A third party website can access information available to a user with access to a restricted bug entry using the image generation in report.cgi in all Bugzilla versions prior to 4.4.
Max CVSS
8.8
EPSS Score
0.13%
Published
2019-04-29
Updated
2019-05-08
SQL injection vulnerability in Bugzilla 2.16.3 and earlier, and 2.17.1 through 2.17.4, allows remote authenticated users with editkeywords privileges to execute arbitrary SQL via the id parameter to editkeywords.cgi.
Max CVSS
10.0
EPSS Score
0.32%
Published
2004-08-18
Updated
2017-07-11
SQL injection vulnerability in collectstats.pl for Bugzilla 2.16.3 and earlier allows remote authenticated users with editproducts privileges to execute arbitrary SQL via the product name.
Max CVSS
10.0
EPSS Score
0.32%
Published
2004-08-18
Updated
2017-07-11
CGI.pl in Bugzilla before 2.14.1, when using LDAP, allows remote attackers to obtain an anonymous bind to the LDAP server via a request that does not include a password, which causes a null password to be sent to the LDAP server.
Max CVSS
10.0
EPSS Score
1.11%
Published
2002-01-31
Updated
2017-10-10
4 vulnerabilities found