CVSS: 9.1EPSS: 0%CPEs: 163EXPL: 1CVE-2012-0448
https://notcve.org/view.php?id=CVE-2012-0448
02 Feb 2012 — Bugzilla 2.x and 3.x before 3.4.14, 3.5.x and 3.6.x before 3.6.8, 3.7.x and 4.0.x before 4.0.4, and 4.1.x and 4.2.x before 4.2rc2 does not reject non-ASCII characters in e-mail addresses of new user accounts, which makes it easier for remote authenticated users to spoof other user accounts by choosing a similar e-mail address. Bugzilla v2.x y v3.x antes de v3.4.14, v3.5.x y v3.6.x antes de v3.6.8, v3.7.x y v4.0.x antes de v4.0.4 y v4.1.x y v4.2.x antes v4.2rc2 no rechazan los caracteres no ASCII en las dire... • http://secunia.com/advisories/47814 • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 160EXPL: 0CVE-2011-3667
https://notcve.org/view.php?id=CVE-2011-3667
02 Jan 2012 — The User.offer_account_by_email WebService method in Bugzilla 2.x and 3.x before 3.4.13, 3.5.x and 3.6.x before 3.6.7, 3.7.x and 4.0.x before 4.0.3, and 4.1.x through 4.1.3, when createemailregexp is not empty, does not properly handle user_can_create_account settings, which allows remote attackers to create user accounts by leveraging a token contained in an e-mail message. El método WebService User.offer_account_by_email en Bugzilla v2.x y v3.x antes de v3.4.13, en v3.5.x y v3.6.x antes de v3.6.7, en v3.7... • http://archives.neohapsis.com/archives/bugtraq/2011-12/0184.html • CWE-287: Improper Authentication •
CVSS: 8.8EPSS: 0%CPEs: 161EXPL: 1CVE-2011-3668
https://notcve.org/view.php?id=CVE-2011-3668
02 Jan 2012 — Cross-site request forgery (CSRF) vulnerability in post_bug.cgi in Bugzilla 2.x, 3.x, and 4.x before 4.2rc1 allows remote attackers to hijack the authentication of arbitrary users for requests that create bug reports. Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en post_bug.cgi en Bugzilla v2.x, v3.x, y v4.x antes de v4.2rc1, permite a atacantes remotos secuestrar la autenticación de usuarios de su elección para peticiones que crean informes de bugs. • http://secunia.com/advisories/47368 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 160EXPL: 1CVE-2011-3657
https://notcve.org/view.php?id=CVE-2011-3657
02 Jan 2012 — Multiple cross-site scripting (XSS) vulnerabilities in Bugzilla 2.x and 3.x before 3.4.13, 3.5.x and 3.6.x before 3.6.7, 3.7.x and 4.0.x before 4.0.3, and 4.1.x through 4.1.3, when debug mode is used, allow remote attackers to inject arbitrary web script or HTML via vectors involving a (1) tabular report, (2) graphical report, or (3) new chart. Multiples vulnerabilidades de ejecución de comandos en sitios cruzados (XSS) en Bugzilla v2.x y v3.x antes de 3.4.13; en v3.5.x y v3.6.x antes de v3.6.7, en v3.7.x y... • http://archives.neohapsis.com/archives/bugtraq/2011-12/0184.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 161EXPL: 1CVE-2011-3669
https://notcve.org/view.php?id=CVE-2011-3669
02 Jan 2012 — Cross-site request forgery (CSRF) vulnerability in attachment.cgi in Bugzilla 2.x, 3.x, and 4.x before 4.2rc1 allows remote attackers to hijack the authentication of arbitrary users for requests that upload attachments. Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF)en attachment.cgi en Bugzilla v2.x, v3.x, y v4.x antes de v4.2rc1, permite a atacantes remotos secuestrar la autenticación de usuarios de su elección para peticiones que suben adjuntos • http://secunia.com/advisories/47368 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 200EXPL: 1CVE-2011-2379
https://notcve.org/view.php?id=CVE-2011-2379
09 Aug 2011 — Cross-site scripting (XSS) vulnerability in Bugzilla 2.4 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3, when Internet Explorer before 9 or Safari before 5.0.6 is used for Raw Unified mode, allows remote attackers to inject arbitrary web script or HTML via a crafted patch, related to content sniffing. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Bugzilla 2.4 hasta la versión 2.22.7, 3.0.x hasta la... • http://secunia.com/advisories/45501 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.1EPSS: 0%CPEs: 129EXPL: 0CVE-2011-2978
https://notcve.org/view.php?id=CVE-2011-2978
09 Aug 2011 — Bugzilla 2.16rc1 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 does not prevent changes to the confirmation e-mail address (aka old_email field) for e-mail change notifications, which makes it easier for remote attackers to perform arbitrary address changes by leveraging an unattended workstation. Bugzilla 2.16rc1 hasta la versión 2.22.7, 3.0.x hasta la 3.3.x, 3.4.x anterior a 3.4.12, 3.5.x, 3.6.x anteriores a 3.6.6, 3.... • http://secunia.com/advisories/45501 • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 0%CPEs: 106EXPL: 0CVE-2011-2976
https://notcve.org/view.php?id=CVE-2011-2976
09 Aug 2011 — Cross-site scripting (XSS) vulnerability in Bugzilla 2.16rc1 through 2.22.7, 3.0.x through 3.3.x, and 3.4.x before 3.4.12 allows remote attackers to inject arbitrary web script or HTML via vectors involving a BUGLIST cookie. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Bugzilla 2.16rc1 hasta la versión 2.22.7, 3.0.x hasta la 3.3.x y 3.4.x anteriores a la 3.4.12 permite a atacantes remotos inyectar codigo de script web o código HTML de su elección a través de vectores que involucran u... • http://secunia.com/advisories/45501 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.1EPSS: 0%CPEs: 115EXPL: 0CVE-2011-2381
https://notcve.org/view.php?id=CVE-2011-2381
09 Aug 2011 — CRLF injection vulnerability in Bugzilla 2.17.1 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 allows remote attackers to inject arbitrary e-mail headers via an attachment description in a flagmail notification. Vulnerabilidad de inyección CRLF (Carriage Return - Line Feed) en Bugzilla 2.17.1 hasta la versión 2.22.7, 3.0.x hasta la 3.3.x, 3.4.x anteriores a 3.4.12, 3.5.x, 3.6.x anteriores a 3.6.6, 3.7.x, 4.0.x anteriores... • http://secunia.com/advisories/45501 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.8EPSS: 3%CPEs: 109EXPL: 0CVE-2011-0046
https://notcve.org/view.php?id=CVE-2011-0046
28 Jan 2011 — Multiple cross-site request forgery (CSRF) vulnerabilities in Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 allow remote attackers to hijack the authentication of arbitrary users for requests related to (1) adding a saved search in buglist.cgi, (2) voting in votes.cgi, (3) sanity checking in sanitycheck.cgi, (4) creating or editing a chart in chart.cgi, (5) column changing in colchange.cgi, and (6) adding, deleting, or approving a quip in quips.cgi. Múltiples vulne... • http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053665.html • CWE-352: Cross-Site Request Forgery (CSRF) •