| Bugzilla has a number of vulnerabilities. From the Fedora alerts:
Directory traversal vulnerability in importxml.pl in Bugzilla before 2.22.5,
and 3.x before 3.0.5, when --attach_path is enabled, allows remote attackers to
read arbitrary files via an XML file with a .. (dot dot) in the data element. (CVE-2008-4437)
Bugzilla 3.2 before 3.2 RC2, 3.0 before 3.0.6, 2.22 before 2.22.6,
2.20 before 2.20.7, and other versions after 2.17.4 allows remote
authenticated users to bypass moderation to approve and disapprove
quips via a direct request to quips.cgi with the action parameter set
to "approve." (CVE-2008-6098)
Bugzilla 2.x before 2.22.7, 3.0 before 3.0.7, 3.2 before 3.2.1, and
3.3 before 3.3.2 allows remote authenticated users to conduct
cross-site scripting (XSS) and related attacks by uploading HTML and
JavaScript attachments that are rendered by web browsers. (CVE-2009-0481)
Cross-site request forgery (CSRF) vulnerability in Bugzilla before 3.2
before 3.2.1, 3.3 before 3.3.2, and other versions before 3.2 allows
remote attackers to perform bug updating activities as other users via
a link or IMG tag to process_bug.cgi. (CVE-2009-0482)
Cross-site request forgery (CSRF) vulnerability in Bugzilla 2.22
before 2.22.7, 3.0 before 3.0.7, 3.2 before 3.2.1, and 3.3 before
3.3.2 allows remote attackers to delete keywords and user preferences
via a link or IMG tag to (1) editkeywords.cgi or (2) userprefs.cgi. (CVE-2009-0483)
Cross-site request forgery (CSRF) vulnerability in Bugzilla 3.0 before
3.0.7, 3.2 before 3.2.1, and 3.3 before 3.3.2 allows remote attackers
to delete shared or saved searches via a link or IMG tag to
buglist.cgi. (CVE-2009-0484)
Cross-site request forgery (CSRF) vulnerability in Bugzilla 2.17 to
2.22.7, 3.0 before 3.0.7, 3.2 before 3.2.1, and 3.3 before 3.3.2
allows remote attackers to delete unused flag types via a link or IMG
tag to editflagtypes.cgi. (CVE-2009-0485)
Bugzilla 3.2.1, 3.0.7, and 3.3.2, when running under mod_perl, calls
the srand function at startup time, which causes Apache children to
have the same seed and produce insufficiently random numbers for
random tokens, which allows remote attackers to bypass cross-site
request forgery (CSRF) protection mechanisms and conduct unauthorized
activities as other users. (CVE-2009-0486) | 