BU
Product
Bugzilla
145
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 1Medium 2Low 1
Watch
Add Bugzilla to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2010-4568 | – | Jan 28 | Bugzilla 2.14 through 2.22.7; 3.0.x, 3.1.x, and 3.2.x before 3.2.10; 3.4.x before 3.4.10; 3.6.x before 3.6.4; and 4.0.x before 4.0rc2 does not properly generate random values for… Affected: 2.14; 2.14.1; 2.14.2; 2.14.3; 2.14.4; 2.14.5; +34 more |
| CVE-2010-3764 | – | Nov 5 | The Old Charts implementation in Bugzilla 2.12 through 3.2.8, 3.4.8, 3.6.2, 3.7.3, and 4.1 creates graph files with predictable names in graphs/, which allows remote attackers to… Affected: 2.2; 2.4; 2.6; 2.8; 2.9; 2.12; +34 more |
| CVE-2010-3172 | – | Nov 5 | CRLF injection vulnerability in Bugzilla before 3.2.9, 3.4.x before 3.4.9, 3.6.x before 3.6.3, and 4.0.x before 4.0rc1, when Server Push is enabled in a web browser, allows remote… Affected: through 3.2.8; 2.0; 2.2; 2.4; 2.6; 2.8; +34 more |
| CVE-2010-2759 | – | Aug 16 | Bugzilla 2.23.1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1 through 3.6.1, and 3.7 through 3.7.2, when PostgreSQL is used, does not properly handle large integers in (1) bug and (2)… Affected: 2.4; 2.6; 2.8; 2.9; 2.23.1; 2.23.2; +34 more |
| CVE-2010-2758 | – | Aug 16 | Bugzilla 2.17.1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1 through 3.6.1, and 3.7 through 3.7.2 generates different error messages depending on whether a product exists, which… Affected: 2.2; 2.4; 2.6; 2.8; 2.9; 2.17.1; +34 more |
| CVE-2010-2757 | – | Aug 16 | The sudo feature in Bugzilla 2.22rc1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1 through 3.6.1, and 3.7 through 3.7.2 does not properly send impersonation notifications, which makes… Affected: 2.4; 2.6; 2.8; 2.9; 2.22; 2.22; +34 more |
| CVE-2010-2756 | – | Aug 16 | Search.pm in Bugzilla 2.19.1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1 through 3.6.1, and 3.7 through 3.7.2 allows remote attackers to determine the group memberships of arbitrary… Affected: 2.2; 2.4; 2.6; 2.8; 2.9; 2.19.1; +34 more |
| CVE-2010-2470 | – | Jun 28 | Install/Filesystem.pm in Bugzilla 3.5.1 through 3.6.1 and 3.7 through 3.7.1, when use_suexec is enabled, uses world-readable permissions within (1) .bzr/ and (2) data/webdot/,… Affected: 3.5.1; 3.5.2; 3.5.3; 3.6; 3.6; 3.6.1; +2 more |
| CVE-2010-1204 | – | Jun 28 | Search.pm in Bugzilla 2.17.1 through 3.2.6, 3.3.1 through 3.4.6, 3.5.1 through 3.6, and 3.7 allows remote attackers to obtain potentially sensitive time-tracking information via a… Affected: 2.17.1; 2.17.3; 2.17.4; 2.17.5; 2.17.6; 2.17.7; +34 more |
| CVE-2010-0180 | – | Jun 28 | Install/Filesystem.pm in Bugzilla 3.5.1 through 3.6 and 3.7, when use_suexec is enabled, uses world-readable permissions for the localconfig files, which allows local users to… Affected: 3.5.1; 3.5.2; 3.5.3; 3.6; 3.7 |
| CVE-2009-3989 | – | Feb 3 | Bugzilla before 3.0.11, 3.2.x before 3.2.6, 3.4.x before 3.4.5, and 3.5.x before 3.5.3 does not block access to files and directories that are used by custom installations, which… Affected: through 3.0.10; 2.0; 2.2; 2.4; 2.6; 2.8; +34 more |
| CVE-2009-3387 | – | Feb 3 | Bugzilla 3.3.1 through 3.4.4, 3.5.1, and 3.5.2 does not allow group restrictions to be preserved throughout the process of moving a bug to a different product category, which… Affected: 3.3.1; 3.3.2; 3.3.3; 3.3.4; 3.4; 3.4.1; +4 more |
| CVE-2009-3386 | – | Nov 20 | Template.pm in Bugzilla 3.3.2 through 3.4.3 and 3.5 through 3.5.1 allows remote attackers to discover the alias of a private bug by reading the (1) Depends On or (2) Blocks field… Affected: 3.3.2; 3.3.3; 3.3.4; 3.4; 3.4; 3.4.1; +4 more |
| CVE-2009-3166 | – | Sep 15 | token.cgi in Bugzilla 3.4rc1 through 3.4.1 places a password in a URL at the beginning of a login session that occurs immediately after a password reset, which allows… Affected: 3.4; 3.4; 3.4.1 |
| CVE-2009-3165 | – | Sep 15 | SQL injection vulnerability in the Bug.create WebService function in Bugzilla 2.23.4 through 3.0.8, 3.1.1 through 3.2.4, and 3.3.1 through 3.4.1 allows remote attackers to execute… Affected: 2.23.4; 3.0; 3.0; 3.0.1; 3.0.2; 3.0.3; +23 more |
| CVE-2009-3125 | – | Sep 15 | SQL injection vulnerability in the Bug.search WebService function in Bugzilla 3.3.2 through 3.4.1, and 3.5, allows remote attackers to execute arbitrary SQL commands via… Affected: 3.3.2; 3.3.3; 3.3.4; 3.4; 3.4.1; 3.5 |
| CVE-2009-1213 | – | Apr 1 | Cross-site request forgery (CSRF) vulnerability in attachment.cgi in Bugzilla 3.2 before 3.2.3, 3.3 before 3.3.4, and earlier versions allows remote attackers to hijack the… Affected: 3.2; 3.2; 3.2; 3.2.1; 3.2.2; 3.3; +3 more |
| CVE-2008-6098 | – | Feb 9 | Bugzilla 3.2 before 3.2 RC2, 3.0 before 3.0.6, 2.22 before 2.22.6, 2.20 before 2.20.7, and other versions after 2.17.4 allows remote authenticated users to bypass moderation to… Affected: 2.17.4; 2.17.5; 2.17.6; 2.17.7; 2.18; 2.18; +34 more |
| CVE-2009-0486 | – | Feb 9 | Bugzilla 3.2.1, 3.0.7, and 3.3.2, when running under mod_perl, calls the srand function at startup time, which causes Apache children to have the same seed and produce… Affected: 3.0.7; 3.2.1; 3.3.2 |
| CVE-2009-0485 | – | Feb 9 | Cross-site request forgery (CSRF) vulnerability in Bugzilla 2.17 to 2.22.7, 3.0 before 3.0.7, 3.2 before 3.2.1, and 3.3 before 3.3.2 allows remote attackers to delete unused flag… Affected: 2.17; 2.17.1; 2.17.3; 2.17.4; 2.17.5; 2.17.6; +34 more |
| CVE-2009-0484 | – | Feb 9 | Cross-site request forgery (CSRF) vulnerability in Bugzilla 3.0 before 3.0.7, 3.2 before 3.2.1, and 3.3 before 3.3.2 allows remote attackers to delete shared or saved searches via… Affected: 3.0.0; 3.0.1; 3.0.2; 3.0.3; 3.0.4; 3.0.5; +3 more |
| CVE-2009-0483 | – | Feb 9 | Cross-site request forgery (CSRF) vulnerability in Bugzilla 2.22 before 2.22.7, 3.0 before 3.0.7, 3.2 before 3.2.1, and 3.3 before 3.3.2 allows remote attackers to delete keywords… Affected: 2.10; 2.12; 2.14; 2.14.1; 2.14.2; 2.14.3; +34 more |
| CVE-2009-0482 | – | Feb 9 | Cross-site request forgery (CSRF) vulnerability in Bugzilla before 3.2 before 3.2.1, 3.3 before 3.3.2, and other versions before 3.2 allows remote attackers to perform bug… Affected: 2.10; 2.12; 2.14; 2.14.1; 2.14.2; 2.14.3; +34 more |
| CVE-2009-0481 | – | Feb 9 | Bugzilla 2.x before 2.22.7, 3.0 before 3.0.7, 3.2 before 3.2.1, and 3.3 before 3.3.2 allows remote authenticated users to conduct cross-site scripting (XSS) and related attacks by… Affected: 2.10; 2.12; 2.14; 2.14.1; 2.14.2; 2.14.3; +34 more |
| CVE-2008-4437 | – | Oct 3 | Directory traversal vulnerability in importxml.pl in Bugzilla before 2.22.5, and 3.x before 3.0.5, when --attach_path is enabled, allows remote attackers to read arbitrary files… Affected: 2.4; 2.6; 2.8; 2.9; 2.22.1; 2.22.2; +12 more |
| CVE-2008-2105 | – | May 7 | email_in.pl in Bugzilla 2.23.4, 3.0.x before 3.0.4, and 3.1.x before 3.1.4 allows remote authenticated users to more easily spoof the changer of a bug via a @reporter command in… Affected: 2.4; 2.6; 2.8; 2.10; 2.12; 2.14; +34 more |
| CVE-2008-2104 | – | May 7 | The WebService in Bugzilla 3.1.3 allows remote authenticated users without canconfirm privileges to create NEW or ASSIGNED bug entries via a request to the XML-RPC interface,… Affected: 3.1.3 |
| CVE-2008-2103 | – | May 7 | Cross-site scripting (XSS) vulnerability in Bugzilla 2.17.2 and later allows remote attackers to inject arbitrary web script or HTML via the id parameter to the "Format for… Affected: 2.17.2; 2.17.3; 2.17.4; 2.17.5; 2.17.6; 2.17.7; +34 more |
| CVE-2007-5038 | – | Sep 24 | The offer_account_by_email function in User.pm in the WebService for Bugzilla before 3.0.2, and 3.1.x before 3.1.2, does not check the value of the createemailregexp parameter,… Affected: 3.0.0; 3.0.1; 3.1.0; 3.1.1 |
| CVE-2007-4539 | – | Aug 27 | The WebService (XML-RPC) interface in Bugzilla 2.23.3 through 3.0.0 does not enforce permissions for the time-tracking fields of bugs, which allows remote attackers to obtain… Affected: 2.4; 2.6; 2.8; 2.9; 2.23.3; 2.23.4; +1 more |
| CVE-2007-4543 | – | Aug 27 | Cross-site scripting (XSS) vulnerability in enter_bug.cgi in Bugzilla 2.17.1 through 2.20.4, 2.22.x before 2.22.3, and 3.x before 3.0.1 allows remote attackers to inject arbitrary… Affected: 2.17.1; 2.17.3; 2.17.4; 2.17.5; 2.17.6; 2.17.7; +24 more |
| CVE-2007-4538 | – | Aug 27 | email_in.pl in Bugzilla 2.23.4 through 3.0.0 allows remote attackers to execute arbitrary commands via the -f (From address) option to the Email::Send::Sendmail function, probably… Affected: 2.4; 2.6; 2.8; 2.9; 2.23.4; 3.0.0 |
| CVE-2007-0792 | – | Feb 6 | The mod_perl initialization script in Bugzilla 2.23.3 does not set the Bugzilla Apache configuration to allow .htaccess permissions to override file permissions, which allows… Affected: 2.23.3 |
| CVE-2007-0791 | – | Feb 6 | Cross-site scripting (XSS) vulnerability in Atom feeds in Bugzilla 2.20.3, 2.22.1, and 2.23.3, and earlier versions down to 2.20.1, allows remote attackers to inject arbitrary web… Affected: 2.20.1; 2.20.2; 2.20.3; 2.21; 2.21.1; 2.21.2; +5 more |
| CVE-2006-5453 | – | Oct 23 | Multiple cross-site scripting (XSS) vulnerabilities in Bugzilla 2.18.x before 2.18.6, 2.20.x before 2.20.3, 2.22.x before 2.22.1, and 2.23.x before 2.23.3 allow remote… Affected: 2.18; 2.18; 2.18; 2.18; 2.18.1; 2.18.2; +12 more |
| CVE-2006-5455 | – | Oct 23 | Cross-site request forgery (CSRF) vulnerability in editversions.cgi in Bugzilla before 2.22.1 and 2.23.x before 2.23.3 allows user-assisted remote attackers to create, modify, or… Affected: through 2.22.1; 2.23; 2.23.1; 2.23.2 |
| CVE-2006-5454 | – | Oct 23 | Bugzilla 2.18.x before 2.18.6, 2.20.x before 2.20.3, 2.22.x before 2.22.1, and 2.23.x before 2.23.3 allow remote attackers to obtain (1) the description of arbitrary attachments… Affected: 2.18; 2.18; 2.18; 2.18; 2.18.1; 2.18.2; +12 more |
| CVE-2006-2420 | – | May 16 | Bugzilla 2.20rc1 through 2.20 and 2.21.1, when using RSS 1.0, allows remote attackers to conduct cross-site scripting (XSS) attacks via a title element with HTML encoded sequences… Affected: 2.20; 2.20; 2.20; 2.21; 2.21.1 |
| CVE-2006-0913 | – | Feb 28 | SQL injection vulnerability in whineatnews.pl in Bugzilla 2.17 through 2.18.4 and 2.20 allows remote authenticated users with administrative privileges to execute arbitrary SQL… Affected: 2.17.1; 2.17.3; 2.17.4; 2.17.5; 2.17.6; 2.17.7; +16 more |
| CVE-2006-0916 | – | Feb 28 | Bugzilla 2.19.3 through 2.20 does not properly handle "//" sequences in URLs when redirecting a user from the login form, which could cause it to generate a partial URL in a form… Affected: 2.19.3; 2.20; 2.20; 2.20; 2.21; 2.21.1; +1 more |
| CVE-2006-0915 | – | Feb 28 | Bugzilla 2.16.10 does not properly handle certain characters in the (1) maxpatchsize and (2) maxattachmentsize parameters in attachment.cgi, which allows remote attackers to… Affected: 2.16.10 |
| CVE-2006-0914 | – | Feb 28 | Bugzilla 2.16.10, 2.17 through 2.18.4, and 2.20 does not properly handle certain characters in the mostfreqthreshold parameter in duplicates.cgi, which allows remote attackers to… Affected: 2.16.10; 2.17; 2.17.4; 2.17.5; 2.17.6; 2.17.7; +9 more |
| CVE-2005-4534 | – | Dec 28 | The shadow database feature (syncshadowdb) in Bugzilla 2.9 through 2.16.10 allows local users to overwrite arbitrary files via a symlink attack on temporary files Affected: 2.9; 2.10; 2.12; 2.14; 2.14.1; 2.14.2; +14 more |
| CVE-2005-3139 | – | Oct 5 | Bugzilla 2.19.1 through 2.20rc2 and 2.21, with user matching turned on in substring mode, allows attackers to list all users whose names match an arbitrary substring, even when… Affected: 2.19.1; 2.19.2; 2.19.3; 2.20; 2.20; 2.21 |
| CVE-2005-3138 | – | Oct 5 | Bugzilla 2.18rc1 through 2.18.3, 2.19 through 2.20rc2, and 2.21 allows remote attackers to obtain sensitive information such as the list of installed products via the config.cgi… Affected: 2.18; 2.18; 2.18; 2.18.1; 2.18.2; 2.18.3; +7 more |
| CVE-2005-2173 | – | Jul 8 | The Flag::validate and Flag::modify functions in Bugzilla 2.17.1 to 2.18.1 and 2.19.1 to 2.19.3 do not verify that the flag ID is appropriate for the given bug or attachment ID,… Affected: 2.17.1; 2.17.3; 2.17.4; 2.17.5; 2.17.6; 2.17.7; +9 more |
| CVE-2005-2174 | – | Jul 8 | Bugzilla 2.17.x, 2.18 before 2.18.2, 2.19.x, and 2.20 before 2.20rc1 inserts a bug into the database before it is marked private, which introduces a race condition and allows… Affected: 2.17.1; 2.17.3; 2.17.4; 2.17.5; 2.17.6; 2.17.7; +9 more |
| CVE-2005-1563 | – | May 14 | Bugzilla 2.10 through 2.18, 2.19.1, and 2.19.2 displays a different error message depending on whether a product exists or not, which allows remote attackers to determine hidden… Affected: 2.10; 2.12; 2.14; 2.14.1; 2.14.2; 2.14.3; +17 more |
| CVE-2005-1564 | – | May 12 | post_bug.cgi in Bugzilla 2.10 through 2.18, 2.19.1, and 2.19.2 allows remote authenticated users to "enter bugs into products that are closed for bug entry" by modifying the URL… Affected: 2.10; 2.12; 2.14; 2.14.1; 2.14.2; 2.14.3; +19 more |
| CVE-2005-1565 | – | May 12 | Bugzilla 2.17.1 through 2.18, 2.19.1, and 2.19.2, when a user is prompted to log in while attempting to view a chart, displays the password in the URL, which may allow local users… Affected: 2.10; 2.12; 2.14; 2.14.1; 2.14.2; 2.14.3; +19 more |