CVE-2010-3303

Multiple cross-site scripting (XSS) vulnerabilities in MantisBT before
1.2.3 allow remote authenticated administrators to inject arbitrary web
script or HTML via (1) a plugin name, related to
manage_plugin_uninstall.php; (2) an enumeration value or (3) a String value
of a custom field, related to core/cfdefs/cfdef_standard.php; or a (4)
project or (5) category name to print_all_bug_page_word.php.

Bugs

• <http://www.mantisbt.org/bugs/view.php?id=12238&gt;
• <http://www.mantisbt.org/bugs/view.php?id=12234&gt;
• <http://www.mantisbt.org/bugs/view.php?id=12232&gt;
• <http://www.mantisbt.org/bugs/view.php?id=12231&gt;