21 matches found
EUVD-2009-0486
Malware in sbrugna...
EUVD-2004-1627
Malware in sbrugna...
Mozilla Bugzilla 2.4/2.6/2.8/2.10 Remote Arbitrary Command Execution
No description provided by source. source: http://www.securityfocus.com/bid/1199/info Bugzilla is a web-based bug-tracking system based on Perl and MySQL. It allows people to submit bugs and catalogs them. Bugzilla is prone to a vulnerability which may allow remote users to execute arbitrary...
CVE-2013-1733: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in processbug.cgi in Bugzilla 4.4.x before 4.4.1 allows remote attackers to hijack the authentication of arbitrary users for requests that modify bugs via vectors involving a midair-collision token...
CVE-2009-0482
Cross-site request forgery CSRF vulnerability in Bugzilla before 3.2 before 3.2.1, 3.3 before 3.3.2, and other versions before 3.2 allows remote attackers to perform bug updating activities as other users via a link or IMG tag to processbug.cgi...
CVE-2009-0482
Cross-site request forgery CSRF vulnerability in Bugzilla before 3.2 before 3.2.1, 3.3 before 3.3.2, and other versions before 3.2 allows remote attackers to perform bug updating activities as other users via a link or IMG tag to processbug.cgi...
CVE-2009-0482: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in Bugzilla before 3.2 before 3.2.1, 3.3 before 3.3.2, and other versions before 3.2 allows remote attackers to perform bug updating activities as other users via a link or IMG tag to processbug.cgi...
Bugzilla remote arbitrary command execution
The remote Bugzilla bug tracking system, according to its version number, is vulnerable to arbitrary commands execution flaws due to a lack of sanitization of user-supplied data in processbug.cgi SPDX-FileCopyrightText: 2004 David Maciejak Some text descriptions might be excerpted from a referenc...
CVE-2005-2173
Bugzilla CVE-2005-2173 affects versions 2.17.1–2.18.1 and 2.19.1–2.19.3, where Flag::validate and Flag::modify do not verify that the flag ID matches the target bug or attachment. This permits changing flags on arbitrary bugs and obtaining a bug summary via process_bug.cgi, exposing information. ...
CVE-2005-2173: Undefined Security Weakness
The Flag::validate and Flag::modify functions in Bugzilla 2.17.1 to 2.18.1 and 2.19.1 to 2.19.3 do not verify that the flag ID is appropriate for the given bug or attachment ID, which allows users to change flags on arbitrary bugs and obtain a bug summary via processbug.cgi...
CVE-2004-1633
The CVE-2004-1633 issue affects Bugzilla 2.9 through 2.18rc2 and 2.19 from CVS, where process_bug.cgi does not enforce edit permissions on the keywords field. An authenticated remote user can modify a bug’s keywords via the keywordaction parameter. The connection documents confirm the vulnerable ...
CVE-2004-1633: Undefined Security Weakness
processbug.cgi in Bugzilla 2.9 through 2.18rc2 and 2.19 from CVS does not check edit permissions on the keywords field, which allows remote authenticated users to modify the keywords in a bug via the keywordaction parameter...
CVE-2001-1406
CVE-2001-1406 affects Bugzilla prior to 2.14. The vulnerability occurs when moving a bug between product groups, where the groupset flag is not updated, causing the bug to retain the old group’s (potentially less stringent) restrictions. This is a local issue with low public impact per the CVSS v...
CVE-2001-1406: Undefined Security Weakness
processbug.cgi in Bugzilla before 2.14 does not set the "groupset" bit when a bug is moved between product groups, which will cause the bug to have the old group's restrictions, which might not be as stringent...
CVE-2001-1402
Bugzilla before 2.14 does not properly escape untrusted parameters, which could allow remote attackers to conduct unauthorized activities via cross-site scripting CSS and possibly SQL injection attacks on 1 the product or output form variables for reports.cgi, 2 the voteon, bugid, and user...
CVE-2001-1401: Undefined Security Weakness
Bugzilla before 2.14 does not properly restrict access to confidential bugs, which could allow Bugzilla users to bypass viewing permissions via modified bug id parameters in 1 processbug.cgi, 2 showactivity.cgi, 3 showvotes.cgi, 4 showdependencytree.cgi, 5 showdependencygraph.cgi, 6...
CVE-2002-0008: Undefined Security Weakness
Bugzilla before 2.14.1 allows remote attackers to 1 spoof a user comment via an HTTP request to processbug.cgi using the "who" parameter, instead of the Bugzillalogin cookie, or 2 post a bug as another user by modifying the reporter parameter to enterbug.cgi, which is passed to postbug.cgi...
CVE-2001-0329: Undefined Security Weakness
Bugzilla 2.10 allows remote attackers to execute arbitrary commands via shell metacharacters in a username that is then processed by 1 the Bugzillalogin cookie in postbug.cgi, or 2 the who parameter in processbug.cgi...
CVE-2000-0421
The CVE-2000-0421 entry corresponds to a vulnerability in Bugzilla where the process_bug.cgi script fails to sanitize user-supplied data, enabling remote arbitrary command execution. Technical documentation from connected sources confirms this flaw affects Bugzilla’s remote command execution via ...