CVE-2007-4543

CVE-2007-4543 is a cross-site scripting (XSS) vulnerability in Bugzilla. According to the provided sources, it affects the bug filing form in Bugzilla’s guided form via the buildid parameter. A remote attacker could inject arbitrary script/HTML, enabling credential theft or session compromise. Af...

CVE-2007-4538

CVE-2007-4538 affects Bugzilla 2.23.4–3.0.0 via the email_in.pl path. The vulnerability arises when using Email::Send::Sendmail with the -f From address, enabling remote attackers to inject shell metacharacters and execute arbitrary commands. Exploitation is described in multiple sources (includi...

CVE-2007-0791

CVE-2007-0791 is a cross-site scripting (XSS) vulnerability in Bugzilla’s Atom feeds affecting Bugzilla versions 2.20.3, 2.22.1, 2.23.3, and older releases back to 2.20.1. The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors within Atom feeds. The conne...

CVE-2002-2260

Vulnerability context (CVE-2002-2260) : Mozilla Bugzilla's quips feature is affected in versions 2.10–2.17, where an XSS vulnerability exists that lets remote attackers inject arbitrary script/HTML via the “show all quips” page. Several connected sources (including Debian’s DSA-218-1 and OpenVAS ...

CVE-2007-5038

CVE-2007-5038 affects Bugzilla WebService: offer_account_by_email in User.pm does not validate the createemailregexp parameter, permitting remote creation of accounts that would be denied by the email regexp. Affected versions are Bugzilla before 3.0.2 and 3.1.x before 3.1.2. Exploitation would b...

CVE-2007-0792

The CVE-2007-0792 entry describes a vulnerability in Bugzilla 2.23.3 where the mod_perl initialization script fails to set the Bugzilla Apache configuration to permit .htaccess overrides of file permissions. This allows remote attackers to directly request the localconfig file and obtain the data...

CVE-2007-4539

CVE-2007-4539 concerns Bugzilla’s WebService (XML-RPC) interface. Affected product versions are Bugzilla 2.23.3 through 3.0.0. The root cause is that the XML-RPC interface does not enforce permissions for the time-tracking fields of bugs, enabling a remote attacker to obtain sensitive information...