Show filters
59 Total Results
Displaying 51-59 of 59
Sort by:
Attacker Value
Unknown
CVE-2004-0707
Disclosure Date: July 27, 2004 (last updated February 22, 2025)
SQL injection vulnerability in editusers.cgi in Bugzilla 2.16.x before 2.16.6, and 2.18 before 2.18rc1, allows remote attackers with privileges to grant membership to any group to execute arbitrary SQL.
0
Attacker Value
Unknown
CVE-2004-0703
Disclosure Date: July 27, 2004 (last updated February 22, 2025)
Unknown vulnerability in the administrative controls in Bugzilla 2.17.1 through 2.17.7 allows users with "grant membership" privileges to grant memberships to groups that the user does not control.
0
Attacker Value
Unknown
CVE-2004-0706
Disclosure Date: July 27, 2004 (last updated February 22, 2025)
Bugzilla 2.17.5 through 2.17.7 embeds the password in an image URL, which could allow local users to view the password in the web server log files.
0
Attacker Value
Unknown
CVE-2004-0702
Disclosure Date: July 27, 2004 (last updated February 22, 2025)
DBI in Bugzilla 2.17.1 through 2.17.7 displays the database password in an error message when the SQL server is not running, which could allow remote attackers to gain sensitive information.
0
Attacker Value
Unknown
CVE-2003-0602
Disclosure Date: August 27, 2003 (last updated February 22, 2025)
Multiple cross-site scripting vulnerabilities (XSS) in Bugzilla 2.16.x before 2.16.3 and 2.17.x before 2.17.4 allow remote attackers to insert arbitrary HTML or web script via (1) multiple default German and Russian HTML templates or (2) ALT and NAME attributes in AREA tags as used by the GraphViz graph generation feature for local dependency graphs.
0
Attacker Value
Unknown
CVE-2003-0603
Disclosure Date: August 27, 2003 (last updated February 22, 2025)
Bugzilla 2.16.x before 2.16.3, 2.17.x before 2.17.4, and earlier versions allows local users to overwrite arbitrary files via a symlink attack on temporary files that are created in directories with group-writable or world-writable permissions.
0
Attacker Value
Unknown
CVE-2003-0013
Disclosure Date: January 17, 2003 (last updated February 22, 2025)
The default .htaccess scripts for Bugzilla 2.14.x before 2.14.5, 2.16.x before 2.16.2, and 2.17.x before 2.17.3 do not include filenames for backup copies of the localconfig file that are made from editors such as vi and Emacs, which could allow remote attackers to obtain a database password by directly accessing the backup file.
0
Attacker Value
Unknown
CVE-2003-0012
Disclosure Date: January 17, 2003 (last updated February 22, 2025)
The data collection script for Bugzilla 2.14.x before 2.14.5, 2.16.x before 2.16.2, and 2.17.x before 2.17.3 sets world-writable permissions for the data/mining directory when it runs, which allows local users to modify or delete the data.
0
Attacker Value
Unknown
CVE-2002-2260
Disclosure Date: December 31, 2002 (last updated February 22, 2025)
Cross-site scripting (XSS) vulnerability in the quips feature in Mozilla Bugzilla 2.10 through 2.17 allows remote attackers to inject arbitrary web script or HTML via the "show all quips" page.
0
