Mozilla Bugzilla时间追踪功能信息泄露漏洞

BUGTRAQ ID: 41141 CVE ID: CVE-2010-1204 Bugzilla是很多软件项目都在使用的基于Web的BUG跟踪系统。 正常情况下有关时间追踪（估计时间、实际时间、已工作时间、截止日期等）的信息应仅限于time-tracking组中的用户可访问，但用户可以通过创建搜索URL使用上述字段搜索bug。如果bug匹配到了搜索，就可以获取有关时间追踪的敏感信息。 Mozilla Bugzilla 3.x Mozilla Bugzilla 2.x 厂商补丁： Mozilla ------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

bugzilla -- information disclosure

A Bugzilla Security Advisory reports: Normally, information about time-tracking estimated hours, actual hours, hours worked, and deadlines is restricted to users in the "time-tracking group". However, any user was able, by crafting their own search URL, to search for bugs based using those fields...

Zen Time Tracking multiple SQL Injection vulnerabilities

Zen Time Tracking is prone to multiple SQL Injection vulnerabilities. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2010-1053

Multiple SQL injection vulnerabilities in Zen Time Tracking 2.2 and earlier, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 password parameters to a userlogin.php and b managerlogin.php. NOTE: some of these details are obtained...

Sql injection

Multiple SQL injection vulnerabilities in Zen Time Tracking 2.2 and earlier, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 password parameters to a userlogin.php and b managerlogin.php. NOTE: some of these details are obtained...

CVE-2010-1053

Multiple SQL injection vulnerabilities in Zen Time Tracking 2.2 and earlier, when magicquotesgpc is disabled, allow remote attackers to execute arbitrary SQL commands via the 1 username and 2 password parameters to a userlogin.php and b managerlogin.php. NOTE: some of these details are obtained...

CVE-2010-1053

CVE-2010-1053 affects Zen Time Tracking 2.2 and earlier. The vulnerability arises from multiple SQL injection flaws in login paths (userlogin.php and managerlogin.php) where the input parameters (username, password) can be exploited when magic_quotes_gpc is disabled. This allows remote attackers ...

Zen Time Tracking 2.2 - Multiple SQL Injections

Zen Time Tracking 2.2 - Multiple SQL Injections source: https://www.securityfocus.com/bid/38153/info Zen Time Tracking is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting these issues could all...

GLSA-200709-18 : Bugzilla: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200709-18 Bugzilla: Multiple vulnerabilities Masahiro Yamada found that from the 2.17.1 version, Bugzilla does not properly sanitize the content of the 'buildid' parameter when filing bugs CVE-2007-4543. The next two vulnerabiliti...

CVE-2007-4539

The WebService XML-RPC interface in Bugzilla 2.23.3 through 3.0.0 does not enforce permissions for the time-tracking fields of bugs, which allows remote attackers to obtain sensitive information via certain XML-RPC requests, as demonstrated by the 1 Deadline and 2 Estimated Time fields...

CVE-2007-4539

The WebService XML-RPC interface in Bugzilla 2.23.3 through 3.0.0 does not enforce permissions for the time-tracking fields of bugs, which allows remote attackers to obtain sensitive information via certain XML-RPC requests, as demonstrated by the 1 Deadline and 2 Estimated Time fields...

CVE-2007-4539

The WebService XML-RPC interface in Bugzilla 2.23.3 through 3.0.0 does not enforce permissions for the time-tracking fields of bugs, which allows remote attackers to obtain sensitive information via certain XML-RPC requests, as demonstrated by the 1 Deadline and 2 Estimated Time fields...

bugzilla -- multiple vulnerabilities

A Bugzilla Security Advisory reports: This advisory covers three security issues that have recently been fixed in the Bugzilla code: A possible cross-site scripting XSS vulnerability when filing bugs using the guided form. When using emailin.pl, insufficiently escaped data may be passed to...

[ECHO_ADV_80$2007] Softerra Time-Assistant <= 6.2 (inc_dir) Remote File Inclusion Vulnerability

----------------------------------------------------------------------------------------- ECHOADV80$2007 Softerra Time-Assistant = 6.2 incdir Remote File Inclusion Vulnerability ----------------------------------------------------------------------------------------- Author : M.Hasran Addahroni...

Softerra Time-Assistant <= 6.2 (inc_dir) Remote File Inclusion Vuln

No description provided by source. \ /\ / | \ | / // / | | \ \ Y / | / / \ /\| /\ / / / / / .OR.ID ECHOADV80$2007 ----------------------------------------------------------------------------------------- ECHOADV80$2007 Softerra Time-Assistant = 6.2 incdir Remote File Inclusion Vulnerability...

Softerra Time-Assistant <= 6.2 (inc_dir) Remote File Inclusion Vuln

Exploit for unknown platform in category web applications =================================================================== Softerra Time-Assistant = 6.2 incdir Remote File Inclusion Vuln =================================================================== \ /\ \ / | \ \ | / \ // / | \ | \ \...

Softerra Time-Assistant 6.2 - inc_dir Remote File Inclusion

Softerra Time-Assistant 6.2 - incdir Remote File Inclusion \ /\ \ / | \ \ | / \ // / | \ | \ \ Y / | \ / / \ /| /\ / / / / / .OR.ID ECHOADV80$2007 ----------------------------------------------------------------------------------------- ECHOADV80$2007 Softerra Time-Assistant = 6.2 incdir...

Softerra Time-Assistant 6.2 - 'inc_dir' Remote File Inclusion

\ /\ \ / | \ \ | / \ // / | \ | \ \ Y / | \ / / \ /| /\ / / / / / .OR.ID ECHOADV80$2007 ----------------------------------------------------------------------------------------- ECHOADV80$2007 Softerra Time-Assistant = 6.2 incdir Remote File Inclusion Vulnerability...

[eVuln] Time Tracking Software Multiple Vulnerabilities

New eVuln Advisory: Time Tracking Software Multiple Vulnerabilities http://evuln.com/vulns/69/summary.html --------------------Summary---------------- eVuln ID: EV0069 CVE: CVE-2006-0689 CVE-2006-0690 CVE-2006-0691 Vendor: TTS Software Software: Time Tracking Software Sowtware's Web Site:...

TTS Software Time Tracking Software 3.0 - edituser.php Access Validation

TTS Software Time Tracking Software 3.0 - edituser.php Access Validation source: https://www.securityfocus.com/bid/16731/info Time Tracking Software is prone to an access-validation vulnerability. This issue is due the application's failure to limit access to administrative sections of the...