EUVD-2002-0801

Malware in sbrugna...

CVE-2011-0046: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 allow remote attackers to hijack the authentication of arbitrary users for requests related to 1 adding a saved search in buglist.cgi, 2 voting in...

CVE-2009-0484

Cross-site request forgery CSRF vulnerability in Bugzilla 3.0 before 3.0.7, 3.2 before 3.2.1, and 3.3 before 3.3.2 allows remote attackers to delete shared or saved searches via a link or IMG tag to buglist.cgi...

CVE-2009-0484

Cross-site request forgery CSRF vulnerability in Bugzilla 3.0 before 3.0.7, 3.2 before 3.2.1, and 3.3 before 3.3.2 allows remote attackers to delete shared or saved searches via a link or IMG tag to buglist.cgi...

CVE-2009-0484

CVE-2009-0484 is a CSRF vulnerability in Bugzilla that allows remote attackers to delete shared or saved searches via a crafted link or IMG tag to buglist.cgi. Affected are Bugzilla 3.0.x before 3.0.7, 3.2.x before 3.2.1, and 3.3.x before 3.3.2. The underlying issue is cross-site request forgery ...

CVE-2009-0484: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in Bugzilla 3.0 before 3.0.7, 3.2 before 3.2.1, and 3.3 before 3.3.2 allows remote attackers to delete shared or saved searches via a link or IMG tag to buglist.cgi...

CVE-2005-2174

Bugzilla 2.17.x, 2.18 before 2.18.2, 2.19.x, and 2.20 before 2.20rc1 inserts a bug into the database before it is marked private, which introduces a race condition and allows attackers to access information about the bug via buglist.cgi before MySQL replication is complete...

CVE-2005-2174

CVE-2005-2174 concerns Bugzilla where Bugzilla 2.17.x, 2.18 before 2.18.2, 2.19.x, and 2.20 before 2.20rc1 insert bugs before they are private, enabling a race condition that can expose bug details via buglist.cgi before MySQL replication completes. Connected references corroborate the flaw and i...

CVE-2005-2174: Undefined Security Weakness

Bugzilla 2.17.x, 2.18 before 2.18.2, 2.19.x, and 2.20 before 2.20rc1 inserts a bug into the database before it is marked private, which introduces a race condition and allows attackers to access information about the bug via buglist.cgi before MySQL replication is complete...

CVE-2004-0704: Undefined Security Weakness

Unknown vulnerability in 1 duplicates.cgi and 2 buglist.cgi in Bugzilla 2.16.x before 2.16.6, 2.18 before 2.18rc1, when configured to hide products, allows remote attackers to view hidden products...

CVE-2002-0809: Undefined Security Weakness

Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, does not properly handle URL-encoded field names that are generated by some browsers, which could cause certain fields to appear to be unset, which has the effect of removing group permissions on bugs when buglist.cgi is provided with the...

CVE-2001-1402

Bugzilla before 2.14 does not properly escape untrusted parameters, which could allow remote attackers to conduct unauthorized activities via cross-site scripting CSS and possibly SQL injection attacks on 1 the product or output form variables for reports.cgi, 2 the voteon, bugid, and user...

CVE-2002-0811: Undefined Security Weakness

Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, may allow remote attackers to cause a denial of service or execute certain queries via a SQL injection attack on the sort order parameter to buglist.cgi...

CVE-2002-0010: Undefined Security Weakness

Bugzilla before 2.14.1 allows remote attackers to inject arbitrary SQL code and create files or gain privileges via 1 the sql parameter in buglist.cgi, 2 invalid field names from the "boolean chart" query in buglist.cgi, 3 the mybugslink parameter in userprefs.cgi, 4 a malformed bug ID in the...