A Bugzilla Security Advisory reports:

• Sometimes the information put into the

  and

  tags in Bugzilla was not properly escaped, leading to a possible XSS vulnerability.

• Bugzilla administrators were allowed to put raw, unfiltered HTML into many fields in Bugzilla, leading to a possible XSS vulnerability. Now, the HTML allowed in those fields is limited.
• attachment.cgi could leak the names of private attachments
• The "deadline" field was visible in the XML format of a bug, even to users who were not a member of the "timetrackinggroup."
• A malicious user could pass a URL to an admin, and make the admin delete or change something that he had not intended to delete or change.
• It is possible to inject arbitrary HTML into the showdependencygraph.cgi page, allowing for a cross-site scripting attack.

> 2.* lt 2.22.1

A Bugzilla advisory states:

This advisory covers a single cross-site scripting issue that has recently been discovered and fixed in the Bugzilla code: If a malicious user links to a Bugzilla site using a specially crafted URL, a script in the error page generated by Bugzilla will display the URL unaltered in the page, allowing scripts embedded in the URL to execute.

< 2.16.8

>= 2.17.* lt 2.18