cpe:2.3:a:mozilla:bugzilla:2.14.2:*:*:*:*:*:*:*
show_bug.cgi in Bugzilla 2.17.1 through 2.18rc2 and 2.19 from CVS, when using the insidergroup feature and exporting a bug to XML, shows comments and attachment summaries which are marked as private, which allows remote attackers to gain sensitive information.
Max CVSS
5.0
EPSS Score
0.25%
Published
2004-10-25
Updated
2017-07-11
process_bug.cgi in Bugzilla 2.9 through 2.18rc2 and 2.19 from CVS does not check edit permissions on the keywords field, which allows remote authenticated users to modify the keywords in a bug via the keywordaction parameter.
Max CVSS
5.0
EPSS Score
0.29%
Published
2004-10-25
Updated
2017-07-11
SQL injection vulnerability in editusers.cgi in Bugzilla 2.16.x before 2.16.6, and 2.18 before 2.18rc1, allows remote attackers with privileges to grant membership to any group to execute arbitrary SQL.
Max CVSS
7.5
EPSS Score
0.16%
Published
2004-07-27
Updated
2017-07-11
Bugzilla 2.17.5 through 2.17.7 embeds the password in an image URL, which could allow local users to view the password in the web server log files.
Max CVSS
2.1
EPSS Score
0.04%
Published
2004-07-27
Updated
2017-07-11
Unknown vulnerability in the administrative controls in Bugzilla 2.17.1 through 2.17.7 allows users with "grant membership" privileges to grant memberships to groups that the user does not control.
Max CVSS
7.5
EPSS Score
0.24%
Published
2004-07-27
Updated
2017-07-11
DBI in Bugzilla 2.17.1 through 2.17.7 displays the database password in an error message when the SQL server is not running, which could allow remote attackers to gain sensitive information.
Max CVSS
5.0
EPSS Score
0.21%
Published
2004-07-27
Updated
2017-07-11
describecomponents.cgi in Bugzilla 2.17.3 and 2.17.4 does not properly verify group membership when bug entry groups are used, which allows remote attackers to list component descriptions for otherwise restricted products.
Max CVSS
7.5
EPSS Score
0.56%
Published
2004-08-18
Updated
2017-07-11
votes.cgi in Bugzilla 2.16.3 and earlier, and 2.17.1 through 2.17.4, allows remote attackers to read a user's voting page when that user has voted on a restricted bug, which allows remote attackers to read potentially sensitive voting information by modifying the who parameter.
Max CVSS
5.0
EPSS Score
2.08%
Published
2004-08-18
Updated
2017-07-11
editproducts.cgi in Bugzilla 2.16.3 and earlier, when usebuggroups is enabled, does not properly remove group add privileges from a group that is being deleted, which allows users with those privileges to perform unauthorized additions to the next group that is assigned with the original group ID.
Max CVSS
7.5
EPSS Score
0.54%
Published
2004-08-18
Updated
2017-07-11
SQL injection vulnerability in Bugzilla 2.16.3 and earlier, and 2.17.1 through 2.17.4, allows remote authenticated users with editkeywords privileges to execute arbitrary SQL via the id parameter to editkeywords.cgi.
Max CVSS
10.0
EPSS Score
0.32%
Published
2004-08-18
Updated
2017-07-11
SQL injection vulnerability in collectstats.pl for Bugzilla 2.16.3 and earlier allows remote authenticated users with editproducts privileges to execute arbitrary SQL via the product name.
Max CVSS
10.0
EPSS Score
0.32%
Published
2004-08-18
Updated
2017-07-11
11 vulnerabilities found
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!