Simranjeet Singh

**Name of the Vulnerable Software and Affected Versions** Bugzilla versions prior to 3.6.13 Bugzilla versions 3.7.x Bugzilla versions 4.0.x prior to 4.0.10 Bugzilla versions 4.1.x Bugzilla versions 4.2.x prior to 4.2.5 Bugzilla versions 4.3.x Bugzilla versions 4.4.x prior to 4.4rc2 **Description** A cross-site scripting (XSS) issue exists, allowing remote attackers to inject arbitrary web script or HTML via the `id` parameter in conjunction with an invalid value of the `format` parameter in the show bug.cgi script. **Recommendations** For versions prior to 3.6.13, update to version 3.6.13 or later. For versions 3.7.x, update to a version outside of the 3.7.x range. For versions 4.0.x prior to 4.0.10, update to version 4.0.10 or later. For versions 4.1.x, update to a version outside of the 4.1.x range. For versions 4.2.x prior to 4.2.5, update to version 4.2.5 or later. For versions 4.3.x, update to a version outside of the 4.3.x range. For versions 4.4.x prior to 4.4rc2, update to version 4.4rc2 or later.