[4] Cross Site Scripting

Possible damage: Medium
Probability of occurrence: Low
Resulting threat: Low

HTTP method: GET

Vulnerability description:

The "view_type" parameter is prone to cross-site scripting attacks. 
This could permit remote attackers to create a malicious link to a 
vulnerable PHP script that includes hostile client-side script code 
or HTML. If this link is visited, the attacker-supplied code may be 
rendered in the browser of the user who visit the malicious link.

Proof of Concept:

[path_to_mantis]/view_filters_page.php?target_field=reporter_id[]&
view_type="><script>alert(document.cookie)</script>

[5] Cross Site Scripting

Possible damage: Medium
Probability of occurrence: Low
Resulting threat: Low

HTTP method: GET

Vulnerability description:

The "target_field" parameter is prone to cross-site scripting

attacks.
This could permit remote attackers to create a malicious link to a
vulnerable PHP script that includes hostile client-side script code
or HTML. If this link is visited, the attacker-supplied code may be
rendered in the browser of the user who visit the malicious link.

Proof of Concept:

[path_to_mantis]/view_filters_page.php?target_field=
"><script>alert(document.cookie)</script>