CVE-2006-2420
published 2006-05-16CVE-2006-2420: Bugzilla 2.20rc1 through 2.20 and 2.21.1, when using RSS 1.0, allows remote attackers to conduct cross-site scripting (XSS) attacks via a title element with…
PriorityP413medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
1.54%
72.2th percentile
Bugzilla 2.20rc1 through 2.20 and 2.21.1, when using RSS 1.0, allows remote attackers to conduct cross-site scripting (XSS) attacks via a title element with HTML encoded sequences such as ">", which are automatically decoded by some RSS readers. NOTE: this issue is not in Bugzilla itself, but rather due to design or documentation inconsistencies within RSS, or implementation vulnerabilities in RSS readers. While this issue normally would not be included in CVE, it is being identified since the Bugzilla developers have addressed it.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://marc.info/?l=bugtraq&m=112818466125484&w=2http://secunia.com/advisories/18979http://www.bugzilla.org/security/2.18.4http://www.osvdb.org/23379https://bugzilla.mozilla.org/show_bug.cgi?id=313441https://exchange.xforce.ibmcloud.com/vulnerabilities/24820http://marc.info/?l=bugtraq&m=112818466125484&w=2http://secunia.com/advisories/18979http://www.bugzilla.org/security/2.18.4http://www.osvdb.org/23379https://bugzilla.mozilla.org/show_bug.cgi?id=313441https://exchange.xforce.ibmcloud.com/vulnerabilities/24820
2006-05-16
Published