Multiple cross-site scripting (XSS) vulnerabilities in (1) editcomponents.cgi, (2) editgroups.cgi, (3) editmilestones.cgi, (4) editproducts.cgi, (5) editusers.cgi, and (6) editversions.cgi in Bugzilla 2.16.x before 2.16.6, and 2.18 before 2.18rc1, allow remote attackers to execute arbitrary JavaScript as other users via a URL parameter.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Bugzilla | Mozilla | 2.4 (including) | 2.4 (including) |
| Bugzilla | Mozilla | 2.6 (including) | 2.6 (including) |
| Bugzilla | Mozilla | 2.8 (including) | 2.8 (including) |
| Bugzilla | Mozilla | 2.10 (including) | 2.10 (including) |
| Bugzilla | Mozilla | 2.12 (including) | 2.12 (including) |
| Bugzilla | Mozilla | 2.14 (including) | 2.14 (including) |
| Bugzilla | Mozilla | 2.14.1 (including) | 2.14.1 (including) |
| Bugzilla | Mozilla | 2.14.2 (including) | 2.14.2 (including) |
| Bugzilla | Mozilla | 2.14.3 (including) | 2.14.3 (including) |
| Bugzilla | Mozilla | 2.14.4 (including) | 2.14.4 (including) |
| Bugzilla | Mozilla | 2.14.5 (including) | 2.14.5 (including) |
| Bugzilla | Mozilla | 2.16 (including) | 2.16 (including) |
| Bugzilla | Mozilla | 2.16.1 (including) | 2.16.1 (including) |
| Bugzilla | Mozilla | 2.16.2 (including) | 2.16.2 (including) |
| Bugzilla | Mozilla | 2.16.3 (including) | 2.16.3 (including) |
| Bugzilla | Mozilla | 2.16.4 (including) | 2.16.4 (including) |
| Bugzilla | Mozilla | 2.16.5 (including) | 2.16.5 (including) |
| Bugzilla | Mozilla | 2.17 (including) | 2.17 (including) |
| Bugzilla | Mozilla | 2.17.1 (including) | 2.17.1 (including) |
| Bugzilla | Mozilla | 2.17.3 (including) | 2.17.3 (including) |
| Bugzilla | Mozilla | 2.17.4 (including) | 2.17.4 (including) |
| Bugzilla | Mozilla | 2.17.5 (including) | 2.17.5 (including) |
| Bugzilla | Mozilla | 2.17.6 (including) | 2.17.6 (including) |
| Bugzilla | Mozilla | 2.17.7 (including) | 2.17.7 (including) |