CVSS: 5.0EPSS: 6%CPEs: 18EXPL: 0CVE-2006-5454
https://notcve.org/view.php?id=CVE-2006-5454
Bugzilla 2.18.x before 2.18.6, 2.20.x before 2.20.3, 2.22.x before 2.22.1, and 2.23.x before 2.23.3 allow remote attackers to obtain (1) the description of arbitrary attachments by viewing the attachment in "diff" mode in attachment.cgi, and (2) the deadline field by viewing the XML format of the bug in show_bug.cgi. Bugzilla 2.18.x anteriores a 2.18.6, 2.20.x anteriores a 2.20.3, 2.22.x anterioers a 2.22.1, y 2.23.x anteriores a 2.23.3 permiten a atacantes remotos obtener (1) la descripción de adjuntos de su elección viendo el adjunto en modo "diff" en attachment.cgi, y (2) el campo fecha límite (deadline) viendo el formato XML del "bug" en show_bug.cgi. • http://secunia.com/advisories/22409 http://secunia.com/advisories/22790 http://security.gentoo.org/glsa/glsa-200611-04.xml http://securityreason.com/securityalert/1760 http://securitytracker.com/id?1017064 http://www.bugzilla.org/security/2.18.5 http://www.osvdb.org/29546 http://www.osvdb.org/29547 http://www.securityfocus.com/archive/1/448777/100/100/threaded http://www.securityfocus.com/bid/20538 http://www.vupen.com/english/advisories/2006/4035 https://bugzill •
CVSS: 2.6EPSS: 4%CPEs: 4EXPL: 0CVE-2006-5455
https://notcve.org/view.php?id=CVE-2006-5455
Cross-site request forgery (CSRF) vulnerability in editversions.cgi in Bugzilla before 2.22.1 and 2.23.x before 2.23.3 allows user-assisted remote attackers to create, modify, or delete arbitrary bug reports via a crafted URL. Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en editversions.cgi en Bugzilla anterior a 2.22.1 y 2.23.x anteriores a 2.23.3 permite a atacantes remotos con intervención del usuario crear, modificar o borrar informes de "bugs" de su elección mediante una URL creada artesanalmente. • http://secunia.com/advisories/22409 http://secunia.com/advisories/22790 http://security.gentoo.org/glsa/glsa-200611-04.xml http://securityreason.com/securityalert/1760 http://www.bugzilla.org/security/2.18.5 http://www.osvdb.org/29548 http://www.securityfocus.com/archive/1/448777/100/100/threaded http://www.securityfocus.com/bid/20538 http://www.vupen.com/english/advisories/2006/4035 https://bugzilla.mozilla.org/show_bug.cgi?id=281181 https://exchange.xforce.ibmcloud •
CVSS: 3.5EPSS: 0%CPEs: 18EXPL: 0CVE-2006-5453
https://notcve.org/view.php?id=CVE-2006-5453
Multiple cross-site scripting (XSS) vulnerabilities in Bugzilla 2.18.x before 2.18.6, 2.20.x before 2.20.3, 2.22.x before 2.22.1, and 2.23.x before 2.23.3 allow remote authenticated users to inject arbitrary web script or HTML via (1) page headers using the H1, H2, and H3 HTML tags in global/header.html.tmpl, (2) description fields of certain items in various edit cgi scripts, and (3) the id parameter in showdependencygraph.cgi. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en Bug<illa 2.18.x anteriores a 2.18.6, 2.20.x anteriores a 2.20.3, 2.22.x anteriores a 2.22.1, y 2.23.x anteriores a 2.23.3 permiten a usuarios autenticados remotamente inyectar secuencias de comandos web o HTML de su elección mediante (1) cabeceras de página usando las etiquetas HTML H1, H2, H3 en global/header.html.tmpl, (2) campos de descripción de determinados objetos en varias secuencias de comandos cgi de edición, y (3) el parámetro id en showdependencygraph.cgi. • http://secunia.com/advisories/22409 http://secunia.com/advisories/22790 http://secunia.com/advisories/22826 http://security.gentoo.org/glsa/glsa-200611-04.xml http://securityreason.com/securityalert/1760 http://securitytracker.com/id?1017063 http://www.bugzilla.org/security/2.18.5 http://www.debian.org/security/2006/dsa-1208 http://www.osvdb.org/29544 http://www.osvdb.org/29545 http://www.osvdb.org/29549 http://www.securityfocus.com/archive/1/448777/100/100&#x •