4.7

CVE-2015-8508

Exploit
Cross-site scripting (XSS) vulnerability in showdependencygraph.cgi in Bugzilla 2.x, 3.x, and 4.x before 4.2.16, 4.3.x and 4.4.x before 4.4.11, and 4.5.x and 5.0.x before 5.0.2, when a local dot configuration is used, allows remote attackers to inject arbitrary web script or HTML via a crafted bug summary.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mozilla ≫ Bugzilla Version2.0
Mozilla ≫ Bugzilla Version2.2
Mozilla ≫ Bugzilla Version2.4
Mozilla ≫ Bugzilla Version2.6
Mozilla ≫ Bugzilla Version2.8
Mozilla ≫ Bugzilla Version2.10
Mozilla ≫ Bugzilla Version2.12
Mozilla ≫ Bugzilla Version2.14
Mozilla ≫ Bugzilla Version2.14.1
Mozilla ≫ Bugzilla Version2.14.2
Mozilla ≫ Bugzilla Version2.14.3
Mozilla ≫ Bugzilla Version2.14.4
Mozilla ≫ Bugzilla Version2.14.5
Mozilla ≫ Bugzilla Version2.16
Mozilla ≫ Bugzilla Version2.16.1
Mozilla ≫ Bugzilla Version2.16.2
Mozilla ≫ Bugzilla Version2.16.3
Mozilla ≫ Bugzilla Version2.16.4
Mozilla ≫ Bugzilla Version2.16.5
Mozilla ≫ Bugzilla Version2.16.6
Mozilla ≫ Bugzilla Version2.16.7
Mozilla ≫ Bugzilla Version2.16.8
Mozilla ≫ Bugzilla Version2.16.9
Mozilla ≫ Bugzilla Version2.16.10
Mozilla ≫ Bugzilla Version2.16.11
Mozilla ≫ Bugzilla Version2.18
Mozilla ≫ Bugzilla Version2.18.1
Mozilla ≫ Bugzilla Version2.18.2
Mozilla ≫ Bugzilla Version2.18.3
Mozilla ≫ Bugzilla Version2.18.4
Mozilla ≫ Bugzilla Version2.18.5
Mozilla ≫ Bugzilla Version2.18.6
Mozilla ≫ Bugzilla Version2.20
Mozilla ≫ Bugzilla Version2.20.1
Mozilla ≫ Bugzilla Version2.20.2
Mozilla ≫ Bugzilla Version2.20.3
Mozilla ≫ Bugzilla Version2.20.4
Mozilla ≫ Bugzilla Version2.20.5
Mozilla ≫ Bugzilla Version2.20.6
Mozilla ≫ Bugzilla Version2.20.7
Mozilla ≫ Bugzilla Version2.22
Mozilla ≫ Bugzilla Version2.22.1
Mozilla ≫ Bugzilla Version2.22.2
Mozilla ≫ Bugzilla Version2.22.3
Mozilla ≫ Bugzilla Version2.22.4
Mozilla ≫ Bugzilla Version2.22.5
Mozilla ≫ Bugzilla Version2.22.6
Mozilla ≫ Bugzilla Version2.22.7
Mozilla ≫ Bugzilla Version3.0
Mozilla ≫ Bugzilla Version3.0.1
Mozilla ≫ Bugzilla Version3.0.2
Mozilla ≫ Bugzilla Version3.0.3
Mozilla ≫ Bugzilla Version3.0.4
Mozilla ≫ Bugzilla Version3.0.5
Mozilla ≫ Bugzilla Version3.0.6
Mozilla ≫ Bugzilla Version3.0.7
Mozilla ≫ Bugzilla Version3.0.8
Mozilla ≫ Bugzilla Version3.0.9
Mozilla ≫ Bugzilla Version3.0.10
Mozilla ≫ Bugzilla Version3.0.11
Mozilla ≫ Bugzilla Version3.2
Mozilla ≫ Bugzilla Version3.2.1
Mozilla ≫ Bugzilla Version3.2.2
Mozilla ≫ Bugzilla Version3.2.3
Mozilla ≫ Bugzilla Version3.2.4
Mozilla ≫ Bugzilla Version3.2.5
Mozilla ≫ Bugzilla Version3.2.6
Mozilla ≫ Bugzilla Version3.2.7
Mozilla ≫ Bugzilla Version3.2.8
Mozilla ≫ Bugzilla Version3.2.9
Mozilla ≫ Bugzilla Version3.2.10
Mozilla ≫ Bugzilla Version3.4
Mozilla ≫ Bugzilla Version3.4.1
Mozilla ≫ Bugzilla Version3.4.2
Mozilla ≫ Bugzilla Version3.4.3
Mozilla ≫ Bugzilla Version3.4.5
Mozilla ≫ Bugzilla Version3.4.6
Mozilla ≫ Bugzilla Version3.4.7
Mozilla ≫ Bugzilla Version3.4.8
Mozilla ≫ Bugzilla Version3.4.9
Mozilla ≫ Bugzilla Version3.4.10
Mozilla ≫ Bugzilla Version3.4.11
Mozilla ≫ Bugzilla Version3.4.12
Mozilla ≫ Bugzilla Version3.4.13
Mozilla ≫ Bugzilla Version3.4.14
Mozilla ≫ Bugzilla Version3.6
Mozilla ≫ Bugzilla Version3.6.1
Mozilla ≫ Bugzilla Version3.6.2
Mozilla ≫ Bugzilla Version3.6.3
Mozilla ≫ Bugzilla Version3.6.4
Mozilla ≫ Bugzilla Version3.6.5
Mozilla ≫ Bugzilla Version3.6.6
Mozilla ≫ Bugzilla Version3.6.7
Mozilla ≫ Bugzilla Version3.6.8
Mozilla ≫ Bugzilla Version3.6.9
Mozilla ≫ Bugzilla Version3.6.10
Mozilla ≫ Bugzilla Version3.6.11
Mozilla ≫ Bugzilla Version3.6.12
Mozilla ≫ Bugzilla Version3.6.13
Mozilla ≫ Bugzilla Version4.0
Mozilla ≫ Bugzilla Version4.0.1
Mozilla ≫ Bugzilla Version4.0.2
Mozilla ≫ Bugzilla Version4.0.3
Mozilla ≫ Bugzilla Version4.0.4
Mozilla ≫ Bugzilla Version4.0.5
Mozilla ≫ Bugzilla Version4.0.6
Mozilla ≫ Bugzilla Version4.0.7
Mozilla ≫ Bugzilla Version4.0.8
Mozilla ≫ Bugzilla Version4.0.9
Mozilla ≫ Bugzilla Version4.0.10
Mozilla ≫ Bugzilla Version4.0.11
Mozilla ≫ Bugzilla Version4.0.12
Mozilla ≫ Bugzilla Version4.0.13
Mozilla ≫ Bugzilla Version4.0.14
Mozilla ≫ Bugzilla Version4.0.15
Mozilla ≫ Bugzilla Version4.0.16
Mozilla ≫ Bugzilla Version4.0.17
Mozilla ≫ Bugzilla Version4.0.18
Mozilla ≫ Bugzilla Version4.2
Mozilla ≫ Bugzilla Version4.2.1
Mozilla ≫ Bugzilla Version4.2.2
Mozilla ≫ Bugzilla Version4.2.3
Mozilla ≫ Bugzilla Version4.2.4
Mozilla ≫ Bugzilla Version4.2.5
Mozilla ≫ Bugzilla Version4.2.6
Mozilla ≫ Bugzilla Version4.2.7
Mozilla ≫ Bugzilla Version4.2.8
Mozilla ≫ Bugzilla Version4.2.9
Mozilla ≫ Bugzilla Version4.2.10
Mozilla ≫ Bugzilla Version4.2.11
Mozilla ≫ Bugzilla Version4.2.12
Mozilla ≫ Bugzilla Version4.2.13
Mozilla ≫ Bugzilla Version4.2.14
Mozilla ≫ Bugzilla Version4.2.15
Mozilla ≫ Bugzilla Version4.4
Mozilla ≫ Bugzilla Version4.4.1
Mozilla ≫ Bugzilla Version4.4.2
Mozilla ≫ Bugzilla Version4.4.3
Mozilla ≫ Bugzilla Version4.4.4
Mozilla ≫ Bugzilla Version4.4.5
Mozilla ≫ Bugzilla Version4.4.6
Mozilla ≫ Bugzilla Version4.4.7
Mozilla ≫ Bugzilla Version4.4.8
Mozilla ≫ Bugzilla Version4.4.9
Mozilla ≫ Bugzilla Version4.4.10
Mozilla ≫ Bugzilla Version5.0
Mozilla ≫ Bugzilla Version5.0.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.48% 0.705
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.7 1.6 2.7
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
nvd@nist.gov 2.6 4.9 2.9
AV:N/AC:H/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

http://packetstormsecurity.com/files/135048/Bugzilla-Cross-Site-Scripting-Information-Leak.html
http://seclists.org/bugtraq/2015/Dec/131
http://www.securityfocus.com/bid/79660
http://www.securitytracker.com/id/1034556
https://bugzilla.mozilla.org/show_bug.cgi?id=1221518
Vendor Advisory
Exploit
https://www.bugzilla.org/security/4.2.15/