vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2011-0048

N/A
Published: January 28, 2011 at 03:00 PM UTC
Updated: June 16, 2026 at 11:26 PM UTC
1 product affected across 1 vendorBugzilla

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
N/A
Exploit prediction
EPSS 2%

Description

Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 creates a clickable link for a (1) javascript: or (2) data: URI in the URL (aka bug_file_loc) field, which allows remote attackers to conduct cross-site scripting (XSS) attacks against logged-out users via a crafted URI.

References (12)

Vendor Advisoryx_refsource_FEDORA
Source: [email protected]
http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053665.html
Vendor Advisoryx_refsource_FEDORA
Source: [email protected]
http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053678.html
VDB Entryx_refsource_OSVDB
Source: [email protected]
http://osvdb.org/70704
Third Party Advisoryx_refsource_SECUNIAVendor Advisory
Source: [email protected]
http://secunia.com/advisories/43033
Third Party Advisoryx_refsource_SECUNIA
Source: [email protected]
http://secunia.com/advisories/43165
x_refsource_CONFIRMVendor Advisory
Source: [email protected]
http://www.bugzilla.org/security/3.2.9/
Vendor Advisoryx_refsource_DEBIAN
Source: [email protected]
http://www.debian.org/security/2011/dsa-2322
VDB Entryx_refsource_BID
Source: [email protected]
http://www.securityfocus.com/bid/45982

CVSS

4.3MEDIUM[email protected]
Confidentiality
NONE
Integrity
PARTIAL
Availability
NONE
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-79

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card