CVSS: 5.5EPSS: 0%CPEs: 25EXPL: 3CVE-2005-1565
https://notcve.org/view.php?id=CVE-2005-1565
12 May 2005 — Bugzilla 2.17.1 through 2.18, 2.19.1, and 2.19.2, when a user is prompted to log in while attempting to view a chart, displays the password in the URL, which may allow local users to gain sensitive information from web logs or browser history. • http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=001040 •
CVSS: 6.1EPSS: 0%CPEs: 18EXPL: 0CVE-2004-1061
https://notcve.org/view.php?id=CVE-2004-1061
31 Dec 2004 — Cross-site scripting (XSS) vulnerability in Bugzilla before 2.18, including 2.16.x before 2.16.11, allows remote attackers to inject arbitrary HTML and web script via forced error messages, as demonstrated using the action parameter. • http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=001040 •
CVSS: 7.5EPSS: 0%CPEs: 26EXPL: 0CVE-2004-1634
https://notcve.org/view.php?id=CVE-2004-1634
25 Oct 2004 — show_bug.cgi in Bugzilla 2.17.1 through 2.18rc2 and 2.19 from CVS, when using the insidergroup feature and exporting a bug to XML, shows comments and attachment summaries which are marked as private, which allows remote attackers to gain sensitive information. • http://marc.info/?l=bugtraq&m=109872095201238&w=2 •
CVSS: 6.5EPSS: 0%CPEs: 25EXPL: 0CVE-2004-1633
https://notcve.org/view.php?id=CVE-2004-1633
25 Oct 2004 — process_bug.cgi in Bugzilla 2.9 through 2.18rc2 and 2.19 from CVS does not check edit permissions on the keywords field, which allows remote authenticated users to modify the keywords in a bug via the keywordaction parameter. • http://marc.info/?l=bugtraq&m=109872095201238&w=2 •
CVSS: 6.5EPSS: 0%CPEs: 26EXPL: 0CVE-2004-1635
https://notcve.org/view.php?id=CVE-2004-1635
24 Oct 2004 — Bugzilla 2.17.1 through 2.18rc2 and 2.19 from cvs, when using the insidergroup feature, does not sufficiently protect private attachments when there are changes to the metadata, such as filename, description, MIME type, or review flags, which allows remote authenticated users to obtain sensitive information when (1) viewing the bug activity log or (2) receiving bug change notification mails. • http://marc.info/?l=bugtraq&m=109872095201238&w=2 •
CVSS: 9.8EPSS: 0%CPEs: 24EXPL: 0CVE-2004-0707
https://notcve.org/view.php?id=CVE-2004-0707
21 Jul 2004 — SQL injection vulnerability in editusers.cgi in Bugzilla 2.16.x before 2.16.6, and 2.18 before 2.18rc1, allows remote attackers with privileges to grant membership to any group to execute arbitrary SQL. Vulnerabilidad de inyección de SQL en editusers.cgi en Bugzilla 2.16.x anteriores a 2.16.6, y 2.18 anterioresa a 2.18rc1, permite a atacantes remotos con privilegios otorgar privilegio de pertenencia a cualquier grupo para ejecutar SQL. • http://bugzilla.mozilla.org/show_bug.cgi?id=244272 •
CVSS: 5.5EPSS: 0%CPEs: 24EXPL: 0CVE-2004-0706
https://notcve.org/view.php?id=CVE-2004-0706
21 Jul 2004 — Bugzilla 2.17.5 through 2.17.7 embeds the password in an image URL, which could allow local users to view the password in the web server log files. Bugzilla 2.17.5 a 2.17.7 incluye la contaseña en una URL de una imagen, lo que podría permitir a usuarios locales ver la contraseña en los ficheros de registro del servidor web. • http://bugzilla.mozilla.org/show_bug.cgi?id=235510 •
CVSS: 8.8EPSS: 0%CPEs: 24EXPL: 0CVE-2004-0703
https://notcve.org/view.php?id=CVE-2004-0703
21 Jul 2004 — Unknown vulnerability in the administrative controls in Bugzilla 2.17.1 through 2.17.7 allows users with "grant membership" privileges to grant memberships to groups that the user does not control. Vulnerabilidad desconocida en los controles administrativos de Bugzilla 2.17.1 a 2.17.7 permite a usuarios con privilegios "grant membership" hacer miembros a grupos que el usuario no controla. • http://marc.info/?l=bugtraq&m=108965446813639&w=2 •
CVSS: 7.5EPSS: 0%CPEs: 24EXPL: 0CVE-2004-0704
https://notcve.org/view.php?id=CVE-2004-0704
21 Jul 2004 — Unknown vulnerability in (1) duplicates.cgi and (2) buglist.cgi in Bugzilla 2.16.x before 2.16.6, 2.18 before 2.18rc1, when configured to hide products, allows remote attackers to view hidden products. Vulnerabilidad desconocida en (1)duplicates.cgi y (2) buglist.cgi de Bugzilla 2.16.x anteriores a 2.16.6, 2.18 anteriores a 2.19rc1, cuando se configuran para esconder productos, permite a atacantes remotos ver los productos ocultos. • http://marc.info/?l=bugtraq&m=108965446813639&w=2 •
CVSS: 7.5EPSS: 0%CPEs: 24EXPL: 0CVE-2004-0702
https://notcve.org/view.php?id=CVE-2004-0702
21 Jul 2004 — DBI in Bugzilla 2.17.1 through 2.17.7 displays the database password in an error message when the SQL server is not running, which could allow remote attackers to gain sensitive information. DBI de Bugzilla 2.17.1 a 2.17.7 muestra la contraseña de la base de datos en un mensaje de error cuando el servidor SQL no está corriendo, lo que podría permitir a atacantes remotos obtener información sensible. • http://marc.info/?l=bugtraq&m=108965446813639&w=2 •