BU
Product
Bugzilla
145
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 1Medium 2Low 1
Watch
Add Bugzilla to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-5123 | 8.8 | Apr 29 | A third party website can access information available to a user with access to a restricted bug entry using the image generation in report.cgi in all Bugzilla versions prior to… Affected: before 4.4 |
| CVE-2016-2803 | 6.1 | Apr 12 | Cross-site scripting (XSS) vulnerability in the dependency graphs in Bugzilla 2.16rc1 through 4.4.11, and 4.5.1 through 5.0.2 allows remote attackers to inject arbitrary web… Affected: 2.2; 2.4; 2.6; 2.8; 2.9; 2.16; +34 more |
| CVE-2015-8508 | 4.7 | Jan 3 | Cross-site scripting (XSS) vulnerability in showdependencygraph.cgi in Bugzilla 2.x, 3.x, and 4.x before 4.2.16, 4.3.x and 4.4.x before 4.4.11, and 4.5.x and 5.0.x before 5.0.2,… Affected: 2.0; 2.2; 2.4; 2.6; 2.8; 2.10; +34 more |
| CVE-2015-8509 | 3.5 | Jan 3 | Template.pm in Bugzilla 2.x, 3.x, and 4.x before 4.2.16, 4.3.x and 4.4.x before 4.4.11, and 4.5.x and 5.0.x before 5.0.2 does not properly construct CSV files, which allows remote… Affected: 2.0; 2.2; 2.4; 2.6; 2.8; 2.10; +34 more |
| CVE-2015-4499 | – | Sep 14 | Util.pm in Bugzilla 2.x, 3.x, and 4.x before 4.2.15, 4.3.x and 4.4.x before 4.4.10, and 5.x before 5.0.1 mishandles long e-mail addresses during account registration, which allows… Affected: 2.0; 2.2; 2.4; 2.6; 2.8; 2.10; +34 more |
| CVE-2014-8630 | – | Feb 1 | Bugzilla before 4.0.16, 4.1.x and 4.2.x before 4.2.12, 4.3.x and 4.4.x before 4.4.7, and 5.x before 5.0rc1 allows remote authenticated users to execute arbitrary commands by… Affected: through 4.0.16; 4.1; 4.1.1; 4.1.2; 4.1.3; 4.2; +33 more |
| CVE-2014-1573 | – | Oct 13 | Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 does not ensure that a scalar context is used for… Affected: 2.0; 2.2; 2.4; 2.6; 2.8; 2.9; +34 more |
| CVE-2014-1572 | – | Oct 13 | The confirm_create_account function in the account-creation feature in token.cgi in Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before… Affected: 2.0; 2.2; 2.4; 2.6; 2.8; 2.9; +34 more |
| CVE-2014-1571 | – | Oct 13 | Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 allows remote authenticated users to obtain sensitive… Affected: 2.0; 2.2; 2.4; 2.6; 2.8; 2.9; +34 more |
| CVE-2014-1546 | – | Aug 14 | The response function in the JSONP endpoint in WebService/Server/JSONRPC.pm in jsonrpc.cgi in Bugzilla 3.x and 4.x before 4.0.14, 4.1.x and 4.2.x before 4.2.10, 4.3.x and 4.4.x… Affected: 3.0; 3.0; 3.0.0; 3.0.1; 3.0.2; 3.0.3; +34 more |
| CVE-2014-1517 | – | Apr 20 | The login form in Bugzilla 2.x, 3.x, 4.x before 4.4.3, and 4.5.x before 4.5.3 does not properly handle a correctly authenticated but unintended login attempt, which makes it… Affected: 2.0; 2.2; 2.4; 2.6; 2.8; 2.9; +34 more |
| CVE-2013-1743 | – | Oct 24 | Multiple cross-site scripting (XSS) vulnerabilities in report.cgi in Bugzilla 4.1.x and 4.2.x before 4.2.7 and 4.3.x and 4.4.x before 4.4.1 allow remote attackers to inject… Affected: 4.1; 4.1.1; 4.1.2; 4.1.3; 4.3; 4.3.1; +13 more |
| CVE-2013-1742 | – | Oct 24 | Multiple cross-site scripting (XSS) vulnerabilities in editflagtypes.cgi in Bugzilla 2.x, 3.x, and 4.0.x before 4.0.11; 4.1.x and 4.2.x before 4.2.7; and 4.3.x and 4.4.x before… Affected: 4.1; 4.1.1; 4.1.2; 4.1.3; 4.3; 4.3.1; +34 more |
| CVE-2013-1734 | – | Oct 24 | Cross-site request forgery (CSRF) vulnerability in attachment.cgi in Bugzilla 2.x, 3.x, and 4.0.x before 4.0.11; 4.1.x and 4.2.x before 4.2.7; and 4.3.x and 4.4.x before 4.4.1… Affected: 2.0; 2.2; 2.4; 2.6; 2.8; 2.9; +34 more |
| CVE-2013-1733 | – | Oct 24 | Cross-site request forgery (CSRF) vulnerability in process_bug.cgi in Bugzilla 4.4.x before 4.4.1 allows remote attackers to hijack the authentication of arbitrary users for… Affected: 4.4; 4.4; 4.4 |
| CVE-2013-0786 | – | Feb 24 | The Bugzilla::Search::build_subselect function in Bugzilla 2.x and 3.x before 3.6.13 and 3.7.x and 4.0.x before 4.0.10 generates different error messages for invalid product… Affected: through 3.6.12; 3.6; 3.6; 3.6.0; 3.6.1; 3.6.2; +34 more |
| CVE-2013-0785 | – | Feb 24 | Cross-site scripting (XSS) vulnerability in show_bug.cgi in Bugzilla before 3.6.13, 3.7.x and 4.0.x before 4.0.10, 4.1.x and 4.2.x before 4.2.5, and 4.3.x and 4.4.x before 4.4rc2… Affected: through 3.6.12; 3.6; 3.6; 3.6.0; 3.6.1; 3.6.2; +34 more |
| CVE-2012-5884 | – | Nov 16 | The User.get method in Bugzilla/WebService/User.pm in Bugzilla 4.3.2 allows remote attackers to obtain sensitive information about the saved searches of arbitrary users via an… Affected: 4.3.2 |
| CVE-2012-5883 | – | Nov 16 | Cross-site scripting (XSS) vulnerability in the Flash component infrastructure in YUI 2.8.0 through 2.9.0, as used in Bugzilla 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before… Affected: 3.7; 3.7.1; 3.7.2; 3.7.3; 4.0; 4.0; +23 more |
| CVE-2012-4199 | – | Nov 16 | template/en/default/bug/field-events.js.tmpl in Bugzilla 3.x before 3.6.12, 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1 generates… Affected: through 3.6.11; 3.0; 3.0; 3.0.0; 3.0.1; 3.0.2; +34 more |
| CVE-2012-4198 | – | Nov 16 | The User.get method in Bugzilla/WebService/User.pm in Bugzilla 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1 has a different… Affected: 3.7; 3.7.1; 3.7.2; 3.7.3; 4.0; 4.0; +23 more |
| CVE-2012-4197 | – | Nov 16 | Bugzilla/Attachment.pm in attachment.cgi in Bugzilla 2.x and 3.x before 3.6.12, 3.7.x and 4.0.x before 4.0.9, 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1… Affected: 2.0; 2.2; 2.4; 2.6; 2.8; 2.9; +34 more |
| CVE-2012-4189 | – | Nov 16 | Cross-site scripting (XSS) vulnerability in Bugzilla 4.1.x and 4.2.x before 4.2.4, and 4.3.x and 4.4.x before 4.4rc1, allows remote attackers to inject arbitrary web script or… Affected: 4.1; 4.1.1; 4.1.2; 4.1.3; 4.2; 4.2; +8 more |
| CVE-2012-4747 | – | Sep 4 | Bugzilla 2.x and 3.x through 3.6.11, 3.7.x and 4.0.x before 4.0.8, 4.1.x and 4.2.x before 4.2.3, and 4.3.x before 4.3.3 stores potentially sensitive information under the web root… Affected: 2.0; 2.2; 2.4; 2.6; 2.8; 2.9; +34 more |
| CVE-2012-3981 | – | Sep 4 | Auth/Verify/LDAP.pm in Bugzilla 2.x and 3.x before 3.6.11, 3.7.x and 4.0.x before 4.0.8, 4.1.x and 4.2.x before 4.2.3, and 4.3.x before 4.3.3 does not restrict the characters in a… Affected: 2.0; 2.2; 2.4; 2.6; 2.8; 2.9; +34 more |
| CVE-2012-1969 | – | Jul 30 | The get_attachment_link function in Template.pm in Bugzilla 2.x and 3.x before 3.6.10, 3.7.x and 4.0.x before 4.0.7, 4.1.x and 4.2.x before 4.2.2, and 4.3.x before 4.3.2 does not… Affected: 2.0; 2.2; 2.4; 2.6; 2.8; 2.9; +34 more |
| CVE-2012-1968 | – | Jul 30 | Bugzilla 4.1.x and 4.2.x before 4.2.2 and 4.3.x before 4.3.2 uses bug-editor privileges instead of bugmail-recipient privileges during construction of HTML bugmail documents,… Affected: 4.1; 4.1.1; 4.1.2; 4.1.3; 4.2; 4.2; +4 more |
| CVE-2012-0466 | – | Apr 27 | template/en/default/list/list.js.tmpl in Bugzilla 2.x and 3.x before 3.6.9, 3.7.x and 4.0.x before 4.0.6, and 4.1.x and 4.2.x before 4.2.1 does not properly handle multiple… Affected: 2.0; 2.2; 2.4; 2.6; 2.8; 2.9; +34 more |
| CVE-2012-0465 | – | Apr 27 | Bugzilla 3.5.x and 3.6.x before 3.6.9, 3.7.x and 4.0.x before 4.0.6, and 4.1.x and 4.2.x before 4.2.1, when the inbound_proxies option is enabled, does not properly validate the… Affected: 3.5.1; 3.5.2; 3.5.3; 3.6.0; 3.6.1; 3.6.2; +20 more |
| CVE-2012-0453 | – | Feb 25 | Cross-site request forgery (CSRF) vulnerability in xmlrpc.cgi in Bugzilla 4.0.2 through 4.0.4 and 4.1.1 through 4.2rc2, when mod_perl is used, allows remote attackers to hijack… Affected: 4.0.2; 4.0.3; 4.0.4; 4.1.1; 4.1.2; 4.1.3; +2 more |
| CVE-2012-0448 | – | Feb 2 | Bugzilla 2.x and 3.x before 3.4.14, 3.5.x and 3.6.x before 3.6.8, 3.7.x and 4.0.x before 4.0.4, and 4.1.x and 4.2.x before 4.2rc2 does not reject non-ASCII characters in e-mail… Affected: 2.0; 2.2; 2.4; 2.6; 2.8; 2.9; +34 more |
| CVE-2012-0440 | – | Feb 2 | Cross-site request forgery (CSRF) vulnerability in jsonrpc.cgi in Bugzilla 3.5.x and 3.6.x before 3.6.8, 3.7.x and 4.0.x before 4.0.4, and 4.1.x and 4.2.x before 4.2rc2 allows… Affected: 3.6; 3.6; 3.6.0; 3.6.1; 3.6.2; 3.6.3; +23 more |
| CVE-2011-3669 | – | Jan 2 | Cross-site request forgery (CSRF) vulnerability in attachment.cgi in Bugzilla 2.x, 3.x, and 4.x before 4.2rc1 allows remote attackers to hijack the authentication of arbitrary… Affected: 2.0; 2.2; 2.4; 2.6; 2.8; 2.9; +34 more |
| CVE-2011-3668 | – | Jan 2 | Cross-site request forgery (CSRF) vulnerability in post_bug.cgi in Bugzilla 2.x, 3.x, and 4.x before 4.2rc1 allows remote attackers to hijack the authentication of arbitrary users… Affected: 2.0; 2.2; 2.4; 2.6; 2.8; 2.9; +34 more |
| CVE-2011-3667 | – | Jan 2 | The User.offer_account_by_email WebService method in Bugzilla 2.x and 3.x before 3.4.13, 3.5.x and 3.6.x before 3.6.7, 3.7.x and 4.0.x before 4.0.3, and 4.1.x through 4.1.3, when… Affected: 2.0; 2.2; 2.4; 2.6; 2.8; 2.9; +34 more |
| CVE-2011-3657 | – | Jan 2 | Multiple cross-site scripting (XSS) vulnerabilities in Bugzilla 2.x and 3.x before 3.4.13, 3.5.x and 3.6.x before 3.6.7, 3.7.x and 4.0.x before 4.0.3, and 4.1.x through 4.1.3,… Affected: 2.0; 2.2; 2.4; 2.6; 2.8; 2.9; +34 more |
| CVE-2011-2979 | – | Aug 9 | Bugzilla 4.1.x before 4.1.3 generates different responses for certain assignee queries depending on whether the group name is valid, which allows remote attackers to determine the… Affected: 4.1; 4.1.1; 4.1.2 |
| CVE-2011-2978 | – | Aug 9 | Bugzilla 2.16rc1 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 does not prevent changes to… Affected: 2.16; 2.16; 2.16.1; 2.16.2; 2.16.3; 2.16.4; +34 more |
| CVE-2011-2977 | – | Aug 9 | Bugzilla 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 on Windows does not delete the temporary files associated with uploaded attachments, which allows… Affected: 3.6.0; 3.6.1; 3.6.2; 3.6.3; 3.6.4; 3.6.5; +11 more |
| CVE-2011-2976 | – | Aug 9 | Cross-site scripting (XSS) vulnerability in Bugzilla 2.16rc1 through 2.22.7, 3.0.x through 3.3.x, and 3.4.x before 3.4.12 allows remote attackers to inject arbitrary web script or… Affected: 2.16; 2.16; 2.16.1; 2.16.2; 2.16.3; 2.16.4; +34 more |
| CVE-2011-2381 | – | Aug 9 | CRLF injection vulnerability in Bugzilla 2.17.1 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before… Affected: 2.17.1; 2.17.3; 2.17.4; 2.17.5; 2.17.6; 2.17.7; +34 more |
| CVE-2011-2380 | – | Aug 9 | Bugzilla 2.23.3 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x before 4.1.3 allows remote attackers to… Affected: 2.22.7; 2.23; 2.23.1; 2.23.2; 2.23.3; 3.4; +34 more |
| CVE-2011-2379 | – | Aug 9 | Cross-site scripting (XSS) vulnerability in Bugzilla 2.4 through 2.22.7, 3.0.x through 3.3.x, 3.4.x before 3.4.12, 3.5.x, 3.6.x before 3.6.6, 3.7.x, 4.0.x before 4.0.2, and 4.1.x… Affected: 2.4; 2.6; 2.8; 2.9; 2.10; 2.12; +34 more |
| CVE-2008-7292 | – | Aug 9 | Bugzilla 2.20.x before 2.20.5, 2.22.x before 2.22.3, and 3.0.x before 3.0.3 on Windows does not delete the temporary files associated with uploaded attachments, which allows local… Affected: 2.20; 2.20.1; 2.20.2; 2.20.3; 2.20.4; 2.22; +6 more |
| CVE-2010-4567 | – | Jan 28 | Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 does not properly handle whitespace preceding a (1) javascript: or (2) data: URI, which… Affected: through 3.2.9; 2.0; 2.2; 2.4; 2.6; 2.8; +34 more |
| CVE-2011-0048 | – | Jan 28 | Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 creates a clickable link for a (1) javascript: or (2) data: URI in the URL (aka… Affected: through 3.2.9; 2.0; 2.2; 2.4; 2.6; 2.8; +34 more |
| CVE-2011-0046 | – | Jan 28 | Multiple cross-site request forgery (CSRF) vulnerabilities in Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 allow remote attackers to… Affected: through 3.2.9; 2.0; 2.2; 2.4; 2.6; 2.8; +34 more |
| CVE-2010-4572 | – | Jan 28 | CRLF injection vulnerability in chart.cgi in Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 allows remote attackers to inject arbitrary… Affected: through 3.2.9; 2.0; 2.2; 2.4; 2.6; 2.8; +34 more |
| CVE-2010-4570 | – | Jan 28 | Cross-site scripting (XSS) vulnerability in the duplicate-detection functionality in Bugzilla 3.7.1, 3.7.2, 3.7.3, and 4.0rc1 allows remote attackers to inject arbitrary web… Affected: 3.7.1; 3.7.2; 3.7.3; 4.0 |
| CVE-2010-4569 | – | Jan 28 | Cross-site scripting (XSS) vulnerability in Bugzilla 3.7.1, 3.7.2, 3.7.3, and 4.0rc1 allows remote attackers to inject arbitrary web script or HTML via the real name field of a… Affected: 3.7.1; 3.7.2; 3.7.3; 4.0 |