Page 6 of 38 results (0.012 seconds)

CVSS: 5.1EPSS: 0%CPEs: 29EXPL: 1

CVE-2012-0440

https://notcve.org/view.php?id=CVE-2012-0440

Cross-site request forgery (CSRF) vulnerability in jsonrpc.cgi in Bugzilla 3.5.x and 3.6.x before 3.6.8, 3.7.x and 4.0.x before 4.0.4, and 4.1.x and 4.2.x before 4.2rc2 allows remote attackers to hijack the authentication of arbitrary users for requests that use the JSON-RPC API. Una vulnerabilidad de falsificación solicitudes en sitios cruzados(CSRF) en jsonrpc.cgi en Bugzilla v3.5.x y 3.6.x antes de v3.6.8, v3.7.x y v4.0.x antes de v4.0.4 y v4.1.x y v4.2.x antes v4.2rc2 permite a atacantes remotos secuestrar la autenticación de usuarios arbitrarios para las solicitudes que utilizan la API de JSON-RPC. • http://secunia.com/advisories/47814 http://www.bugzilla.org/security/3.4.13 http://www.securitytracker.com/id?1026623 https://bugzilla.mozilla.org/show_bug.cgi?id=718319 https://exchange.xforce.ibmcloud.com/vulnerabilities/72882 • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 4.0EPSS: 0%CPEs: 163EXPL: 1

CVE-2012-0448

https://notcve.org/view.php?id=CVE-2012-0448

Bugzilla 2.x and 3.x before 3.4.14, 3.5.x and 3.6.x before 3.6.8, 3.7.x and 4.0.x before 4.0.4, and 4.1.x and 4.2.x before 4.2rc2 does not reject non-ASCII characters in e-mail addresses of new user accounts, which makes it easier for remote authenticated users to spoof other user accounts by choosing a similar e-mail address. Bugzilla v2.x y v3.x antes de v3.4.14, v3.5.x y v3.6.x antes de v3.6.8, v3.7.x y v4.0.x antes de v4.0.4 y v4.1.x y v4.2.x antes v4.2rc2 no rechazan los caracteres no ASCII en las direcciones de correo electrónico de las nuevas cuentas de usuario, lo que facilita a los usuarios remotos autenticados a la hora de suplantar otras cuentas de usuario al elegir una dirección de correo electrónico similar a la suya. • http://secunia.com/advisories/47814 http://www.bugzilla.org/security/3.4.13 http://www.securityfocus.com/bid/51784 http://www.securitytracker.com/id?1026623 https://bugzilla.mozilla.org/show_bug.cgi?id=714472 https://exchange.xforce.ibmcloud.com/vulnerabilities/72877 • CWE-20: Improper Input Validation •

CVSS: 6.8EPSS: 0%CPEs: 161EXPL: 1

CVE-2011-3668

https://notcve.org/view.php?id=CVE-2011-3668

Cross-site request forgery (CSRF) vulnerability in post_bug.cgi in Bugzilla 2.x, 3.x, and 4.x before 4.2rc1 allows remote attackers to hijack the authentication of arbitrary users for requests that create bug reports. Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en post_bug.cgi en Bugzilla v2.x, v3.x, y v4.x antes de v4.2rc1, permite a atacantes remotos secuestrar la autenticación de usuarios de su elección para peticiones que crean informes de bugs. • http://secunia.com/advisories/47368 http://www.bugzilla.org/security/3.4.12 https://bugzilla.mozilla.org/show_bug.cgi?id=703975 • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 6.8EPSS: 0%CPEs: 161EXPL: 1

CVE-2011-3669

https://notcve.org/view.php?id=CVE-2011-3669

Cross-site request forgery (CSRF) vulnerability in attachment.cgi in Bugzilla 2.x, 3.x, and 4.x before 4.2rc1 allows remote attackers to hijack the authentication of arbitrary users for requests that upload attachments. Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF)en attachment.cgi en Bugzilla v2.x, v3.x, y v4.x antes de v4.2rc1, permite a atacantes remotos secuestrar la autenticación de usuarios de su elección para peticiones que suben adjuntos • http://secunia.com/advisories/47368 http://www.bugzilla.org/security/3.4.12 https://bugzilla.mozilla.org/show_bug.cgi?id=703983 • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 4.3EPSS: 0%CPEs: 160EXPL: 1

CVE-2011-3657 – Bugzilla Chart Generator Cross Site Scripting

https://notcve.org/view.php?id=CVE-2011-3657

Multiple cross-site scripting (XSS) vulnerabilities in Bugzilla 2.x and 3.x before 3.4.13, 3.5.x and 3.6.x before 3.6.7, 3.7.x and 4.0.x before 4.0.3, and 4.1.x through 4.1.3, when debug mode is used, allow remote attackers to inject arbitrary web script or HTML via vectors involving a (1) tabular report, (2) graphical report, or (3) new chart. Multiples vulnerabilidades de ejecución de comandos en sitios cruzados (XSS) en Bugzilla v2.x y v3.x antes de 3.4.13; en v3.5.x y v3.6.x antes de v3.6.7, en v3.7.x y v4.0.x antes de v4.0.3, y en v4.1.x amtes de la v4.1.3, cuando se utiliza el modo de depuración, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través de vectores relacionados con (1) un informe con tablas, (2) un informe gráfico, o (3) nuevo gráfico. RedTeam Pentesting discovered a cross site scripting vulnerability in Bugzilla's chart generator during a penetration test. If attackers can persuade users to click on a prepared link or redirected them to such a link from an attacker-controlled website, they are able to run arbitrary JavaScript code in the context of the Bugzilla installation's domain. Versions affected include 2.17.1 to 3.4.12, 3.5.1 to 3.6.6, 3.7.1 to 4.0.2 and 4.1.1 to 4.1.3. • http://archives.neohapsis.com/archives/bugtraq/2011-12/0184.html http://www.bugzilla.org/security/3.4.12 https://bugzilla.mozilla.org/show_bug.cgi?id=697699 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •