CVE-2012-3981
published 2012-09-04CVE-2012-3981: Auth/Verify/LDAP.pm in Bugzilla 2.x and 3.x before 3.6.11, 3.7.x and 4.0.x before 4.0.8, 4.1.x and 4.2.x before 4.2.3, and 4.3.x before 4.3.3 does not restrict…
PriorityP424medium5CVSS 2.0
AVNACLAuNCNIPAN
EPSS
1.74%
75.4th percentile
Auth/Verify/LDAP.pm in Bugzilla 2.x and 3.x before 3.6.11, 3.7.x and 4.0.x before 4.0.8, 4.1.x and 4.2.x before 4.2.3, and 4.3.x before 4.3.3 does not restrict the characters in a username, which might allow remote attackers to inject data into an LDAP directory via a crafted login attempt.
Affected
152 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
| mozilla | bugzilla | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2013-0785 CVE-2013-0786 bugzilla: XSS and information leak flaws fixed in 3.6.13/4.0.10/4.2.5/4.4rc2
bugzilla·2013-02-21·CVSS 4.3
CVE-2013-0785 [MEDIUM] CVE-2013-0785 CVE-2013-0786 bugzilla: XSS and information leak flaws fixed in 3.6.13/4.0.10/4.2.5/4.4rc2
CVE-2013-0785 CVE-2013-0786 bugzilla: XSS and information leak flaws fixed in 3.6.13/4.0.10/4.2.5/4.4rc2
Two flaws were reported as fixed in upstream bugzilla [1]:
Vulnerability Details
Class: Cross-Site Scripting
Versions: 2.0 to 3.6.12, 3.7.1 to 4.0.9, 4.1.1 to 4.2.4,
4.3.1 to 4.4rc1
Fixed In: 3.6.13, 4.0.10, 4.2.5, 4.4rc2
Description: When viewing a single bug report, which is the default,
the bug ID is validated and rejected if it is invalid.
But when viewing several bug reports at once, which is
specified by the format=multiple parameter, invalid bug
IDs can go through and are sanitized in the HTML page
itself. But when an invalid page format is passed to the
CGI script, the wrong HTML page is called and data are not
correctly sanitized, which can lead to XSS.
References: https://b
Bugzilla
CVE-2012-3981 CVE-2012-4747 bugzilla: LDAP injection and disclosure of sensitive information
bugzilla·2012-09-03·CVSS 5.0
CVE-2012-3981 [MEDIUM] CVE-2012-3981 CVE-2012-4747 bugzilla: LDAP injection and disclosure of sensitive information
CVE-2012-3981 CVE-2012-4747 bugzilla: LDAP injection and disclosure of sensitive information
1) Common Vulnerabilities and Exposures assigned an identifier CVE-2012-3981 to the following vulnerability:
Auth/Verify/LDAP.pm in Bugzilla 2.x and 3.x before 3.6.11, 3.7.x and 4.0.x before 4.0.8, 4.1.x and 4.2.x before 4.2.3, and 4.3.x before 4.3.3 does not restrict the characters in a username, which might allow remote attackers to inject data into an LDAP directory via a crafted login attempt.
Upstream advisory:
[1] http://www.bugzilla.org/security/3.6.10/
Upstream bug report:
[2] https://bugzilla.mozilla.org/show_bug.cgi?id=785470
Upstream patches:
[3] http://bzr.mozilla.org/bugzilla/trunk/revision/8370
(against trunk)
[4] http://bzr.mozilla.org/bugzilla/4.2/revision/8132
(against 4.2 bra
Bugzilla
CVE-2012-3981 CVE-2012-4747 bugzilla: various flaws [epel-all]
bugzilla·2012-09-03·CVSS 5.0
CVE-2012-3981 [MEDIUM] CVE-2012-3981 CVE-2012-4747 bugzilla: various flaws [epel-all]
CVE-2012-3981 CVE-2012-4747 bugzilla: various flaws [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include this bug ID and the
bug IDs of this bug's parent bugs filed against the "Security Response"
product (the top-level CVE bugs). Please mention the CVE IDs being fixed
in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/updates/new/?type_=security&bugs=853868
http://osvdb.org/85072http://www.bugzilla.org/security/3.6.10/http://www.mandriva.com/security/advisories?name=MDVSA-2013:066https://bugzilla.mozilla.org/show_bug.cgi?id=785112https://bugzilla.mozilla.org/show_bug.cgi?id=785470https://exchange.xforce.ibmcloud.com/vulnerabilities/78193http://osvdb.org/85072http://www.bugzilla.org/security/3.6.10/http://www.mandriva.com/security/advisories?name=MDVSA-2013:066https://bugzilla.mozilla.org/show_bug.cgi?id=785112https://bugzilla.mozilla.org/show_bug.cgi?id=785470https://exchange.xforce.ibmcloud.com/vulnerabilities/78193
2012-09-04
Published