CVE-2004-0706

Bugzilla 2.17.5 through 2.17.7 embeds the password in an image URL, which could allow local users to view the password in the web server log files...

CVE-2004-0705

Multiple cross-site scripting XSS vulnerabilities in 1 editcomponents.cgi, 2 editgroups.cgi, 3 editmilestones.cgi, 4 editproducts.cgi, 5 editusers.cgi, and 6 editversions.cgi in Bugzilla 2.16.x before 2.16.6, and 2.18 before 2.18rc1, allow remote attackers to execute arbitrary JavaScript as other...

Bugzilla < 2.16.6 / 2.18rc1 Multiple Vulnerabilities (XSS, SQLi, Priv Esc, more)

The remote Bugzilla bug tracking system, according to its version number, is vulnerable to various flaws : - An administrator may be able to execute arbitrary SQL commands on the remote host. - There are instances of information leaks that may let an attacker know the database password under...

[BUGZILLA] Multiple vulnerabilities in Bugzilla 2.16.5 and 2.17.7

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Bugzilla Security Advisory July 10, 2004 Summary ======= Bugzilla is a Web-based bug-tracking system, used by a large number of software projects. This advisory covers security bugs that have recently been discovered and fixed in the Bugzilla code: In...

Bugzilla < 2.16.4 / 2.17.5 Multiple Vulnerabilities (SQLi, ID)

According to its version number, the remote Bugzilla bug tracker is vulnerable to various flaws that could let a privileged user execute arbitrary SQL commands on this host, which could allow an attacker to obtain information about bugs marked as being confidential. %NASLMINLEVEL 70300 C Tenable...

CVE-2003-0602

Multiple cross-site scripting vulnerabilities XSS in Bugzilla 2.16.x before 2.16.3 and 2.17.x before 2.17.4 allow remote attackers to insert arbitrary HTML or web script via 1 multiple default German and Russian HTML templates or 2 ALT and NAME attributes in AREA tags as used by the GraphViz grap...

Bugzilla < 2.16.3 / 2.17.4 Multiple Vulnerabilities (XSS, Symlink)

The remote Bugzilla bug tracking system, according to its version number, contains various flaws that may let an attacker perform cross- site scripting attacks or even delete local files provided he has an account on the remote host. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. Ref: Date:...

CVE-2002-0809

Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, does not properly handle URL-encoded field names that are generated by some browsers, which could cause certain fields to appear to be unset, which has the effect of removing group permissions on bugs when buglist.cgi is provided with the...

CVE-2002-0810

Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, directs error messages from the syncshadowdb command to the HTML output, which could leak sensitive information, including plaintext passwords, if syncshadowdb fails...

CVE-2002-0805

Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, 1 creates new directories with world-writable permissions, and 2 creates the params file with world-writable permissions, which allows local users to modify the files and execute code...

Bugzilla < 2.14.2 / 2.16rc2 / 2.17 Multiple Vulnerabilities (SQLi, XSS, ID, Cmd Exe)

According to its version number, the remote Bugzilla bug tracking system is vulnerable to various flaws, including SQL injection, cross-site scripting, and arbitrary command execution. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...

[SECURITY] [DSA 230-1] New bugzilla packages fix unauthorized data modification

-------------------------------------------------------------------------- Debian Security Advisory DSA 230-1 [email protected] http://www.debian.org/security/ Martin Schulze January 16th, 2003 http://www.debian.org/security/faq -...

CVE-2002-1196

editproducts.cgi in Bugzilla 2.14.x before 2.14.4, and 2.16.x before 2.16.1, when the "usebuggroups" feature is enabled and more than 47 groups are specified, does not properly calculate bit values for large numbers, which grants extra permissions to users via known features of Perl math that set...

CVE-2001-1402

Bugzilla before 2.14 does not properly escape untrusted parameters, which could allow remote attackers to conduct unauthorized activities via cross-site scripting CSS and possibly SQL injection attacks on 1 the product or output form variables for reports.cgi, 2 the voteon, bugid, and user...

CVE-2002-0805

Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, 1 creates new directories with world-writable permissions, and 2 creates the params file with world-writable permissions, which allows local users to modify the files and execute code...

CVE-2002-0010

Bugzilla before 2.14.1 allows remote attackers to inject arbitrary SQL code and create files or gain privileges via 1 the sql parameter in buglist.cgi, 2 invalid field names from the "boolean chart" query in buglist.cgi, 3 the mybugslink parameter in userprefs.cgi, 4 a malformed bug ID in the...

CVE-2001-1402

Bugzilla before 2.14 does not properly escape untrusted parameters, which could allow remote attackers to conduct unauthorized activities via cross-site scripting CSS and possibly SQL injection attacks on 1 the product or output form variables for reports.cgi, 2 the voteon, bugid, and user...