CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2018-5123 – Bugzilla 4.4.12 / 5.0.3 Cross Site Request Forgery
https://notcve.org/view.php?id=CVE-2018-5123
19 Feb 2018 — A third party website can access information available to a user with access to a restricted bug entry using the image generation in report.cgi in all Bugzilla versions prior to 4.4. Un sitio web de terceros puede acceder a la información disponible para un usuario con acceso a una entrada de fallo restringida, utilizando la generación de imágenes en report.cgi en todas las versiones de Bugzilla anteriores a la 4.4. Bugzilla versions 2.16rc1 to 4.4.12 and 4.5.1 to 5.0.3 suffer from a cross site request forg... • https://bugzilla.mozilla.org/show_bug.cgi?id=CVE-2018-5123 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 224EXPL: 0CVE-2016-2803 – Bugzilla 4.4.11 / 5.0.2 Summary Cross Site Scripting
https://notcve.org/view.php?id=CVE-2016-2803
17 May 2016 — Cross-site scripting (XSS) vulnerability in the dependency graphs in Bugzilla 2.16rc1 through 4.4.11, and 4.5.1 through 5.0.2 allows remote attackers to inject arbitrary web script or HTML. Vulnerabilidad (XSS) en los gráficos de dependencia en Bugzilla 2.16rc1 hasta la versión 4.4.11, y 4.5.1 hasta la versión 5.0.2 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrario. Bugzilla versions 2.16rc1 to 4.4.11 and 4.5.1 to 5.0.2 suffer from a cross site scripting vulnerability. • http://packetstormsecurity.com/files/137079/Bugzilla-4.4.11-5.0.2-Summary-Cross-Site-Scripting.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.7EPSS: 0%CPEs: 147EXPL: 1CVE-2015-8508 – Bugzilla Cross Site Scripting / Information Leak
https://notcve.org/view.php?id=CVE-2015-8508
23 Dec 2015 — Cross-site scripting (XSS) vulnerability in showdependencygraph.cgi in Bugzilla 2.x, 3.x, and 4.x before 4.2.16, 4.3.x and 4.4.x before 4.4.11, and 4.5.x and 5.0.x before 5.0.2, when a local dot configuration is used, allows remote attackers to inject arbitrary web script or HTML via a crafted bug summary. Vulnerabilidad de XSS en showdependencygraph.cgi en Bugzilla 2.x, 3.x y 4.x en versiones anteriores a 4.2.16, 4.3.x y 4.4.x en versiones anteriores a 4.4.11 y 4.5.x y 5.0.x en versiones anteriores a 5.0.2... • http://packetstormsecurity.com/files/135048/Bugzilla-Cross-Site-Scripting-Information-Leak.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 147EXPL: 1CVE-2015-8509 – Bugzilla Cross Site Scripting / Information Leak
https://notcve.org/view.php?id=CVE-2015-8509
23 Dec 2015 — Template.pm in Bugzilla 2.x, 3.x, and 4.x before 4.2.16, 4.3.x and 4.4.x before 4.4.11, and 4.5.x and 5.0.x before 5.0.2 does not properly construct CSV files, which allows remote attackers to obtain sensitive information by leveraging a web browser that interprets CSV data as JavaScript code. Template.pm en Bugzilla 2.x, 3.x y 4.x en versiones anteriores a 4.2.16, 4.3.x y 4.4.x en versiones anteriores a 4.4.11 y 4.5.x y 5.0.x en versiones anteriores a 5.0.2 no construye adecuadamente archivos CSV, lo que p... • http://packetstormsecurity.com/files/135048/Bugzilla-Cross-Site-Scripting-Information-Leak.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 1%CPEs: 205EXPL: 1CVE-2015-4499 – Bugzilla Unauthorized Account Creation
https://notcve.org/view.php?id=CVE-2015-4499
10 Sep 2015 — Util.pm in Bugzilla 2.x, 3.x, and 4.x before 4.2.15, 4.3.x and 4.4.x before 4.4.10, and 5.x before 5.0.1 mishandles long e-mail addresses during account registration, which allows remote attackers to obtain the default privileges for an arbitrary domain name by placing that name in a substring of an address, as demonstrated by truncation of an @mozilla.com.example.com address to an @mozilla.com address. Vulnerabilidad en Util.pm en Bugzilla 2.x, 3.x, y 4.x en versiones anteriores a 4.2.15, 4.3.x y 4.4.x en ... • http://lists.fedoraproject.org/pipermail/package-announce/2015-October/168725.html • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 0%CPEs: 41EXPL: 0CVE-2014-8630 – Mandriva Linux Security Advisory 2015-030
https://notcve.org/view.php?id=CVE-2014-8630
01 Feb 2015 — Bugzilla before 4.0.16, 4.1.x and 4.2.x before 4.2.12, 4.3.x and 4.4.x before 4.4.7, and 5.x before 5.0rc1 allows remote authenticated users to execute arbitrary commands by leveraging the editcomponents privilege and triggering crafted input to a two-argument Perl open call, as demonstrated by shell metacharacters in a product name. Bugzilla anterior a 4.0.16, 4.1.x y 4.2.x anterior a 4.2.12, 4.3.x y 4.4.x anterior a 4.4.7, y 5.x anterior a 5.0rc1 permite a usuarios remotos autenticados ejecutar comandos a... • http://advisories.mageia.org/MGASA-2015-0048.html • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 6.1EPSS: 0%CPEs: 200EXPL: 1CVE-2011-2379
https://notcve.org/view.php?id=CVE-2011-2379
09 Aug 2011 — Cross-site scripting (XSS) vulnerability in Bugzilla 2.4 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3, when Internet Explorer before 9 or Safari before 5.0.6 is used for Raw Unified mode, allows remote attackers to inject arbitrary web script or HTML via a crafted patch, related to content sniffing. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Bugzilla 2.4 hasta la versión 2.22.7, 3.0.x hasta la... • http://secunia.com/advisories/45501 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 109EXPL: 0CVE-2010-4567
https://notcve.org/view.php?id=CVE-2010-4567
28 Jan 2011 — Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 does not properly handle whitespace preceding a (1) javascript: or (2) data: URI, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the URL (aka bug_file_loc) field. Bugzilla anterior a v3.2.10, v3.4.x anterior a v3.4.10, v3.6.x anterior a v3.6.4, y v4.0.x anterior a v4.0rc2 no gestiona adecuadamente el espacio en blanco que precede a URIs de (1) javascript: o (2) datos:, esto permite a ata... • http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053665.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.1EPSS: 1%CPEs: 113EXPL: 0CVE-2010-4568
https://notcve.org/view.php?id=CVE-2010-4568
28 Jan 2011 — Bugzilla 2.14 through 2.22.7; 3.0.x, 3.1.x, and 3.2.x before 3.2.10; 3.4.x before 3.4.10; 3.6.x before 3.6.4; and 4.0.x before 4.0rc2 does not properly generate random values for cookies and tokens, which allows remote attackers to obtain access to arbitrary accounts via unspecified vectors, related to an insufficient number of calls to the srand function. Bugzilla v2.14 a la v2.22.7; v3.0.x, v3.1.x, y v3.2.x anterior a v3.2.10; v3.4.x anterior a v3.4.10; v3.6.x anterior a v3.6.4; y v4.0.x anterior a v4.0rc... • http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053665.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.1EPSS: 0%CPEs: 109EXPL: 0CVE-2010-4572
https://notcve.org/view.php?id=CVE-2010-4572
28 Jan 2011 — CRLF injection vulnerability in chart.cgi in Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the query string, a different vulnerability than CVE-2010-2761 and CVE-2010-4411. Vulnerabilidad de CRLF (de validación de entrada) en chart.cgi en Bugzilla anterior a v3.2.10, v3.4.x anterior a v3.4.10, v3.6.x anterior a v3.6.4, y v4.0.x anterior a v4.0rc2, permite a atac... • http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053665.html • CWE-94: Improper Control of Generation of Code ('Code Injection') •