bugzilla: SQL injection
| Package(s): | bugzilla | CVE #(s): | CVE-2009-3125 CVE-2009-3165 CVE-2009-3166 | ||||||||||||||||
| Created: | September 21, 2009 | Updated: | June 4, 2010 | ||||||||||||||||
| Description: | From the Bugzilla advisory:
* Two SQL injection attacks have been discovered in Bugzilla. One only affects the 3.4 series, while the other affects the 3.0, 3.2, and 3.4 series. These are extremely serious vulnerabilities that must be patched immediately. * When a user would change his password, his new password would be exposed in the URL field of the browser if he logged in right after changing his password. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||