cbcvebase.
CVE-2011-0048
published 2011-01-28

CVE-2011-0048: Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 creates a clickable link for a (1) javascript: or (2) data: URI in the…

PriorityP417medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
1.79%
76.0th percentile
Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 creates a clickable link for a (1) javascript: or (2) data: URI in the URL (aka bug_file_loc) field, which allows remote attackers to conduct cross-site scripting (XSS) attacks against logged-out users via a crafted URI.

Affected

98 ranges· showing 25
VendorProductVersion rangeFixed in
mozillabugzilla<= 3.2.9—
mozillabugzilla——
mozillabugzilla——
mozillabugzilla——
mozillabugzilla——
mozillabugzilla——
mozillabugzilla——
mozillabugzilla——
mozillabugzilla——
mozillabugzilla——
mozillabugzilla——
mozillabugzilla——
mozillabugzilla——
mozillabugzilla——
mozillabugzilla——
mozillabugzilla——
mozillabugzilla——
mozillabugzilla——
mozillabugzilla——
mozillabugzilla——
mozillabugzilla——
mozillabugzilla——
mozillabugzilla——
mozillabugzilla——
mozillabugzilla——
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.