CVSS: 4.3EPSS: 0%CPEs: 11EXPL: 0CVE-2007-0791
https://notcve.org/view.php?id=CVE-2007-0791
Cross-site scripting (XSS) vulnerability in Atom feeds in Bugzilla 2.20.3, 2.22.1, and 2.23.3, and earlier versions down to 2.20.1, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en feeds de Atom en Bugzilla 2.20.3, 2.22.1, y 2.23.3, y versiones anteriores a 2.20.1, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección mediante vectores no especificados. • http://osvdb.org/33090 http://secunia.com/advisories/24031 http://securityreason.com/securityalert/2222 http://securitytracker.com/id?1017585 http://www.bugzilla.org/security/2.20.3 http://www.securityfocus.com/archive/1/459025/100/0/threaded http://www.securityfocus.com/bid/22380 http://www.vupen.com/english/advisories/2007/0477 https://exchange.xforce.ibmcloud.com/vulnerabilities/32248 •
CVSS: 7.5EPSS: 10%CPEs: 1EXPL: 0CVE-2007-0792
https://notcve.org/view.php?id=CVE-2007-0792
The mod_perl initialization script in Bugzilla 2.23.3 does not set the Bugzilla Apache configuration to allow .htaccess permissions to override file permissions, which allows remote attackers to obtain the database username and password via a direct request for the localconfig file. La secuencia de comandos de inicialización de mod_perl en Bugzilla 2.23.3 no establece la configuración de Bugzilla Apache para permitir sobrescribir los permisos del fichero .htaccess, lo cual permite a atacantes remotos obtener el nombre de usuario y la contraseña mediante una petición directa al fichero localconfig. • http://osvdb.org/35862 http://securityreason.com/securityalert/2222 http://securitytracker.com/id?1017585 http://www.bugzilla.org/security/2.20.3 http://www.securityfocus.com/archive/1/459025/100/0/threaded http://www.securityfocus.com/bid/22380 http://www.vupen.com/english/advisories/2007/0477 https://exchange.xforce.ibmcloud.com/vulnerabilities/32252 •