CVE-2014-1572

CVE-2014-1572 affects Bugzilla 2.x through 4.5.x where confirm_create_account in token.cgi does not enforce scalar context for the realname parameter. This allows remote attackers to create accounts with unverified e-mail addresses by sending three realname values, with realname=login_name as the...

CVE-2014-1571

Bugzilla is affected in multiple lines: vulnerable components are Bugzilla versions 2.x–4.0.x (pre-4.0.15), 4.1.x, 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6. The flaw allows remote authenticated users to obtain sensitive private-comment information by abusing a rol...

CVE-2014-1546

The CVE-2014-1546 issue affects Bugzilla’s JSONP endpoint (jsonrpc.cgi) in Bugzilla 3.x and 4.x prior to the listed fixed versions (before 4.0.14, 4.2.10 for 4.2.x, 4.4.5 for 4.3/4.4.x, and 4.5.5 for 4.5.x). The vulnerability stems from the JSONP response function in Bugzilla’s JSONRPC.pm, which ...

CVE-2014-1517

CVE-2014-1517 corresponds to a login CSRF flaw in Bugzilla 2.x/3.x/4.x before 4.4.3 and 4.5.x before 4.5.3. Multiple security advisories (Mageia MGASA-2014-0200, OpenVAS entries, Fedora updates) indicate a fix was released in Bugzilla packages; apply the vendor patch/update to the affected system...

CVE-2014-1573

CVE-2014-1573 affects Bugzilla before fixes: 2.x–4.0.x before 4.0.15; 4.1.x and 4.2.x before 4.2.11; 4.3.x and 4.4.x before 4.4.6; and 4.5.x before 4.5.6. The issue arises from not ensuring scalar context for certain CGI parameters, enabling remote XSS via a single parameter name receiving three ...