CVE-2009-0481

The CVE-2009-0481 issue affects Bugzilla 2.x (before 2.22.7), 3.0 (before 3.0.7), 3.2 (before 3.2.1), and 3.3 (before 3.3.2). It allows remote authenticated users to perform cross-site scripting by uploading HTML/JavaScript attachments that are rendered by browsers. The NVD CVSSv2 score is 3.5 (L...

CVE-2009-3165

CVE-2009-3165 is a SQL injection vulnerability affecting Bugzilla 2.23.4–3.0.8, 3.1.1–3.2.4, and 3.3.1–3.4.1 via Bug.create WebService parameters, enabling remote arbitrary SQL execution. Connected advisories confirm impact and remediation guidance, notably Gentoo GLSA 2010-06-19 recommending upg...

CVE-2009-3166

Bugzilla 3.4rc1–3.4.1 vulnerability: token.cgi places a password in the login URL after a reset, allowing context-dependent attackers to obtain passwords via web server access logs, Referer logs, or browser history. The provided documents confirm Bugzilla involvement and CVE-2009-3166, but do not...

CVE-2009-3386

The CVE-2009-3386 vulnerability affects Bugzilla versions 3.3.2–3.4.3 and 3.5–3.5.1, where Template.pm allows an attacker to remotely read the alias of a private bug by inspecting the Related Bug fields (Depends On or Blocks). The underlying issue is an information-disclosure path in Bugzilla’s t...

CVE-2009-0485

CVE-2009-0485 is a CSRF vulnerability in Bugzilla affecting 2.17–2.22.7, 3.0 before 3.0.7, 3.2 before 3.2.1, and 3.3 before 3.3.2. An attacker can cause deletion of unused flag types by delivering a crafted link or IMG tag to editflagtypes.cgi. The root cause is CSRF without sufficient user inter...

CVE-2009-1213

Bugzilla CSRF: CVE-2009-1213 is a vulnerability in attachment.cgi that affects Bugzilla 3.2 before 3.2.3 and 3.3 before 3.3.4 (and earlier versions). The flaw allows remote attackers to hijack a user’s authenticated session when performing attachment editing, via Cross‑Site Request Forgery. Impac...

CVE-2009-0484

CVE-2009-0484 is a CSRF vulnerability in Bugzilla that allows remote attackers to delete shared or saved searches via a crafted link or IMG tag to buglist.cgi. Affected are Bugzilla 3.0.x before 3.0.7, 3.2.x before 3.2.1, and 3.3.x before 3.3.2. The underlying issue is cross-site request forgery ...

CVE-2009-0486

CVE-2009-0486 (Bugzilla) affects Bugzilla 3.2.1, 3.0.7, and 3.3.2 when run under mod_perl, where startup srand seeds produce identical pseudorandom numbers for tokens, allowing remote attackers to bypass CSRF protections and perform actions as other users. The vulnerability is documented with a b...

CVE-2009-3125

CVE-2009-3125 : Bugzilla 3.3.2–3.4.1 and 3.5 are affected by an SQL injection in the Bug.search WebService, allowing remote attackers to execute arbitrary SQL via unspecified parameters. The issue is within Bugzilla’s web service layer and is tied to untrusted input used in SQL queries. Several c...

CVE-2008-6098

CVE-2008-6098 affects Bugzilla variants (e.g., Bugzilla 3.2 before 3.2 RC2, 3.0 before 3.0.6, 2.22 before 2.22.6, 2.20 before 2.20.7, and related versions). The vulnerability lets remote authenticated users bypass moderation to approve/disapprove quips via a direct request to quips.cgi with actio...

CVE-2009-0483

CVE-2009-0483 describes a Cross-site request forgery (CSRF) vulnerability in Bugzilla versions 2.22 before 2.22.7, 3.0 before 3.0.7, 3.2 before 3.2.1, and 3.3 before 3.3.2. The flaw allows remote attackers to delete keywords and user preferences by delivering a crafted link or IMG tag to editkeyw...

CVE-2009-0482

CVE-2009-0482 is a CSRF vulnerability in Bugzilla affecting versions before 3.2.1, before 3.2. for 3.2-era, and 3.3 before 3.3.2, enabling remote attackers to perform bug-updating actions as other users via a crafted link or IMG tag to process_bug.cgi. Public references in the connected documents...