Mozilla

Bugzilla

145 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
8.8

CVE-2018-5123

Exploit
  • EPSS 0.14%
  • Published 29.04.2019 16:29:00
  • Last modified 21.11.2024 04:08:09

A third party website can access information available to a user with access to a restricted bug entry using the image generation in report.cgi in all Bugzilla versions prior to 4.4.

6.1

CVE-2016-2803

  • EPSS 0.39%
  • Published 12.04.2017 22:59:00
  • Last modified 20.04.2025 01:37:25

Cross-site scripting (XSS) vulnerability in the dependency graphs in Bugzilla 2.16rc1 through 4.4.11, and 4.5.1 through 5.0.2 allows remote attackers to inject arbitrary web script or HTML.

4.3

CVE-2015-8509

Exploit
  • EPSS 0.16%
  • Published 03.01.2016 05:59:11
  • Last modified 12.04.2025 10:46:40

Template.pm in Bugzilla 2.x, 3.x, and 4.x before 4.2.16, 4.3.x and 4.4.x before 4.4.11, and 4.5.x and 5.0.x before 5.0.2 does not properly construct CSV files, which allows remote attackers to obtain sensitive information by leveraging a web browser ...

4.7

CVE-2015-8508

Exploit
  • EPSS 0.27%
  • Published 03.01.2016 05:59:10
  • Last modified 12.04.2025 10:46:40

Cross-site scripting (XSS) vulnerability in showdependencygraph.cgi in Bugzilla 2.x, 3.x, and 4.x before 4.2.16, 4.3.x and 4.4.x before 4.4.11, and 4.5.x and 5.0.x before 5.0.2, when a local dot configuration is used, allows remote attackers to injec...

7.5

CVE-2015-4499

Exploit
  • EPSS 2.11%
  • Published 14.09.2015 01:59:01
  • Last modified 12.04.2025 10:46:40

Util.pm in Bugzilla 2.x, 3.x, and 4.x before 4.2.15, 4.3.x and 4.4.x before 4.4.10, and 5.x before 5.0.1 mishandles long e-mail addresses during account registration, which allows remote attackers to obtain the default privileges for an arbitrary dom...

6.5

CVE-2014-8630

  • EPSS 0.63%
  • Published 01.02.2015 15:59:04
  • Last modified 12.04.2025 10:46:40

Bugzilla before 4.0.16, 4.1.x and 4.2.x before 4.2.12, 4.3.x and 4.4.x before 4.4.7, and 5.x before 5.0rc1 allows remote authenticated users to execute arbitrary commands by leveraging the editcomponents privilege and triggering crafted input to a tw...

4.3

CVE-2014-1573

  • EPSS 0.87%
  • Published 13.10.2014 01:55:07
  • Last modified 12.04.2025 10:46:40

Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 does not ensure that a scalar context is used for certain CGI parameters, which allows remote attackers to conduct cross-sit...

5

CVE-2014-1572

  • EPSS 1.1%
  • Published 13.10.2014 01:55:06
  • Last modified 12.04.2025 10:46:40

The confirm_create_account function in the account-creation feature in token.cgi in Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 does not specify a scalar context for th...

4

CVE-2014-1571

  • EPSS 0.5%
  • Published 13.10.2014 01:55:05
  • Last modified 12.04.2025 10:46:40

Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 allows remote authenticated users to obtain sensitive private-comment information by leveraging a role as a flag recipient, ...

4.3

CVE-2014-1546

  • EPSS 0.22%
  • Published 14.08.2014 11:15:23
  • Last modified 12.04.2025 10:46:40

The response function in the JSONP endpoint in WebService/Server/JSONRPC.pm in jsonrpc.cgi in Bugzilla 3.x and 4.x before 4.0.14, 4.1.x and 4.2.x before 4.2.10, 4.3.x and 4.4.x before 4.4.5, and 4.5.x before 4.5.5 accepts certain long callback values...