Lpsolit

The issue allows remote attackers to obtain sensitive information by reading HTML source code, specifically in circumstances involving custom-field visibility control. This occurs because the `template/en/default/bug/field-events.js.tmpl` file generates JavaScript function calls containing private product names or private component names.

The issue allows remote attackers to potentially inject data into an LDAP directory via a crafted login attempt due to the lack of character restriction in usernames.

The issue allows remote attackers to determine the existence of private group names via a crafted parameter during bug creation or bug editing.

The issue allows remote attackers to obtain sensitive information by requesting specific files and directories used by custom installations, including (1) `CVS/`, (2) `contrib/`, (3) `docs/en/xml/`, (4) `t/`, or (5) `old-params.txt`.

The issue arises from improper handling of "//" sequences in URLs when redirecting a user from the login form. This could lead to the generation of a partial URL in a form action, causing the user's browser to send form data to another domain.

The issue allows remote attackers to determine hidden products by exploiting a difference in error messages displayed by the software, depending on whether a product exists or not.

The issue allows remote authenticated users to enter bugs into products that are closed for bug entry by modifying the URL to specify the name of the product. This is possible due to a flaw in the post bug.cgi script.