Vulnerabilities > Mozilla > Bugzilla > 2.17
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2005-05-12 | CVE-2005-1564 | Remote Security vulnerability in Bugzilla post_bug.cgi in Bugzilla 2.10 through 2.18, 2.19.1, and 2.19.2 allows remote authenticated users to "enter bugs into products that are closed for bug entry" by modifying the URL to specify the name of the product. | 7.5 |
| 2005-01-04 | CVE-2004-1061 | Cross-Site Scripting vulnerability in Bugzilla Internal Error Cross-site scripting (XSS) vulnerability in Bugzilla before 2.18, including 2.16.x before 2.16.11, allows remote attackers to inject arbitrary HTML and web script via forced error messages, as demonstrated using the action parameter. network mozilla | 4.3 |
| 2004-10-25 | CVE-2004-1634 | Authentication Bypass and Information Disclosure vulnerability in Mozilla Bugzilla show_bug.cgi in Bugzilla 2.17.1 through 2.18rc2 and 2.19 from CVS, when using the insidergroup feature and exporting a bug to XML, shows comments and attachment summaries which are marked as private, which allows remote attackers to gain sensitive information. | 5.0 |
| 2004-10-25 | CVE-2004-1633 | Remote Security vulnerability in Bugzilla process_bug.cgi in Bugzilla 2.9 through 2.18rc2 and 2.19 from CVS does not check edit permissions on the keywords field, which allows remote authenticated users to modify the keywords in a bug via the keywordaction parameter. | 5.0 |
| 2004-10-24 | CVE-2004-1635 | Authentication Bypass and Information Disclosure vulnerability in Mozilla Bugzilla Bugzilla 2.17.1 through 2.18rc2 and 2.19 from cvs, when using the insidergroup feature, does not sufficiently protect private attachments when there are changes to the metadata, such as filename, description, MIME type, or review flags, which allows remote authenticated users to obtain sensitive information when (1) viewing the bug activity log or (2) receiving bug change notification mails. | 5.0 |
| 2004-07-27 | CVE-2004-0707 | Unspecified vulnerability in Mozilla Bugzilla SQL injection vulnerability in editusers.cgi in Bugzilla 2.16.x before 2.16.6, and 2.18 before 2.18rc1, allows remote attackers with privileges to grant membership to any group to execute arbitrary SQL. | 7.5 |
| 2004-07-27 | CVE-2004-0706 | Unspecified vulnerability in Mozilla Bugzilla Bugzilla 2.17.5 through 2.17.7 embeds the password in an image URL, which could allow local users to view the password in the web server log files. | 2.1 |
| 2004-07-27 | CVE-2004-0705 | Multiple cross-site scripting (XSS) vulnerabilities in (1) editcomponents.cgi, (2) editgroups.cgi, (3) editmilestones.cgi, (4) editproducts.cgi, (5) editusers.cgi, and (6) editversions.cgi in Bugzilla 2.16.x before 2.16.6, and 2.18 before 2.18rc1, allow remote attackers to execute arbitrary JavaScript as other users via a URL parameter. network mozilla | 6.8 |
| 2004-07-27 | CVE-2004-0704 | Unknown vulnerability in (1) duplicates.cgi and (2) buglist.cgi in Bugzilla 2.16.x before 2.16.6, 2.18 before 2.18rc1, when configured to hide products, allows remote attackers to view hidden products. | 5.0 |
| 2004-07-27 | CVE-2004-0703 | Unspecified vulnerability in Mozilla Bugzilla Unknown vulnerability in the administrative controls in Bugzilla 2.17.1 through 2.17.7 allows users with "grant membership" privileges to grant memberships to groups that the user does not control. | 7.5 |