CVE-2014-1572

Related Files

Mandriva Linux Security Advisory 2014-200

Posted Oct 21, 2014

Authored by Mandriva | Site mandriva.com

Mandriva Linux Security Advisory 2014-200 - If a new comment was marked private to the insider group, and a flag was set in the same transaction, the comment would be visible to flag recipients even if they were not in the insider group. An attacker creating a new Bugzilla account can override certain parameters when finalizing the account creation that can lead to the user being created with a different email address than originally requested. The overridden login name could be automatically added to groups based on the group's regular expression setting. During an audit of the Bugzilla code base, several places were found where cross-site scripting exploits could occur which could allow an attacker to access sensitive information.

tags | advisory, xss

systems | linux, mandriva

advisories | CVE-2014-1571, CVE-2014-1572, CVE-2014-1573

SHA-256 | 61c8f38894850ae966a1583e1ba4b90ec2c9300c03912a57fe10569160797a9e

Download | Favorite | View

Bugzilla Account Creation / XSS / Information Leak

Posted Oct 7, 2014

Authored by Frederic Buclin, Byron Jones, David Lawrence, Netanel Rubin, Simon Green, James Kettle, Matt Tyson | Site bugzilla.org

Bugzilla Security Advisory - Bugzilla versions 2.23.3 to 4.0.14, 4.1.1 to 4.2.10, 4.3.1 to 4.4.5, and 4.5.1 to 4.5.5 suffer from unauthorized account creation, cross site scripting, and information leak vulnerabilities.

tags | advisory, vulnerability, xss, info disclosure

advisories | CVE-2014-1571, CVE-2014-1572, CVE-2014-1573

SHA-256 | 0d0e7c27532f6562403faf6ddb1249c6fce16ba6525feadfe7c92217191a6748

Download | Favorite | View