Mozilla

Bugzilla

145 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
8.8

CVE-2018-5123

Exploit
  • EPSS 0.14%
  • Veröffentlicht 29.04.2019 16:29:00
  • Zuletzt bearbeitet 21.11.2024 04:08:09

A third party website can access information available to a user with access to a restricted bug entry using the image generation in report.cgi in all Bugzilla versions prior to 4.4.

6.1

CVE-2016-2803

  • EPSS 0.39%
  • Veröffentlicht 12.04.2017 22:59:00
  • Zuletzt bearbeitet 20.04.2025 01:37:25

Cross-site scripting (XSS) vulnerability in the dependency graphs in Bugzilla 2.16rc1 through 4.4.11, and 4.5.1 through 5.0.2 allows remote attackers to inject arbitrary web script or HTML.

4.3

CVE-2015-8509

Exploit
  • EPSS 0.16%
  • Veröffentlicht 03.01.2016 05:59:11
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Template.pm in Bugzilla 2.x, 3.x, and 4.x before 4.2.16, 4.3.x and 4.4.x before 4.4.11, and 4.5.x and 5.0.x before 5.0.2 does not properly construct CSV files, which allows remote attackers to obtain sensitive information by leveraging a web browser ...

4.7

CVE-2015-8508

Exploit
  • EPSS 0.27%
  • Veröffentlicht 03.01.2016 05:59:10
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Cross-site scripting (XSS) vulnerability in showdependencygraph.cgi in Bugzilla 2.x, 3.x, and 4.x before 4.2.16, 4.3.x and 4.4.x before 4.4.11, and 4.5.x and 5.0.x before 5.0.2, when a local dot configuration is used, allows remote attackers to injec...

7.5

CVE-2015-4499

Exploit
  • EPSS 2.11%
  • Veröffentlicht 14.09.2015 01:59:01
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Util.pm in Bugzilla 2.x, 3.x, and 4.x before 4.2.15, 4.3.x and 4.4.x before 4.4.10, and 5.x before 5.0.1 mishandles long e-mail addresses during account registration, which allows remote attackers to obtain the default privileges for an arbitrary dom...

6.5

CVE-2014-8630

  • EPSS 0.63%
  • Veröffentlicht 01.02.2015 15:59:04
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Bugzilla before 4.0.16, 4.1.x and 4.2.x before 4.2.12, 4.3.x and 4.4.x before 4.4.7, and 5.x before 5.0rc1 allows remote authenticated users to execute arbitrary commands by leveraging the editcomponents privilege and triggering crafted input to a tw...

4.3

CVE-2014-1573

  • EPSS 0.87%
  • Veröffentlicht 13.10.2014 01:55:07
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 does not ensure that a scalar context is used for certain CGI parameters, which allows remote attackers to conduct cross-sit...

5

CVE-2014-1572

  • EPSS 1.1%
  • Veröffentlicht 13.10.2014 01:55:06
  • Zuletzt bearbeitet 12.04.2025 10:46:40

The confirm_create_account function in the account-creation feature in token.cgi in Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 does not specify a scalar context for th...

4

CVE-2014-1571

  • EPSS 0.5%
  • Veröffentlicht 13.10.2014 01:55:05
  • Zuletzt bearbeitet 12.04.2025 10:46:40

Bugzilla 2.x through 4.0.x before 4.0.15, 4.1.x and 4.2.x before 4.2.11, 4.3.x and 4.4.x before 4.4.6, and 4.5.x before 4.5.6 allows remote authenticated users to obtain sensitive private-comment information by leveraging a role as a flag recipient, ...

4.3

CVE-2014-1546

  • EPSS 0.22%
  • Veröffentlicht 14.08.2014 11:15:23
  • Zuletzt bearbeitet 12.04.2025 10:46:40

The response function in the JSONP endpoint in WebService/Server/JSONRPC.pm in jsonrpc.cgi in Bugzilla 3.x and 4.x before 4.0.14, 4.1.x and 4.2.x before 4.2.10, 4.3.x and 4.4.x before 4.4.5, and 4.5.x before 4.5.5 accepts certain long callback values...