Mario Gomes

The issue allows for phishing attacks by spoofing the displayed URL in the address bar when a specially formatted URL is dragged from page content. This enables a malicious page to impersonate another site.

The issue is related to a use-after-free vulnerability that allows remote attackers to execute arbitrary code. This is achieved via an object with a revision number of -1 in a PDF document.

The issue allows remote attackers to obtain sensitive information by leveraging a web browser that interprets CSV data as JavaScript code, due to improper construction of CSV files in the Template.pm module.

The issue is related to a lack of protection for service data, allowing a remote attacker to bypass existing access restrictions and execute a redirect to a specified URL using specially crafted JavaScript code. This can be achieved when a user performs a drag-and-drop action of an image into a TEXTBOX element, allowing the attacker to discover the target URL of a redirect.

The issue allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted web site.

The issue allows remote attackers to bypass cross-site scripting (XSS) protection mechanisms. This is achieved via a feed:javascript: URL, which is not properly handled in terms of its security context.

The issue affects the drag-and-drop implementation, allowing remote attackers to spoof the address bar by canceling a page load.

A cross-site request forgery issue affects the xmlrpc.cgi component in Bugzilla when mod perl is used. This allows remote attackers to hijack the authentication of arbitrary users for requests that modify the product's installation via the XML-RPC API.

A cross-site request forgery (CSRF) issue exists, allowing remote attackers to hijack the authentication of arbitrary users for requests that use the JSON-RPC API.

A cross-site request forgery issue exists, allowing remote attackers to hijack user authentication for uploading attachments.

A cross-site request forgery issue allows remote attackers to hijack the authentication of arbitrary users for requests that create bug reports.

The issue is related to improper garbage collection during the processing of PDF documents, which can be exploited by remote attackers using a crafted document. This can lead to a denial of service or possibly have other unspecified impacts.