BU
Product
Bugzilla
145
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 1Medium 2Low 1
Watch
Add Bugzilla to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2004-1061 | – | Jan 4 | Cross-site scripting (XSS) vulnerability in Bugzilla before 2.18, including 2.16.x before 2.16.11, allows remote attackers to inject arbitrary HTML and web script via forced error… Affected: 2.16.1; 2.16.2; 2.16.3; 2.16.4; 2.16.5; 2.16.6; +12 more |
| CVE-2004-1634 | – | Oct 25 | show_bug.cgi in Bugzilla 2.17.1 through 2.18rc2 and 2.19 from CVS, when using the insidergroup feature and exporting a bug to XML, shows comments and attachment summaries which… Affected: 2.4; 2.6; 2.8; 2.10; 2.12; 2.14; +20 more |
| CVE-2004-1633 | – | Oct 25 | process_bug.cgi in Bugzilla 2.9 through 2.18rc2 and 2.19 from CVS does not check edit permissions on the keywords field, which allows remote authenticated users to modify the… Affected: 2.9; 2.10; 2.12; 2.14; 2.14.1; 2.14.2; +19 more |
| CVE-2003-1042 | – | Aug 18 | SQL injection vulnerability in collectstats.pl for Bugzilla 2.16.3 and earlier allows remote authenticated users with editproducts privileges to execute arbitrary SQL via the… Affected: 2.4; 2.6; 2.8; 2.10; 2.12; 2.14; +12 more |
| CVE-2004-0769 | – | Aug 18 | Buffer overflow in LHA allows remote attackers to execute arbitrary code via long pathnames in LHarc format 2 headers for a .LHZ archive, as originally demonstrated using the "x"… Affected: All versions, or not specified |
| CVE-2003-1046 | – | Aug 18 | describecomponents.cgi in Bugzilla 2.17.3 and 2.17.4 does not properly verify group membership when bug entry groups are used, which allows remote attackers to list component… Affected: 2.4; 2.6; 2.8; 2.10; 2.12; 2.14; +12 more |
| CVE-2003-1045 | – | Aug 18 | votes.cgi in Bugzilla 2.16.3 and earlier, and 2.17.1 through 2.17.4, allows remote attackers to read a user's voting page when that user has voted on a restricted bug, which… Affected: 2.4; 2.6; 2.8; 2.10; 2.12; 2.14; +12 more |
| CVE-2003-1044 | – | Aug 18 | editproducts.cgi in Bugzilla 2.16.3 and earlier, when usebuggroups is enabled, does not properly remove group add privileges from a group that is being deleted, which allows users… Affected: 2.4; 2.6; 2.8; 2.10; 2.12; 2.14; +12 more |
| CVE-2003-1043 | – | Aug 18 | SQL injection vulnerability in Bugzilla 2.16.3 and earlier, and 2.17.1 through 2.17.4, allows remote authenticated users with editkeywords privileges to execute arbitrary SQL via… Affected: 2.4; 2.6; 2.8; 2.10; 2.12; 2.14; +12 more |
| CVE-2004-0707 | – | Jul 27 | SQL injection vulnerability in editusers.cgi in Bugzilla 2.16.x before 2.16.6, and 2.18 before 2.18rc1, allows remote attackers with privileges to grant membership to any group to… Affected: 2.4; 2.6; 2.8; 2.10; 2.12; 2.14; +18 more |
| CVE-2004-0706 | – | Jul 27 | Bugzilla 2.17.5 through 2.17.7 embeds the password in an image URL, which could allow local users to view the password in the web server log files Affected: 2.4; 2.6; 2.8; 2.10; 2.12; 2.14; +18 more |
| CVE-2004-0703 | – | Jul 27 | Unknown vulnerability in the administrative controls in Bugzilla 2.17.1 through 2.17.7 allows users with "grant membership" privileges to grant memberships to groups that the user… Affected: 2.4; 2.6; 2.8; 2.10; 2.12; 2.14; +18 more |
| CVE-2004-0702 | – | Jul 27 | DBI in Bugzilla 2.17.1 through 2.17.7 displays the database password in an error message when the SQL server is not running, which could allow remote attackers to gain sensitive… Affected: 2.4; 2.6; 2.8; 2.10; 2.12; 2.14; +18 more |
| CVE-2003-0602 | – | Aug 27 | Multiple cross-site scripting vulnerabilities (XSS) in Bugzilla 2.16.x before 2.16.3 and 2.17.x before 2.17.4 allow remote attackers to insert arbitrary HTML or web script via (1)… Affected: 2.16; 2.16.1; 2.16.2; 2.17; 2.17.1; 2.17.3 |
| CVE-2003-0603 | – | Aug 27 | Bugzilla 2.16.x before 2.16.3, 2.17.x before 2.17.4, and earlier versions allows local users to overwrite arbitrary files via a symlink attack on temporary files that are created… Affected: 2.10; 2.12; 2.14; 2.14.1; 2.14.2; 2.14.3; +8 more |
| CVE-2003-0012 | – | Jan 17 | The data collection script for Bugzilla 2.14.x before 2.14.5, 2.16.x before 2.16.2, and 2.17.x before 2.17.3 sets world-writable permissions for the data/mining directory when it… Affected: 2.14; 2.14.1; 2.14.2; 2.14.3; 2.14.4; 2.16; +3 more |
| CVE-2003-0013 | – | Jan 17 | The default .htaccess scripts for Bugzilla 2.14.x before 2.14.5, 2.16.x before 2.16.2, and 2.17.x before 2.17.3 do not include filenames for backup copies of the localconfig file… Affected: 2.14; 2.14.1; 2.14.2; 2.14.3; 2.14.4; 2.16; +3 more |
| CVE-2002-2260 | – | Dec 31 | Cross-site scripting (XSS) vulnerability in the quips feature in Mozilla Bugzilla 2.10 through 2.17 allows remote attackers to inject arbitrary web script or HTML via the "show… Affected: 2.10; 2.12; 2.14; 2.14.1; 2.14.2; 2.14.3; +22 more |
| CVE-2002-1197 | – | Oct 28 | bugzilla_email_append.pl in Bugzilla 2.14.x before 2.14.4, and 2.16.x before 2.16.1, allows remote attackers to execute arbitrary code via shell metacharacters in a system call to… Affected: 2.14; 2.14.1; 2.14.2; 2.14.3; 2.16 |
| CVE-2002-1198 | – | Oct 28 | Bugzilla 2.16.x before 2.16.1 does not properly filter apostrophes from an email address during account creation, which allows remote attackers to execute arbitrary SQL via a SQL… Affected: 2.14; 2.14.1; 2.14.2; 2.14.3; 2.14.4; 2.16 |
| CVE-2002-1196 | – | Oct 28 | editproducts.cgi in Bugzilla 2.14.x before 2.14.4, and 2.16.x before 2.16.1, when the "usebuggroups" feature is enabled and more than 47 groups are specified, does not properly… Affected: 2.14; 2.14.1; 2.14.2; 2.14.3; 2.16 |
| CVE-2002-0804 | – | Aug 12 | Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, when configured to perform reverse DNS lookups, allows remote attackers to bypass IP restrictions by connecting from a system… Affected: 2.14; 2.14.1; 2.16; 2.16 |
| CVE-2002-0811 | – | Aug 12 | Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, may allow remote attackers to cause a denial of service or execute certain queries via a SQL injection attack on the sort… Affected: 2.14; 2.14.1; 2.16; 2.16 |
| CVE-2002-0810 | – | Aug 12 | Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, directs error messages from the syncshadowdb command to the HTML output, which could leak sensitive information, including… Affected: 2.14; 2.14.1; 2.16; 2.16 |
| CVE-2002-0809 | – | Aug 12 | Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, does not properly handle URL-encoded field names that are generated by some browsers, which could cause certain fields to… Affected: 2.14; 2.14.1; 2.16; 2.16 |
| CVE-2002-0808 | – | Aug 12 | Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, when performing a mass change, sets the groupset of all bugs to the groupset of the first bug, which could inadvertently… Affected: 2.14; 2.14.1; 2.16; 2.16 |
| CVE-2002-0807 | – | Aug 12 | Cross-site scripting vulnerabilities in Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, could allow remote attackers to execute script as other Bugzilla users via the full… Affected: 2.14; 2.14.1; 2.16; 2.16 |
| CVE-2002-0806 | – | Aug 12 | Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, allows authenticated users with editing privileges to delete other users by directly calling the editusers.cgi script with… Affected: 2.14; 2.14.1; 2.16; 2.16 |
| CVE-2002-0805 | – | Aug 12 | Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, (1) creates new directories with world-writable permissions, and (2) creates the params file with world-writable permissions,… Affected: 2.14; 2.14.1; 2.16; 2.16 |
| CVE-2002-0803 | – | Aug 12 | Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, allows remote attackers to display restricted products and components via a direct HTTP request to queryhelp.cgi Affected: 2.14; 2.14.1; 2.16; 2.16 |
| CVE-2002-0008 | – | Jan 31 | Bugzilla before 2.14.1 allows remote attackers to (1) spoof a user comment via an HTTP request to process_bug.cgi using the "who" parameter, instead of the Bugzilla_login cookie,… Affected: through 2.14.1 |
| CVE-2002-0011 | – | Jan 31 | Information leak in doeditvotes.cgi in Bugzilla before 2.14.1 may allow remote attackers to more easily conduct attacks on the login Affected: through 2.14.1 |
| CVE-2002-0010 | – | Jan 31 | Bugzilla before 2.14.1 allows remote attackers to inject arbitrary SQL code and create files or gain privileges via (1) the sql parameter in buglist.cgi, (2) invalid field names… Affected: through 2.14.1 |
| CVE-2002-0009 | – | Jan 31 | show_bug.cgi in Bugzilla before 2.14.1 allows a user with "Bugs Access" privileges to see other products that are not accessible to the user, by submitting a bug and reading the… Affected: through 2.14.1 |
| CVE-2002-0007 | – | Jan 31 | CGI.pl in Bugzilla before 2.14.1, when using LDAP, allows remote attackers to obtain an anonymous bind to the LDAP server via a request that does not include a password, which… Affected: through 2.14.1 |
| CVE-2001-1402 | – | Sep 10 | Bugzilla before 2.14 does not properly escape untrusted parameters, which could allow remote attackers to conduct unauthorized activities via cross-site scripting (CSS) and… Affected: 2.4; 2.6; 2.8; 2.10; 2.12; 2.14 |
| CVE-2001-1407 | – | Sep 10 | Bugzilla before 2.14 allows Bugzilla users to bypass group security checks by marking a bug as the duplicate of a restricted bug, which adds the user to the CC list of the… Affected: 2.4; 2.6; 2.8; 2.10; 2.12; 2.14 |
| CVE-2001-1406 | – | Sep 10 | process_bug.cgi in Bugzilla before 2.14 does not set the "groupset" bit when a bug is moved between product groups, which will cause the bug to have the old group's restrictions,… Affected: 2.4; 2.6; 2.8; 2.10; 2.12; 2.14 |
| CVE-2001-1405 | – | Sep 10 | Bugzilla before 2.14 does not restrict access to sanitycheck.cgi, which allows local users to cause a denial of service (CPU consumption) via a flood of requests to… Affected: 2.4; 2.6; 2.8; 2.10; 2.12; 2.14 |
| CVE-2001-1404 | – | Sep 10 | Bugzilla before 2.14 stores user passwords in plaintext and sends password requests in an email message, which could allow attackers to gain privileges Affected: 2.4; 2.6; 2.8; 2.10; 2.12; 2.14 |
| CVE-2001-1403 | – | Sep 10 | Bugzilla before 2.14 includes the username and password in URLs, which could allow attackers to gain privileges by reading the information from the web server logs, or by… Affected: 2.4; 2.6; 2.8; 2.10; 2.12; 2.14 |
| CVE-2001-1401 | – | Sep 10 | Bugzilla before 2.14 does not properly restrict access to confidential bugs, which could allow Bugzilla users to bypass viewing permissions via modified bug id parameters in (1)… Affected: 2.4; 2.6; 2.8; 2.10; 2.12; 2.14 |
| CVE-2001-0329 | – | Jun 27 | Bugzilla 2.10 allows remote attackers to execute arbitrary commands via shell metacharacters in a username that is then processed by (1) the Bugzilla_login cookie in post_bug.cgi,… Affected: 2.4; 2.6; 2.8; 2.10 |
| CVE-2001-0330 | – | Jun 27 | Bugzilla 2.10 allows remote attackers to access sensitive information, including the database username and password, via an HTTP request for the globals.pl file, which is normally… Affected: 2.4; 2.6; 2.8; 2.10 |
| CVE-2000-0421 | – | May 11 | The process_bug.cgi script in Bugzilla allows remote attackers to execute arbitrary commands via shell metacharacters Affected: 2.8 |