Bugzilla

bugzilla

Vendor: Mozilla • 145 CVEs

CVEs (145)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2004-1061 1Mozilla 1Bugzilla Apr 16, 2026 Jan 4, 2005 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in Bugzilla before 2.18, including 2.16.x before 2.16.11, allows remote attackers to inject arbitrary HTML and web script via forced error messages, as demonstrated using the acti...Show more Cross-site scripting (XSS) vulnerability in Bugzilla before 2.18, including 2.16.x before 2.16.11, allows remote attackers to inject arbitrary HTML and web script via forced error messages, as demonstrated using the action parameter.Show less
CVE-2004-1634 1Mozilla 1Bugzilla Apr 16, 2026 Oct 25, 2004 N/A· v4 N/A· v3 5.0 MEDIUM· v2 show_bug.cgi in Bugzilla 2.17.1 through 2.18rc2 and 2.19 from CVS, when using the insidergroup feature and exporting a bug to XML, shows comments and attachment summaries which are marked as private, which allows remote...Show more show_bug.cgi in Bugzilla 2.17.1 through 2.18rc2 and 2.19 from CVS, when using the insidergroup feature and exporting a bug to XML, shows comments and attachment summaries which are marked as private, which allows remote attackers to gain sensitive information.Show less
CVE-2004-1633 1Mozilla 1Bugzilla Apr 16, 2026 Oct 25, 2004 N/A· v4 N/A· v3 5.0 MEDIUM· v2 process_bug.cgi in Bugzilla 2.9 through 2.18rc2 and 2.19 from CVS does not check edit permissions on the keywords field, which allows remote authenticated users to modify the keywords in a bug via the keywordaction param...Show more process_bug.cgi in Bugzilla 2.9 through 2.18rc2 and 2.19 from CVS does not check edit permissions on the keywords field, which allows remote authenticated users to modify the keywords in a bug via the keywordaction parameter.Show less
CVE-2004-0769 1Mozilla 1Bugzilla Apr 16, 2026 Aug 18, 2004 N/A· v4 N/A· v3 10.0 HIGH· v2 Buffer overflow in LHA allows remote attackers to execute arbitrary code via long pathnames in LHarc format 2 headers for a .LHZ archive, as originally demonstrated using the "x" option but also exploitable through "l" a...Show more Buffer overflow in LHA allows remote attackers to execute arbitrary code via long pathnames in LHarc format 2 headers for a .LHZ archive, as originally demonstrated using the "x" option but also exploitable through "l" and "v", and fixed in header.c, a different issue than CVE-2004-0771.Show less
CVE-2003-1046 1Mozilla 1Bugzilla Apr 16, 2026 Aug 18, 2004 N/A· v4 N/A· v3 7.5 HIGH· v2 describecomponents.cgi in Bugzilla 2.17.3 and 2.17.4 does not properly verify group membership when bug entry groups are used, which allows remote attackers to list component descriptions for otherwise restricted product...Show more describecomponents.cgi in Bugzilla 2.17.3 and 2.17.4 does not properly verify group membership when bug entry groups are used, which allows remote attackers to list component descriptions for otherwise restricted products.Show less
CVE-2003-1045 1Mozilla 1Bugzilla Apr 16, 2026 Aug 18, 2004 N/A· v4 N/A· v3 5.0 MEDIUM· v2 votes.cgi in Bugzilla 2.16.3 and earlier, and 2.17.1 through 2.17.4, allows remote attackers to read a user's voting page when that user has voted on a restricted bug, which allows remote attackers to read potentially se...Show more votes.cgi in Bugzilla 2.16.3 and earlier, and 2.17.1 through 2.17.4, allows remote attackers to read a user's voting page when that user has voted on a restricted bug, which allows remote attackers to read potentially sensitive voting information by modifying the who parameter.Show less
CVE-2003-1044 1Mozilla 1Bugzilla Apr 16, 2026 Aug 18, 2004 N/A· v4 N/A· v3 7.5 HIGH· v2 editproducts.cgi in Bugzilla 2.16.3 and earlier, when usebuggroups is enabled, does not properly remove group add privileges from a group that is being deleted, which allows users with those privileges to perform unautho...Show more editproducts.cgi in Bugzilla 2.16.3 and earlier, when usebuggroups is enabled, does not properly remove group add privileges from a group that is being deleted, which allows users with those privileges to perform unauthorized additions to the next group that is assigned with the original group ID.Show less
CVE-2003-1043 1Mozilla 1Bugzilla Apr 16, 2026 Aug 18, 2004 N/A· v4 N/A· v3 10.0 HIGH· v2 SQL injection vulnerability in Bugzilla 2.16.3 and earlier, and 2.17.1 through 2.17.4, allows remote authenticated users with editkeywords privileges to execute arbitrary SQL via the id parameter to editkeywords.cgi.
CVE-2003-1042 1Mozilla 1Bugzilla Apr 16, 2026 Aug 18, 2004 N/A· v4 N/A· v3 10.0 HIGH· v2 SQL injection vulnerability in collectstats.pl for Bugzilla 2.16.3 and earlier allows remote authenticated users with editproducts privileges to execute arbitrary SQL via the product name.
CVE-2004-0707 1Mozilla 1Bugzilla Apr 16, 2026 Jul 27, 2004 N/A· v4 N/A· v3 7.5 HIGH· v2 SQL injection vulnerability in editusers.cgi in Bugzilla 2.16.x before 2.16.6, and 2.18 before 2.18rc1, allows remote attackers with privileges to grant membership to any group to execute arbitrary SQL.
CVE-2004-0706 1Mozilla 1Bugzilla Apr 16, 2026 Jul 27, 2004 N/A· v4 N/A· v3 2.1 LOW· v2 Bugzilla 2.17.5 through 2.17.7 embeds the password in an image URL, which could allow local users to view the password in the web server log files.
CVE-2004-0703 1Mozilla 1Bugzilla Apr 16, 2026 Jul 27, 2004 N/A· v4 N/A· v3 7.5 HIGH· v2 Unknown vulnerability in the administrative controls in Bugzilla 2.17.1 through 2.17.7 allows users with "grant membership" privileges to grant memberships to groups that the user does not control.
CVE-2004-0702 1Mozilla 1Bugzilla Apr 16, 2026 Jul 27, 2004 N/A· v4 N/A· v3 5.0 MEDIUM· v2 DBI in Bugzilla 2.17.1 through 2.17.7 displays the database password in an error message when the SQL server is not running, which could allow remote attackers to gain sensitive information.
CVE-2003-0603 1Mozilla 1Bugzilla Apr 16, 2026 Aug 27, 2003 N/A· v4 N/A· v3 2.1 LOW· v2 Bugzilla 2.16.x before 2.16.3, 2.17.x before 2.17.4, and earlier versions allows local users to overwrite arbitrary files via a symlink attack on temporary files that are created in directories with group-writable or wor...Show more Bugzilla 2.16.x before 2.16.3, 2.17.x before 2.17.4, and earlier versions allows local users to overwrite arbitrary files via a symlink attack on temporary files that are created in directories with group-writable or world-writable permissions.Show less
CVE-2003-0602 1Mozilla 1Bugzilla Apr 16, 2026 Aug 27, 2003 N/A· v4 N/A· v3 6.8 MEDIUM· v2 Multiple cross-site scripting vulnerabilities (XSS) in Bugzilla 2.16.x before 2.16.3 and 2.17.x before 2.17.4 allow remote attackers to insert arbitrary HTML or web script via (1) multiple default German and Russian HTML...Show more Multiple cross-site scripting vulnerabilities (XSS) in Bugzilla 2.16.x before 2.16.3 and 2.17.x before 2.17.4 allow remote attackers to insert arbitrary HTML or web script via (1) multiple default German and Russian HTML templates or (2) ALT and NAME attributes in AREA tags as used by the GraphViz graph generation feature for local dependency graphs.Show less
CVE-2003-0013 1Mozilla 1Bugzilla Apr 16, 2026 Jan 17, 2003 N/A· v4 N/A· v3 7.5 HIGH· v2 The default .htaccess scripts for Bugzilla 2.14.x before 2.14.5, 2.16.x before 2.16.2, and 2.17.x before 2.17.3 do not include filenames for backup copies of the localconfig file that are made from editors such as vi and...Show more The default .htaccess scripts for Bugzilla 2.14.x before 2.14.5, 2.16.x before 2.16.2, and 2.17.x before 2.17.3 do not include filenames for backup copies of the localconfig file that are made from editors such as vi and Emacs, which could allow remote attackers to obtain a database password by directly accessing the backup file.Show less
CVE-2003-0012 1Mozilla 1Bugzilla Apr 16, 2026 Jan 17, 2003 N/A· v4 N/A· v3 2.1 LOW· v2 The data collection script for Bugzilla 2.14.x before 2.14.5, 2.16.x before 2.16.2, and 2.17.x before 2.17.3 sets world-writable permissions for the data/mining directory when it runs, which allows local users to modify...Show more The data collection script for Bugzilla 2.14.x before 2.14.5, 2.16.x before 2.16.2, and 2.17.x before 2.17.3 sets world-writable permissions for the data/mining directory when it runs, which allows local users to modify or delete the data.Show less
CVE-2002-2260 1Mozilla 1Bugzilla Apr 16, 2026 Dec 31, 2002 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in the quips feature in Mozilla Bugzilla 2.10 through 2.17 allows remote attackers to inject arbitrary web script or HTML via the "show all quips" page.
CVE-2002-1198 1Mozilla 1Bugzilla Apr 16, 2026 Oct 28, 2002 N/A· v4 N/A· v3 7.5 HIGH· v2 Bugzilla 2.16.x before 2.16.1 does not properly filter apostrophes from an email address during account creation, which allows remote attackers to execute arbitrary SQL via a SQL injection attack.
CVE-2002-1197 1Mozilla 1Bugzilla Apr 16, 2026 Oct 28, 2002 N/A· v4 N/A· v3 7.5 HIGH· v2 bugzilla_email_append.pl in Bugzilla 2.14.x before 2.14.4, and 2.16.x before 2.16.1, allows remote attackers to execute arbitrary code via shell metacharacters in a system call to processmail.

Previous 1...4 567 8 Next