778Patch, Vendor Advisory
http://www.gentoo.org/security/en/glsa/glsa-200509-16.xmlPatch, Vendor Advisory
http://www.mantisbt.org/changelog.php
http://www.securityfocus.com/bid/14604Exploit, Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/21958

Timeline

Published: Sep 28, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-25584.6Stack-based buffer overflow in the init_syms function in MySQL 4.0 before 4.0.25, 4.1 before 4.1.13, and 5.0 before 5.0.7-beta allows remote CVE-2005-25597.5doping.php in ePing plugin 1.02 and earlier for e107 portal allows remote attackers to execute arbitrary code or overwrite files via (1) she CVE-2005-25604.3Cross-site scripting (XSS) vulnerability in index.cfm in CFBB 1.1.0 allows remote attackers to inject arbitrary web script or HTML via the p CVE-2005-25617.5Multiple SQL injection vulnerabilities in MYFAQ 1.0 allow remote attackers to execute arbitrary SQL commands via the Theme parameter to (1) CVE-2005-25627.5SQL injection vulnerability in Gravity Board X (GBX) 1.1 allows remote attackers to execute arbitrary SQL commands and bypass authentication CVE-2005-25634.3Multiple cross-site scripting (XSS) vulnerabilities in Gravity Board X (GBX) 1.1 allow remote attackers to inject arbitrary web script or HT CVE-2005-25647.5Direct static code injection vulnerability in editcss.php in Gravity Board X (GBX) 1.1 allows remote attackers to execute arbitrary PHP code CVE-2005-25655.0Gravity Board X (GBX) 1.1 allows remote attackers to obtain sensitive information via (1) a 1 in the perm parameter to deletethread.php or a CVE-2005-25667.5Multiple SQL injection vulnerabilities in Open Bulletin Board (OpenBB) allow remote attackers to execute arbitrary SQL commands via the (1) CVE-2005-25677.5PHP remote file inclusion vulnerability in SysCP 1.2.10 and earlier allows remote attackers to execute arbitrary PHP code via the language p CVE-2005-25687.5Eval injection vulnerability in the template engine for SysCP 1.2.10 and earlier allows remote attackers to execute arbitrary PHP code via a CVE-2005-25694.3Multiple cross-site scripting (XSS) vulnerabilities in FunkBoard 0.66CF, and possibly earlier versions, allow remote attackers to inject arb