Bugzilla < 4.0.14 / 4.2.10 / 4.4.5 / 4.5.5 CSRF Vulnerability

According to its banner, the version of Bugzilla installed on the remote host contains a flaw in its callback APIs in which data is not properly sanitized before being submitted to the 'jsonrpc.cgi' script. Using a specially crafted OBJECT element with SWF content, a remote attacker could perform...

CVE-2012-0466

template/en/default/list/list.js.tmpl in Bugzilla 2.x and 3.x before 3.6.9, 3.7.x and 4.0.x before 4.0.6, and 4.1.x and 4.2.x before 4.2.1 does not properly handle multiple logins, which allows remote attackers to conduct cross-site scripting XSS attacks and obtain sensitive bug information via a...

PT-2012-2587

Name of the Vulnerable Software and Affected Versions Bugzilla versions 2.x through 3.6.8 Bugzilla versions 3.7.x Bugzilla version 4.0.x through 4.0.5 Bugzilla version 4.1.x Bugzilla version 4.2.x through 4.2.0 Description The issue allows remote attackers to conduct cross-site scripting XSS...