Page 4 of 40 results (0.008 seconds)

CVSS: 4.7EPSS: 0%CPEs: 105EXPL: 0

CVE-2010-3172

https://notcve.org/view.php?id=CVE-2010-3172

05 Nov 2010 — CRLF injection vulnerability in Bugzilla before 3.2.9, 3.4.x before 3.4.9, 3.6.x before 3.6.3, and 4.0.x before 4.0rc1, when Server Push is enabled in a web browser, allows remote attackers to inject arbitrary HTTP headers and content, and conduct HTTP response splitting attacks, via a crafted URL. Vulnerabilidad de inyección CRLF (se refiere a CR (retorno de carro) y LF (salto de línea)) en Bugzilla anterior a v3.2.9, v3.4.x anterior a v3.4.9, v3.6.x anterior a v3.6.3, y v4.0.x anterior a v4.0rc1, cuando S... • http://lists.fedoraproject.org/pipermail/package-announce/2010-November/050813.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •

CVSS: 5.3EPSS: 0%CPEs: 78EXPL: 0

CVE-2010-2756

https://notcve.org/view.php?id=CVE-2010-2756

13 Aug 2010 — Search.pm in Bugzilla 2.19.1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1 through 3.6.1, and 3.7 through 3.7.2 allows remote attackers to determine the group memberships of arbitrary users via vectors involving the Search interface, boolean charts, and group-based pronouns. Search.pm en Bugzilla v2.19.1 hasta la v3.2.7, v3.3.1 hasta la v3.4.7, v3.5.1 hasta la v3.6.1, y v3.7 hasta la v3.7.2 permite a atacantes remotos determinar la pertenencia a grupos de usuarios de su elección a través de vectores de ataque q... • http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046518.html • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 5.3EPSS: 0%CPEs: 100EXPL: 0

CVE-2010-2758

https://notcve.org/view.php?id=CVE-2010-2758

13 Aug 2010 — Bugzilla 2.17.1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1 through 3.6.1, and 3.7 through 3.7.2 generates different error messages depending on whether a product exists, which makes it easier for remote attackers to guess product names via unspecified use of the (1) Reports or (2) Duplicates page. Bugzilla v2.23.1 hasta la v3.2.7, v3.3.1 hasta la v3.4.7, v3.5.1 hasta la v3.6.1, y v3.7 hasta la v3.7.2, genera mensajes de error diferentes dependiendo de si un producto existe, lo que facilita a atacantes remoto... • http://lists.fedoraproject.org/pipermail/package-announce/2010-August/046518.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 7.5EPSS: 0%CPEs: 85EXPL: 0

CVE-2009-3989

https://notcve.org/view.php?id=CVE-2009-3989

03 Feb 2010 — Bugzilla before 3.0.11, 3.2.x before 3.2.6, 3.4.x before 3.4.5, and 3.5.x before 3.5.3 does not block access to files and directories that are used by custom installations, which allows remote attackers to obtain sensitive information via requests for (1) CVS/, (2) contrib/, (3) docs/en/xml/, (4) t/, or (5) old-params.txt. Bugzilla anteriores a v3.0.11, v3.2.x anteriores a v3.2.6, v3.4.x anteriores a v3.4.5, y v3.5.x anteriores a v3.5.3 no bloquea el acceso a ficheros y directorios que son utilizados en ins... • http://secunia.com/advisories/38443 • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 8.1EPSS: 0%CPEs: 4EXPL: 0

CVE-2006-5455

https://notcve.org/view.php?id=CVE-2006-5455

23 Oct 2006 — Cross-site request forgery (CSRF) vulnerability in editversions.cgi in Bugzilla before 2.22.1 and 2.23.x before 2.23.3 allows user-assisted remote attackers to create, modify, or delete arbitrary bug reports via a crafted URL. Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en editversions.cgi en Bugzilla anterior a 2.22.1 y 2.23.x anteriores a 2.23.3 permite a atacantes remotos con intervención del usuario crear, modificar o borrar informes de "bugs" de su elección mediante una URL cr... • http://secunia.com/advisories/22409 •

CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 0

CVE-2002-0007

https://notcve.org/view.php?id=CVE-2002-0007

31 Jan 2002 — CGI.pl in Bugzilla before 2.14.1, when using LDAP, allows remote attackers to obtain an anonymous bind to the LDAP server via a request that does not include a password, which causes a null password to be sent to the LDAP server. CGl.pl en Bugzilla anterior a la 2.14.1, cuando se usa LDAP, permite que atacantes remotos obtengan una conexión anónima con el servidor LDAP por medio de una petición que no incluye una clave, lo que provoca que se envíe una clave nula al servidor LDAP. • http://archives.neohapsis.com/archives/bugtraq/2002-01/0034.html •

CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0

CVE-2002-0011

https://notcve.org/view.php?id=CVE-2002-0011

31 Jan 2002 — Information leak in doeditvotes.cgi in Bugzilla before 2.14.1 may allow remote attackers to more easily conduct attacks on the login. Pérdida de información en doeditvotes.cgi en Bugzilla anterior a la 2.14.1 permite que los atacantes lleven a cabo más fácilmente sus ataques de login. • http://archives.neohapsis.com/archives/bugtraq/2002-01/0034.html •

CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0

CVE-2002-0009

https://notcve.org/view.php?id=CVE-2002-0009

31 Jan 2002 — show_bug.cgi in Bugzilla before 2.14.1 allows a user with "Bugs Access" privileges to see other products that are not accessible to the user, by submitting a bug and reading the resulting Product pulldown menu. show_bug.cgi en Bugzilla anterior a la 2.14.1 permite que un usuario con privilegios de "Bugs Access" vea otros productos que no son accesibles al usuario, enviando un bug y leyendo el menú "Producto" resultante. • http://archives.neohapsis.com/archives/bugtraq/2002-01/0034.html •

CVSS: 7.5EPSS: 2%CPEs: 1EXPL: 0

CVE-2002-0008

https://notcve.org/view.php?id=CVE-2002-0008

10 Jan 2002 — Bugzilla before 2.14.1 allows remote attackers to (1) spoof a user comment via an HTTP request to process_bug.cgi using the "who" parameter, instead of the Bugzilla_login cookie, or (2) post a bug as another user by modifying the reporter parameter to enter_bug.cgi, which is passed to post_bug.cgi. Versiones anteriores a la 2.14.1 de Bugzilla permiten que un atacante remoto (1) falsee el comentario de un usuario por medio de una petición HTTP usando process_bug.cgi y el parámetro "who" en vez de una cokie d... • http://archives.neohapsis.com/archives/bugtraq/2002-01/0034.html •

CVSS: 9.8EPSS: 3%CPEs: 1EXPL: 0

CVE-2002-0010

https://notcve.org/view.php?id=CVE-2002-0010

10 Jan 2002 — Bugzilla before 2.14.1 allows remote attackers to inject arbitrary SQL code and create files or gain privileges via (1) the sql parameter in buglist.cgi, (2) invalid field names from the "boolean chart" query in buglist.cgi, (3) the mybugslink parameter in userprefs.cgi, (4) a malformed bug ID in the buglist parameter in long_list.cgi, and (5) the value parameter in editusers.cgi, which allows groupset privileges to be modified by attackers with blessgroupset privileges. Bugzilla anterior a la 2.14.1 permit... • http://archives.neohapsis.com/archives/bugtraq/2002-01/0034.html •