bugzilla Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/bugzilla/ Sun, 26 Feb 2023 09:07:30 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png bugzilla Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/bugzilla/ 32 32 CVE-2007-5038 https://cvevulnerability.com/cve_vulnerabilities/cve-2007-5038/ Sun, 26 Feb 2023 09:07:30 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2007-5038/ The offer_account_by_email function in User.pm in the WebService for Bugzilla before 3.0.2, and 3.1.x before 3.1.2, does not check the value of the createemailregexp parameter, which allows remote attackers to bypass intended restrictions on account creation.

The post CVE-2007-5038 appeared first on CVE Vulnerability.

]]> The offer_account_by_email function in User.pm in the WebService for Bugzilla before 3.0.2, and 3.1.x before 3.1.2, does not check the value of the createemailregexp parameter, which allows remote attackers to bypass intended restrictions on account creation.

The post CVE-2007-5038 appeared first on CVE Vulnerability.

]]> CVE-2007-4538 https://cvevulnerability.com/cve_vulnerabilities/cve-2007-4538/ Sun, 26 Feb 2023 09:07:16 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2007-4538/ email_in.pl in Bugzilla 2.23.4 through 3.0.0 allows remote attackers to execute arbitrary commands via the -f (From address) option to the Email::Send::Sendmail function, probably involving shell metacharacters.

The post CVE-2007-4538 appeared first on CVE Vulnerability.

]]> email_in.pl in Bugzilla 2.23.4 through 3.0.0 allows remote attackers to execute arbitrary commands via the -f (From address) option to the Email::Send::Sendmail function, probably involving shell metacharacters.

The post CVE-2007-4538 appeared first on CVE Vulnerability.

]]> CVE-2007-4539 https://cvevulnerability.com/cve_vulnerabilities/cve-2007-4539/ Sun, 26 Feb 2023 09:07:16 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2007-4539/ The WebService (XML-RPC) interface in Bugzilla 2.23.3 through 3.0.0 does not enforce permissions for the time-tracking fields of bugs, which allows remote attackers to obtain sensitive information via certain XML-RPC requests, as demonstrated by the (1) Deadline and (2) Estimated Time fields.

The post CVE-2007-4539 appeared first on CVE Vulnerability.

]]> The WebService (XML-RPC) interface in Bugzilla 2.23.3 through 3.0.0 does not enforce permissions for the time-tracking fields of bugs, which allows remote attackers to obtain sensitive information via certain XML-RPC requests, as demonstrated by the (1) Deadline and (2) Estimated Time fields.

The post CVE-2007-4539 appeared first on CVE Vulnerability.

]]> CVE-2007-4543 https://cvevulnerability.com/cve_vulnerabilities/cve-2007-4543/ Sun, 26 Feb 2023 09:07:16 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2007-4543/ Cross-site scripting (XSS) vulnerability in enter_bug.cgi in Bugzilla 2.17.1 through 2.20.4, 2.22.x before 2.22.3, and 3.x before 3.0.1 allows remote attackers to inject arbitrary web script or HTML via the buildid field in the “guided form.”

The post CVE-2007-4543 appeared first on CVE Vulnerability.

]]> Cross-site scripting (XSS) vulnerability in enter_bug.cgi in Bugzilla 2.17.1 through 2.20.4, 2.22.x before 2.22.3, and 3.x before 3.0.1 allows remote attackers to inject arbitrary web script or HTML via the buildid field in the “guided form.”

The post CVE-2007-4543 appeared first on CVE Vulnerability.

]]> CVE-2007-0791 https://cvevulnerability.com/cve_vulnerabilities/cve-2007-0791/ Sun, 26 Feb 2023 09:05:37 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2007-0791/ Cross-site scripting (XSS) vulnerability in Atom feeds in Bugzilla 2.20.3, 2.22.1, and 2.23.3, and earlier versions down to 2.20.1, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

The post CVE-2007-0791 appeared first on CVE Vulnerability.

]]> Cross-site scripting (XSS) vulnerability in Atom feeds in Bugzilla 2.20.3, 2.22.1, and 2.23.3, and earlier versions down to 2.20.1, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

The post CVE-2007-0791 appeared first on CVE Vulnerability.

]]> CVE-2007-0792 https://cvevulnerability.com/cve_vulnerabilities/cve-2007-0792/ Sun, 26 Feb 2023 09:05:37 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2007-0792/ The mod_perl initialization script in Bugzilla 2.23.3 does not set the Bugzilla Apache configuration to allow .htaccess permissions to override file permissions, which allows remote attackers to obtain the database username and password via a direct request for the localconfig file.

The post CVE-2007-0792 appeared first on CVE Vulnerability.

]]> The mod_perl initialization script in Bugzilla 2.23.3 does not set the Bugzilla Apache configuration to allow .htaccess permissions to override file permissions, which allows remote attackers to obtain the database username and password via a direct request for the localconfig file.

The post CVE-2007-0792 appeared first on CVE Vulnerability.

]]> CVE-2018-5123 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-5123/ Sun, 26 Feb 2023 06:50:12 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-5123/ A third party website can access information available to a user with access to a restricted bug entry using the image generation in report.cgi in all Bugzilla versions prior to 4.4.

The post CVE-2018-5123 appeared first on CVE Vulnerability.

]]> A third party website can access information available to a user with access to a restricted bug entry using the image generation in report.cgi in all Bugzilla versions prior to 4.4.

The post CVE-2018-5123 appeared first on CVE Vulnerability.

]]>