SUSE CVE-2011-3669

Cross-site request forgery CSRF vulnerability in attachment.cgi in Bugzilla 2.x, 3.x, and 4.x before 4.2rc1 allows remote attackers to hijack the authentication of arbitrary users for requests that upload attachments...

SUSE CVE-2013-1734

Cross-site request forgery CSRF vulnerability in attachment.cgi in Bugzilla 2.x, 3.x, and 4.0.x before 4.0.11; 4.1.x and 4.2.x before 4.2.7; and 4.3.x and 4.4.x before 4.4.1 allows remote attackers to hijack the authentication of arbitrary users for requests that commit an attachment change via a...

CVE-2013-1734

CVE-2013-1734 is a CSRF vulnerability in Bugzilla's attachment.cgi that allows remote attackers to hijack user authentication for requests that modify an attachment via an update action. Affected products/versions include Bugzilla 2.x, 3.x, and 4.0.x before 4.0.11; 4.1.x and 4.2.x before 4.2.7; a...

CVE-2013-1734: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in attachment.cgi in Bugzilla 2.x, 3.x, and 4.0.x before 4.0.11; 4.1.x and 4.2.x before 4.2.7; and 4.3.x and 4.4.x before 4.4.1 allows remote attackers to hijack the authentication of arbitrary users for requests that commit an attachment change via a...

CVE-2012-4197

CVE-2012-4197 affects Bugzilla’s Attachment.pm in attachment.cgi, allowing remote attackers to read attachment descriptions from private bugs via an obsolete=1 insert action. Affected: Bugzilla 2.x/3.x before 3.6.12, 3.7.x, 4.0.x before 4.0.9, 4.1.x/4.2.x before 4.2.4, and 4.3.x/4.4.x before 4.4r...

CVE-2011-3669

CVE-2011-3669 : CSRF vulnerability in Bugzilla’s attachment.cgi permits remote attackers to hijack the authentication of arbitrary users when uploading attachments. Affected software: Bugzilla 2.x, 3.x, and 4.x prior to 4.2rc1. Root cause: cross-site request forgery on the attachment upload path....

CVE-2011-3669: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in attachment.cgi in Bugzilla 2.x, 3.x, and 4.x before 4.2rc1 allows remote attackers to hijack the authentication of arbitrary users for requests that upload attachments...

CVE-2009-1213: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in attachment.cgi in Bugzilla 3.2 before 3.2.3, 3.3 before 3.3.4, and earlier versions allows remote attackers to hijack the authentication of arbitrary users for requests that use attachment editing...

Bugzilla 'attachment.cgi' Cross Site Request Forgery Vulnerability

Bugzilla is prone to a cross-site request-forgery vulnerability. An attacker can exploit this issue to submit attachments in the context of the logged-in user. This issue affects versions prior to Bugzilla 3.2.3 and 3.3.4. OpenVAS Vulnerability Test $Id: bugzilla34308.nasl 4574 2016-11-18 13:36:5...

CVE-2006-5454: Undefined Security Weakness

Bugzilla 2.18.x before 2.18.6, 2.20.x before 2.20.3, 2.22.x before 2.22.1, and 2.23.x before 2.23.3 allow remote attackers to obtain 1 the description of arbitrary attachments by viewing the attachment in "diff" mode in attachment.cgi, and 2 the deadline field by viewing the XML format of the bug...

CVE-2006-0915

Bugzilla 2.16.10 does not properly handle certain characters in the 1 maxpatchsize and 2 maxattachmentsize parameters in attachment.cgi, which allows remote attackers to trigger a SQL error...

Sql injection

Bugzilla 2.16.10 does not properly handle certain characters in the 1 maxpatchsize and 2 maxattachmentsize parameters in attachment.cgi, which allows remote attackers to trigger a SQL error...

CVE-2006-0915: Undefined Security Weakness

Bugzilla 2.16.10 does not properly handle certain characters in the 1 maxpatchsize and 2 maxattachmentsize parameters in attachment.cgi, which allows remote attackers to trigger a SQL error...