CVE-2016-2803

CVE-2016-2803 is a cross-site scripting vulnerability in Bugzilla’s dependency graphs affecting versions 2.16rc1–4.4.11 and 4.5.1–5.0.2. The issue allows remote attackers to inject arbitrary web script or HTML. OpenVAS and Fedora advisories confirm the bug is exploitable via the Bugzilla dependen...

CVE-2013-1734

CVE-2013-1734 is a CSRF vulnerability in Bugzilla's attachment.cgi that allows remote attackers to hijack user authentication for requests that modify an attachment via an update action. Affected products/versions include Bugzilla 2.x, 3.x, and 4.0.x before 4.0.11; 4.1.x and 4.2.x before 4.2.7; a...

CVE-2011-0046

CVE-2011-0046 affects Bugzilla prior to 3.2.10, 3.4.x prior to 3.4.10, 3.6.x prior to 3.6.4, and 4.0.x prior to 4.0rc2, enabling CSRF to hijack user authentication for actions such as adding saved searches, voting, sanity checks, charting, column changes, and quips. Public sources in the connecte...

CVE-2014-8630

CVE-2014-8630 affects Bugzilla versions across 4.0.x to 5.x before specific fixed points. The underlying issue is a command injection via a two-argument Perl open call when a crafted input is given in a product name, exploitable by remote authenticated users with editcomponents privilege. Impact ...

CVE-2003-0602

CVE-2003-0602 affects Bugzilla 2.16.x up to 2.16.2 and 2.17.x up to 2.17.3, where remote attackers could inject arbitrary HTML or script. The flaws are in two vectors: (1) default German/Russian HTML templates, and (2) ALT and NAME attributes in AREA tags used by GraphViz-based local dependency g...

CVE-2013-1733

CVE-2013-1733 affects Bugzilla 4.4.x prior to 4.4.1. A CSRF flaw in process_bug.cgi enables remote attackers to hijack a user’s session to modify bugs via requests authenticated with a midair-collision token. CVSSv2 base score 6.8 (AV:N/AC:M/Au:N/C:P/I:P/A:P). Remediation: upgrade to Bugzilla 4.4...

CVE-2009-1213

Bugzilla CSRF: CVE-2009-1213 is a vulnerability in attachment.cgi that affects Bugzilla 3.2 before 3.2.3 and 3.3 before 3.3.4 (and earlier versions). The flaw allows remote attackers to hijack a user’s authenticated session when performing attachment editing, via Cross‑Site Request Forgery. Impac...

CVE-2011-3669

CVE-2011-3669 : CSRF vulnerability in Bugzilla’s attachment.cgi permits remote attackers to hijack the authentication of arbitrary users when uploading attachments. Affected software: Bugzilla 2.x, 3.x, and 4.x prior to 4.2rc1. Root cause: cross-site request forgery on the attachment upload path....

CVE-2011-3667

CVE-2011-3667 affects Bugzilla 2.x and 3.x before 3.4.13, 3.5.x and 3.6.x before 3.6.7, 3.7.x and 4.0.x before 4.0.3, and 4.1.x through 4.1.3. The root cause is that when createemailregexp is not empty, Bugzilla does not properly apply the user_can_create_account setting, allowing remote attacker...

CVE-2010-2757

CVE-2010-2757 describes a vulnerability in Bugzilla where the sudo feature fails to send impersonation notifications, enabling remote authenticated users to impersonate other users without discovery. The description lists affected Bugzilla releases across multiple branches (2.22rc1–3.2.7, 3.3.1–3...

CVE-2011-3668

The CVE-2011-3668 entry describes a cross-site request forgery (CSRF) in Bugzilla’s post_bug.cgi function affecting Bugzilla 2.x, 3.x, and 4.x prior to 4.2rc1. Exploitation would allow remote attackers to hijack the authentication of arbitrary users to perform actions that create bug reports. The...