CVE-2009-3166

token.cgi in Bugzilla 3.4rc1 through 3.4.1 places a password in a URL at the beginning of a login session that occurs immediately after a password reset, which allows context-dependent attackers to discover passwords by reading 1 web-server access logs, 2 web-server Referer logs, or 3 the browser...

CVE-2009-3166

Bugzilla 3.4rc1–3.4.1 vulnerability: token.cgi places a password in the login URL after a reset, allowing context-dependent attackers to obtain passwords via web server access logs, Referer logs, or browser history. The provided documents confirm Bugzilla involvement and CVE-2009-3166, but do not...

Bugzilla 'show_bug.cgi' Information Disclosure Vulnerability

Bugzilla is prone to an information-disclosure vulnerability. Successful exploits will allow authenticated attackers to obtain potentially sensitive information that may aid in further attacks. The following are vulnerable: Bugzilla 3.3.4, 3.4rc1, and 3.4. OpenVAS Vulnerability Test $Id:...