CVE-2011-2976

Mozilla Bugzilla - XSS

Title source: rule

Description

Cross-site scripting (XSS) vulnerability in Bugzilla 2.16rc1 through 2.22.7, 3.0.x through 3.3.x, and 3.4.x before 3.4.12 allows remote attackers to inject arbitrary web script or HTML via vectors involving a BUGLIST cookie.

References (6)

[Vendor Advisory] http://secunia.com/advisories/45501

[Vendor Advisory] http://www.bugzilla.org/security/3.4.11/

[Patch] https://bugzilla.mozilla.org/show_bug.cgi?id=660053

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/69038

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/49042

[Third Party Advisory, VDB Entry] http://www.osvdb.org/74303

Scores

EPSS 0.0044

EPSS Percentile 63.0%

Classification

CWE

CWE-79

Status published

Affected Products (50)

mozilla/bugzilla

... and 35 more

Timeline

Published Aug 09, 2011

Tracked Since Feb 18, 2026