From 3690d623e47738c2a3e2a2f35d8da917e961d9ea Mon Sep 17 00:00:00 2001 From: Jacques Vidrine Date: Mon, 24 Jan 2005 18:45:43 +0000 Subject: Document Bugzilla XSS issue. --- security/vuxml/vuln.xml | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) (limited to 'security') diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index f513e5b93232..1c8d42d7a5ac 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -32,6 +32,41 @@ EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. --> + + bugzilla -- cross-site scripting vulnerability + + + bugzilla + ja-bugzilla + 2.16.8 + 2.17.*2.18 + + + + +

A Bugzilla advisory states:

+
This advisory covers a single cross-site scripting issue + that has recently been discovered and fixed in the + Bugzilla code: If a malicious user links to a Bugzilla + site using a specially crafted URL, a script in the error + page generated by Bugzilla will display the URL unaltered + in the page, allowing scripts embedded in the URL to + execute.
+

+ + + + CAN-2004-1061 + http://www.bugzilla.org/security/2.16.7-nr/ + https://bugzilla.mozilla.org/show_bug.cgi?id=272620 + + + 2004-12-01 + 2005-01-24 + + + web browsers -- window injection vulnerabilities -- cgit v1.2.3