CVE-2006-5453

CVE-2006-5453 affects Bugzilla 2.18.x before 2.18.6, 2.20.x before 2.20.3, 2.22.x before 2.22.1, and 2.23.x before 2.23.3. The description cites multiple cross-site scripting (XSS) vulnerabilities allowing remote authenticated users to inject arbitrary web script or HTML via: (1) page headers in ...

CVE-2006-0913

CVE-2006-0913 describes an SQL injection in the Bugzilla component for the web front end. The vulnerability affects Bugzilla versions 2.17 through 2.18.4 and 2.20, where remote authenticated users with administrative privileges can exploit the flaw via the whinedays parameter exposed from editpar...

CVE-2006-5455

CVE-2006-5455 is a CSRF vulnerability in Bugzilla’s editversions.cgi that allows user-assisted remote attackers to create, modify, or delete arbitrary bug reports via a crafted URL. Affected releases are Bugzilla versions before 2.22.1 and 2.23.x before 2.23.3. The root cause is insufficient CSRF...

CVE-2006-0914

The CVE-2006-0914 entry affects Bugzilla versions 2.16.10, 2.17 through 2.18.4, and 2.20. The vulnerability arises because character handling in the mostfreqthreshold parameter within duplicates.cgi is insufficient, allowing remote attackers to trigger a SQL error. This is documented across multi...

CVE-2006-0915

CVE-2006-0915 concerns Bugzilla 2.16.10, where the application does not properly handle certain characters in the attachments parameters (maxpatchsize and maxattachmentsize) in attachment.cgi. This improper input handling can cause a remote SQL error, per the NVD description. The connected docume...

CVE-2006-0916

Bugzilla 2.19.3 through 2.20 contains a URL handling flaw during login redirects: sequences like // can cause a form action to be built with a URL to a different domain, potentially exposing form data to an unintended site. This is documented in multiple connected sources (e.g., PRION entry and N...

CVE-2006-5454

CVE-2006-5454 affects Bugzilla: versions 2.18.x before 2.18.6, 2.20.x before 2.20.3, 2.22.x before 2.22.1, and 2.23.x before 2.23.3. The vulnerability allows remote attackers to (1) obtain the description of arbitrary attachments by viewing an attachment in diff mode (attachment.cgi), and (2) rea...

CVE-2006-2420

CVE-2006-2420 affects Bugzilla 2.20rc1 through 2.20 and 2.21.1 when using RSS 1.0, enabling remote XSS via a title element containing HTML-encoded sequences (e.g., ">") that are decoded by some RSS readers. The issue is described as stemming from RSS design/documentation inconsistencies or RSS...