Bugzilla (Mozilla) - vulnerabilities (CVEs)

145 CVEs, 0 in the last 30 days, 244 known versions, newest CVE from 2019-04-29. Vendor: Mozilla.

CVEs of Bugzilla

• CVE-2018-5123 - CVSS 8.8 (high), 2019-04-29: A third party website can access information available to a user with access to a restricted bug entry using the image generation in report.cgi in all…
• CVE-2016-2803 - CVSS 6.1 (medium), 2017-04-12: Cross-site scripting (XSS) vulnerability in the dependency graphs in Bugzilla 2.16rc1 through 4.4.11, and 4.5.1 through 5.0.2 allows remote attackers to…
• CVE-2015-8509 - CVSS 3.5 (low), 2016-01-03: Template.pm in Bugzilla 2.x, 3.x, and 4.x before 4.2.16, 4.3.x and 4.4.x before 4.4.11, and 4.5.x and 5.0.x before 5.0.2 does not properly construct CSV…
• CVE-2015-8508 - CVSS 4.7 (medium), 2016-01-03: Cross-site scripting (XSS) vulnerability in showdependencygraph.cgi in Bugzilla 2.x, 3.x, and 4.x before 4.2.16, 4.3.x and 4.4.x before 4.4.11, and 4.5.x and…
• CVE-2015-4499 - CVSS 7.5 (high), 2015-09-14: Util.pm in Bugzilla 2.x, 3.x, and 4.x before 4.2.15, 4.3.x and 4.4.x before 4.4.10, and 5.x before 5.0.1 mishandles long e-mail addresses during account…
• CVE-2014-8630 - CVSS 6.5 (medium), 2015-02-01: Bugzilla before 4.0.16, 4.1.x and 4.2.x before 4.2.12, 4.3.x and 4.4.x before 4.4.7, and 5.x before 5.0rc1 allows remote authenticated users to execute…
• CVE-2014-1573 - CVSS 4.3 (medium), 2014-10-13: Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 does not ensure that a scalar…
• CVE-2014-1572 - CVSS 5 (medium), 2014-10-13: The confirm_create_account function in the account-creation feature in token.cgi in Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11,…
• CVE-2014-1571 - CVSS 4 (medium), 2014-10-13: Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 allows remote authenticated…
• CVE-2014-1546 - CVSS 4.3 (medium), 2014-08-14: The response function in the JSONP endpoint in WebService/Server/JSONRPC.pm in jsonrpc.cgi in Bugzilla 3.x and 4.x before 4.0.14, 4.1.x and 4.2.x before…
• CVE-2014-1517 - CVSS 4 (medium), 2014-04-20: The login form in Bugzilla 2.x, 3.x, 4.x before 4.4.3, and 4.5.x before 4.5.3 does not properly handle a correctly authenticated but unintended login attempt,…
• CVE-2013-1742 - CVSS 4.3 (medium), 2013-10-24: Multiple cross-site scripting (XSS) vulnerabilities in editflagtypes.cgi in Bugzilla 2.x, 3.x, and 4.0.x before 4.0.11; 4.1.x and 4.2.x before 4.2.7; and…
• CVE-2013-1734 - CVSS 6.8 (medium), 2013-10-24: Cross-site request forgery (CSRF) vulnerability in attachment.cgi in Bugzilla 2.x, 3.x, and 4.0.x before 4.0.11; 4.1.x and 4.2.x before 4.2.7; and 4.3.x and…
• CVE-2013-1743 - CVSS 4.3 (medium), 2013-10-24: Multiple cross-site scripting (XSS) vulnerabilities in report.cgi in Bugzilla 4.1.x and 4.2.x before 4.2.7 and 4.3.x and 4.4.x before 4.4.1 allow remote…
• CVE-2013-1733 - CVSS 6.8 (medium), 2013-10-24: Cross-site request forgery (CSRF) vulnerability in process_bug.cgi in Bugzilla 4.4.x before 4.4.1 allows remote attackers to hijack the authentication of…
• CVE-2013-0786 - CVSS 5 (medium), 2013-02-24: The Bugzilla::Search::build_subselect function in Bugzilla 2.x and 3.x before 3.6.13 and 3.7.x and 4.0.x before 4.0.10 generates different error messages for…
• CVE-2013-0785 - CVSS 4.3 (medium), 2013-02-24: Cross-site scripting (XSS) vulnerability in show_bug.cgi in Bugzilla before 3.6.13, 3.7.x and 4.0.x before 4.0.10, 4.1.x and 4.2.x before 4.2.5, and 4.3.x and…
• CVE-2012-4189 - CVSS 4.3 (medium), 2012-11-16: Cross-site scripting (XSS) vulnerability in Bugzilla 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1, allows remote attackers to inject…
• CVE-2012-4199 - CVSS 4.3 (medium), 2012-11-16: template/en/default/bug/field-events.js.tmpl in Bugzilla 3.x before 3.6.12, 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x…
• CVE-2012-4198 - CVSS 4 (medium), 2012-11-16: The User.get method in Bugzilla/WebService/User.pm in Bugzilla 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1…
• CVE-2012-5884 - CVSS 5 (medium), 2012-11-16: The User.get method in Bugzilla/WebService/User.pm in Bugzilla 4.3.2 allows remote attackers to obtain sensitive information about the saved searches of…
• CVE-2012-4197 - CVSS 5 (medium), 2012-11-16: Bugzilla/Attachment.pm in attachment.cgi in Bugzilla 2.x and 3.x before 3.6.12, 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and…
• CVE-2012-5883 - CVSS 4.3 (medium), 2012-11-16: Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.8.0 through 2.9.0, as used in Bugzilla 3.7.x and 4.0.x before 4.0.9,…
• CVE-2012-4747 - CVSS 5 (medium), 2012-09-04: Bugzilla 2.x and 3.x through 3.6.11, 3.7.x and 4.0.x before 4.0.8, 4.1.x and 4.2.x before 4.2.3, and 4.3.x before 4.3.3 stores potentially sensitive…
• CVE-2012-3981 - CVSS 5 (medium), 2012-09-04: Auth/Verify/LDAP.pm in Bugzilla 2.x and 3.x before 3.6.11, 3.7.x and 4.0.x before 4.0.8, 4.1.x and 4.2.x before 4.2.3, and 4.3.x before 4.3.3 does not…
• CVE-2012-1969 - CVSS 4.3 (medium), 2012-07-30: The get_attachment_link function in Template.pm in Bugzilla 2.x and 3.x before 3.6.10, 3.7.x and 4.0.x before 4.0.7, 4.1.x and 4.2.x before 4.2.2, and 4.3.x…
• CVE-2012-1968 - CVSS 4.3 (medium), 2012-07-30: Bugzilla 4.1.x and 4.2.x before 4.2.2 and 4.3.x before 4.3.2 uses bug-editor privileges instead of bugmail-recipient privileges during construction of HTML…
• CVE-2012-0465 - CVSS 4.3 (medium), 2012-04-27: Bugzilla 3.5.x and 3.6.x before 3.6.9, 3.7.x and 4.0.x before 4.0.6, and 4.1.x and 4.2.x before 4.2.1, when the inbound_proxies option is enabled, does not…
• CVE-2012-0466 - CVSS 4 (medium), 2012-04-27: template/en/default/list/list.js.tmpl in Bugzilla 2.x and 3.x before 3.6.9, 3.7.x and 4.0.x before 4.0.6, and 4.1.x and 4.2.x before 4.2.1 does not properly…
• CVE-2012-0453 - CVSS 5.1 (medium), 2012-02-25: Cross-site request forgery (CSRF) vulnerability in xmlrpc.cgi in Bugzilla 4.0.2 through 4.0.4 and 4.1.1 through 4.2rc2, when mod_perl is used, allows remote…
• CVE-2012-0440 - CVSS 5.1 (medium), 2012-02-02: Cross-site request forgery (CSRF) vulnerability in jsonrpc.cgi in Bugzilla 3.5.x and 3.6.x before 3.6.8, 3.7.x and 4.0.x before 4.0.4, and 4.1.x and 4.2.x…
• CVE-2012-0448 - CVSS 4 (medium), 2012-02-02: Bugzilla 2.x and 3.x before 3.4.14, 3.5.x and 3.6.x before 3.6.8, 3.7.x and 4.0.x before 4.0.4, and 4.1.x and 4.2.x before 4.2rc2 does not reject non-ASCII…
• CVE-2011-3657 - CVSS 4.3 (medium), 2012-01-02: Multiple cross-site scripting (XSS) vulnerabilities in Bugzilla 2.x and 3.x before 3.4.13, 3.5.x and 3.6.x before 3.6.7, 3.7.x and 4.0.x before 4.0.3, and…
• CVE-2011-3669 - CVSS 6.8 (medium), 2012-01-02: Cross-site request forgery (CSRF) vulnerability in attachment.cgi in Bugzilla 2.x, 3.x, and 4.x before 4.2rc1 allows remote attackers to hijack the…
• CVE-2011-3668 - CVSS 6.8 (medium), 2012-01-02: Cross-site request forgery (CSRF) vulnerability in post_bug.cgi in Bugzilla 2.x, 3.x, and 4.x before 4.2rc1 allows remote attackers to hijack the…
• CVE-2011-3667 - CVSS 6.8 (medium), 2012-01-02: The User.offer_account_by_email WebService method in Bugzilla 2.x and 3.x before 3.4.13, 3.5.x and 3.6.x before 3.6.7, 3.7.x and 4.0.x before 4.0.3, and 4.1.x…
• CVE-2011-2380 - CVSS 5 (medium), 2011-08-09: Bugzilla 2.23.3 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 allows…
• CVE-2011-2977 - CVSS 2.1 (low), 2011-08-09: Bugzilla 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 on Windows does not delete the temporary files associated with uploaded…
• CVE-2011-2379 - CVSS 4.3 (medium), 2011-08-09: Cross-site scripting (XSS) vulnerability in Bugzilla 2.4 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x…
• CVE-2011-2976 - CVSS 4.3 (medium), 2011-08-09: Cross-site scripting (XSS) vulnerability in Bugzilla 2.16rc1 through 2.22.7, 3.0.x through 3.3.x, and 3.4.x before 3.4.12 allows remote attackers to inject…
• CVE-2011-2979 - CVSS 5 (medium), 2011-08-09: Bugzilla 4.1.x before 4.1.3 generates different responses for certain assignee queries depending on whether the group name is valid, which allows remote…
• CVE-2011-2381 - CVSS 4.3 (medium), 2011-08-09: CRLF injection vulnerability in Bugzilla 2.17.1 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before…
• CVE-2011-2978 - CVSS 5 (medium), 2011-08-09: Bugzilla 2.16rc1 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 does…
• CVE-2008-7292 - CVSS 2.1 (low), 2011-08-09: Bugzilla 2.20.x before 2.20.5, 2.22.x before 2.22.3, and 3.0.x before 3.0.3 on Windows does not delete the temporary files associated with uploaded…
• CVE-2011-0048 - CVSS 4.3 (medium), 2011-01-28: Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 creates a clickable link for a (1) javascript: or (2) data: URI in…
• CVE-2010-4570 - CVSS 4.3 (medium), 2011-01-28: Cross-site scripting (XSS) vulnerability in the duplicate-detection functionality in Bugzilla 3.7.1, 3.7.2, 3.7.3, and 4.0rc1 allows remote attackers to…
• CVE-2010-4569 - CVSS 4.3 (medium), 2011-01-28: Cross-site scripting (XSS) vulnerability in Bugzilla 3.7.1, 3.7.2, 3.7.3, and 4.0rc1 allows remote attackers to inject arbitrary web script or HTML via the…
• CVE-2011-0046 - CVSS 6.8 (medium), 2011-01-28: Multiple cross-site request forgery (CSRF) vulnerabilities in Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 allow…
• CVE-2010-4568 - CVSS 7.5 (high), 2011-01-28: Bugzilla 2.14 through 2.22.7; 3.0.x, 3.1.x, and 3.2.x before 3.2.10; 3.4.x before 3.4.10; 3.6.x before 3.6.4; and 4.0.x before 4.0rc2 does not properly…
• CVE-2010-4572 - CVSS 4.3 (medium), 2011-01-28: CRLF injection vulnerability in chart.cgi in Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 allows remote attackers…
• CVE-2010-4567 - CVSS 4.3 (medium), 2011-01-28: Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 does not properly handle whitespace preceding a (1) javascript: or…
• CVE-2010-3764 - CVSS 5 (medium), 2010-11-05: The Old Charts implementation in Bugzilla 2.12 through 3.2.8, 3.4.8, 3.6.2, 3.7.3, and 4.1 creates graph files with predictable names in graphs/, which allows…
• CVE-2010-3172 - CVSS 2.6 (low), 2010-11-05: CRLF injection vulnerability in Bugzilla before 3.2.9, 3.4.x before 3.4.9, 3.6.x before 3.6.3, and 4.0.x before 4.0rc1, when Server Push is enabled in a web…
• CVE-2010-2758 - CVSS 5 (medium), 2010-08-16: Bugzilla 2.17.1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1 through 3.6.1, and 3.7 through 3.7.2 generates different error messages depending on whether a…
• CVE-2010-2757 - CVSS 6.5 (medium), 2010-08-16: The sudo feature in Bugzilla 2.22rc1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1 through 3.6.1, and 3.7 through 3.7.2 does not properly send impersonation…
• CVE-2010-2756 - CVSS 5 (medium), 2010-08-16: Search.pm in Bugzilla 2.19.1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1 through 3.6.1, and 3.7 through 3.7.2 allows remote attackers to determine the group…
• CVE-2010-2759 - CVSS 4 (medium), 2010-08-16: Bugzilla 2.23.1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1 through 3.6.1, and 3.7 through 3.7.2, when PostgreSQL is used, does not properly handle large…
• CVE-2010-2470 - CVSS 1.9 (low), 2010-06-28: Install/Filesystem.pm in Bugzilla 3.5.1 through 3.6.1 and 3.7 through 3.7.1, when use_suexec is enabled, uses world-readable permissions within (1) .bzr/ and…
• CVE-2010-1204 - CVSS 5 (medium), 2010-06-28: Search.pm in Bugzilla 2.17.1 through 3.2.6, 3.3.1 through 3.4.6, 3.5.1 through 3.6, and 3.7 allows remote attackers to obtain potentially sensitive…
• CVE-2010-0180 - CVSS 1.9 (low), 2010-06-28: Install/Filesystem.pm in Bugzilla 3.5.1 through 3.6 and 3.7, when use_suexec is enabled, uses world-readable permissions for the localconfig files, which…
• CVE-2009-3989 - CVSS 4.3 (medium), 2010-02-03: Bugzilla before 3.0.11, 3.2.x before 3.2.6, 3.4.x before 3.4.5, and 3.5.x before 3.5.3 does not block access to files and directories that are used by custom…
• CVE-2009-3387 - CVSS 5 (medium), 2010-02-03: Bugzilla 3.3.1 through 3.4.4, 3.5.1, and 3.5.2 does not allow group restrictions to be preserved throughout the process of moving a bug to a different product…
• CVE-2009-3386 - CVSS 5 (medium), 2009-11-20: Template.pm in Bugzilla 3.3.2 through 3.4.3 and 3.5 through 3.5.1 allows remote attackers to discover the alias of a private bug by reading the (1) Depends On…
• CVE-2009-3166 - CVSS 5 (medium), 2009-09-15: token.cgi in Bugzilla 3.4rc1 through 3.4.1 places a password in a URL at the beginning of a login session that occurs immediately after a password reset,…
• CVE-2009-3165 - CVSS 7.5 (high), 2009-09-15: SQL injection vulnerability in the Bug.create WebService function in Bugzilla 2.23.4 through 3.0.8, 3.1.1 through 3.2.4, and 3.3.1 through 3.4.1 allows remote…
• CVE-2009-3125 - CVSS 7.5 (high), 2009-09-15: SQL injection vulnerability in the Bug.search WebService function in Bugzilla 3.3.2 through 3.4.1, and 3.5, allows remote attackers to execute arbitrary SQL…
• CVE-2009-1213 - CVSS 6.8 (medium), 2009-04-01: Cross-site request forgery (CSRF) vulnerability in attachment.cgi in Bugzilla 3.2 before 3.2.3, 3.3 before 3.3.4, and earlier versions allows remote attackers…
• CVE-2008-6098 - CVSS 4 (medium), 2009-02-09: Bugzilla 3.2 before 3.2 RC2, 3.0 before 3.0.6, 2.22 before 2.22.6, 2.20 before 2.20.7, and other versions after 2.17.4 allows remote authenticated users to…
• CVE-2009-0481 - CVSS 3.5 (low), 2009-02-09: Bugzilla 2.x before 2.22.7, 3.0 before 3.0.7, 3.2 before 3.2.1, and 3.3 before 3.3.2 allows remote authenticated users to conduct cross-site scripting (XSS)…
• CVE-2009-0484 - CVSS 5.8 (medium), 2009-02-09: Cross-site request forgery (CSRF) vulnerability in Bugzilla 3.0 before 3.0.7, 3.2 before 3.2.1, and 3.3 before 3.3.2 allows remote attackers to delete shared…
• CVE-2009-0483 - CVSS 5.8 (medium), 2009-02-09: Cross-site request forgery (CSRF) vulnerability in Bugzilla 2.22 before 2.22.7, 3.0 before 3.0.7, 3.2 before 3.2.1, and 3.3 before 3.3.2 allows remote…
• CVE-2009-0486 - CVSS 7.5 (high), 2009-02-09: Bugzilla 3.2.1, 3.0.7, and 3.3.2, when running under mod_perl, calls the srand function at startup time, which causes Apache children to have the same seed…
• CVE-2009-0482 - CVSS 5.8 (medium), 2009-02-09: Cross-site request forgery (CSRF) vulnerability in Bugzilla before 3.2 before 3.2.1, 3.3 before 3.3.2, and other versions before 3.2 allows remote attackers…
• CVE-2009-0485 - CVSS 5.8 (medium), 2009-02-09: Cross-site request forgery (CSRF) vulnerability in Bugzilla 2.17 to 2.22.7, 3.0 before 3.0.7, 3.2 before 3.2.1, and 3.3 before 3.3.2 allows remote attackers…
• CVE-2008-4437 - CVSS 7.1 (high), 2008-10-03: Directory traversal vulnerability in importxml.pl in Bugzilla before 2.22.5, and 3.x before 3.0.5, when --attach_path is enabled, allows remote attackers to…
• CVE-2008-2104 - CVSS 4 (medium), 2008-05-07: The WebService in Bugzilla 3.1.3 allows remote authenticated users without canconfirm privileges to create NEW or ASSIGNED bug entries via a request to the…
• CVE-2008-2103 - CVSS 4.3 (medium), 2008-05-07: Cross-site scripting (XSS) vulnerability in Bugzilla 2.17.2 and later allows remote attackers to inject arbitrary web script or HTML via the id parameter to…
• CVE-2008-2105 - CVSS 3.5 (low), 2008-05-07: email_in.pl in Bugzilla 2.23.4, 3.0.x before 3.0.4, and 3.1.x before 3.1.4 allows remote authenticated users to more easily spoof the changer of a bug via a…
• CVE-2007-5038 - CVSS 7.5 (high), 2007-09-24: The offer_account_by_email function in User.pm in the WebService for Bugzilla before 3.0.2, and 3.1.x before 3.1.2, does not check the value of the…
• CVE-2007-4543 - CVSS 4.3 (medium), 2007-08-27: Cross-site scripting (XSS) vulnerability in enter_bug.cgi in Bugzilla 2.17.1 through 2.20.4, 2.22.x before 2.22.3, and 3.x before 3.0.1 allows remote…
• CVE-2007-4539 - CVSS 5 (medium), 2007-08-27: The WebService (XML-RPC) interface in Bugzilla 2.23.3 through 3.0.0 does not enforce permissions for the time-tracking fields of bugs, which allows remote…
• CVE-2007-4538 - CVSS 5 (medium), 2007-08-27: email_in.pl in Bugzilla 2.23.4 through 3.0.0 allows remote attackers to execute arbitrary commands via the -f (From address) option to the…
• CVE-2007-0791 - CVSS 4.3 (medium), 2007-02-06: Cross-site scripting (XSS) vulnerability in Atom feeds in Bugzilla 2.20.3, 2.22.1, and 2.23.3, and earlier versions down to 2.20.1, allows remote attackers to…
• CVE-2007-0792 - CVSS 7.5 (high), 2007-02-06: The mod_perl initialization script in Bugzilla 2.23.3 does not set the Bugzilla Apache configuration to allow .htaccess permissions to override file…
• CVE-2006-5453 - CVSS 3.5 (low), 2006-10-23: Multiple cross-site scripting (XSS) vulnerabilities in Bugzilla 2.18.x before 2.18.6, 2.20.x before 2.20.3, 2.22.x before 2.22.1, and 2.23.x before 2.23.3…
• CVE-2006-5455 - CVSS 2.6 (low), 2006-10-23: Cross-site request forgery (CSRF) vulnerability in editversions.cgi in Bugzilla before 2.22.1 and 2.23.x before 2.23.3 allows user-assisted remote attackers…
• CVE-2006-5454 - CVSS 5 (medium), 2006-10-23: Bugzilla 2.18.x before 2.18.6, 2.20.x before 2.20.3, 2.22.x before 2.22.1, and 2.23.x before 2.23.3 allow remote attackers to obtain (1) the description of…
• CVE-2006-2420 - CVSS 4.3 (medium), 2006-05-16: Bugzilla 2.20rc1 through 2.20 and 2.21.1, when using RSS 1.0, allows remote attackers to conduct cross-site scripting (XSS) attacks via a title element with…
• CVE-2006-0915 - CVSS 7.5 (high), 2006-02-28: Bugzilla 2.16.10 does not properly handle certain characters in the (1) maxpatchsize and (2) maxattachmentsize parameters in attachment.cgi, which allows…
• CVE-2006-0914 - CVSS 5.5 (medium), 2006-02-28: Bugzilla 2.16.10, 2.17 through 2.18.4, and 2.20 does not properly handle certain characters in the mostfreqthreshold parameter in duplicates.cgi, which allows…
• CVE-2006-0913 - CVSS 5.5 (medium), 2006-02-28: SQL injection vulnerability in whineatnews.pl in Bugzilla 2.17 through 2.18.4 and 2.20 allows remote authenticated users with administrative privileges to…
• CVE-2006-0916 - CVSS 7.5 (high), 2006-02-28: Bugzilla 2.19.3 through 2.20 does not properly handle "//" sequences in URLs when redirecting a user from the login form, which could cause it to generate a…
• CVE-2005-4534 - CVSS 7.5 (high), 2005-12-28: The shadow database feature (syncshadowdb) in Bugzilla 2.9 through 2.16.10 allows local users to overwrite arbitrary files via a symlink attack on temporary…
• CVE-2005-3139 - CVSS 5 (medium), 2005-10-05: Bugzilla 2.19.1 through 2.20rc2 and 2.21, with user matching turned on in substring mode, allows attackers to list all users whose names match an arbitrary…
• CVE-2005-3138 - CVSS 5 (medium), 2005-10-05: Bugzilla 2.18rc1 through 2.18.3, 2.19 through 2.20rc2, and 2.21 allows remote attackers to obtain sensitive information such as the list of installed products…
• CVE-2005-2174 - CVSS 2.6 (low), 2005-07-08: Bugzilla 2.17.x, 2.18 before 2.18.2, 2.19.x, and 2.20 before 2.20rc1 inserts a bug into the database before it is marked private, which introduces a race…
• CVE-2005-2173 - CVSS 5 (medium), 2005-07-08: The Flag::validate and Flag::modify functions in Bugzilla 2.17.1 to 2.18.1 and 2.19.1 to 2.19.3 do not verify that the flag ID is appropriate for the given…
• CVE-2005-1563 - CVSS 5 (medium), 2005-05-14: Bugzilla 2.10 through 2.18, 2.19.1, and 2.19.2 displays a different error message depending on whether a product exists or not, which allows remote attackers…
• CVE-2005-1564 - CVSS 7.5 (high), 2005-05-12: post_bug.cgi in Bugzilla 2.10 through 2.18, 2.19.1, and 2.19.2 allows remote authenticated users to "enter bugs into products that are closed for bug entry"…
• CVE-2005-1565 - CVSS 5 (medium), 2005-05-12: Bugzilla 2.17.1 through 2.18, 2.19.1, and 2.19.2, when a user is prompted to log in while attempting to view a chart, displays the password in the URL, which…