Some vulnerabilities have been reported in Mantis, which can be exploited by malicious people to conduct cross-site scripting attacks.

Input passed to various parameters in view_all_set.php, to the "sort" parameter in manage_user_page.php, to the "view_type" parameter in view_filters_page.php, and to the "title" parameter in proj_doc_delete.php isn't properly sanitised before being returned to users. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.

Note: An SQL injection error in the "sort" parameter of manage_user_page.php, that is reportedly not exploitable, has also been fixed.

Solution
Update to version 1.0.0.
Further details available to Secunia VIM customers

Provided and/or discovered by
Thomas Waldegger

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://bugs.mantisbt.org/view.php?id=6509
http://bugs.mantisbt.org/view.php?id=6557
http://bugs.mantisbt.org/view.php?id=6563
http://bugs.mantisbt.org/view.php?id=6569
http://morph3us.org/advisories/20060214-mantis-100rc4.txt

Deep Links
Links available to Secunia VIM customers