CVE-2008-4437

CVE-2008-4437 describes a directory traversal vulnerability in Bugzilla’s importxml.pl when --attach_path is enabled. It affects Bugzilla versions before 2.22.5 and 3.x before 3.0.5, allowing a remote attacker to read arbitrary files by placing a .. in the data element of an XML file. The issue’s...

CVE-2008-2103

CVE-2008-2103 describes a cross-site scripting (XSS) vulnerability in Bugzilla 2.17.2 and later, allowing remote attackers to inject arbitrary script/HTML via the id parameter in the Format for Printing and Long Format bug views. Connected sources confirm vendor advisories and OpenVAS/Nessus entr...

CVE-2008-2105

CVE-2008-2105 affects Bugzilla: vulnerable in Bugzilla 2.23.4 and 3.0.x before 3.0.4, and 3.1.x before 3.1.4. A remote authenticated user can abuse the @reporter command in the body of an email to spoof the bug changer, overriding the address from the From header. This bypasses normal From-header...

CVE-2008-2104

The CVE-2008-2104 entry concerns Bugzilla 3.1.3’s WebService: remote authenticated users lacking canconfirm privileges can create NEW or ASSIGNED bug entries via XML-RPC, bypassing the canconfirm check. The connected documents confirm the affected product/version and the bypass directly enabling ...