Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Bugzilla 2.20rc1 through 2.20 and 2.21.1, when using RSS 1.0, allows remote attackers to conduct cross-site scripting (XSS) attacks via a title element with HTML encoded sequences such as ">", which are automatically decoded by some RSS readers. NOTE: this issue is not in Bugzilla itself, but rather due to design or documentation inconsistencies within RSS, or implementation vulnerabilities in RSS readers. While this issue normally would not be included in CVE, it is being identified since the Bugzilla developers have addressed it.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Bugzilla RSS阅读器 跨站脚本(XSS) 攻击
Vulnerability Description
Bugzilla 2.20rc1到2.20 和 2.21.1在使用RSS 1.0时，可以使远程攻击者借助带有HTML编码的">"等序列的，可由某些RSS阅读器自动解码的标题元素，进行跨站脚本(XSS) 攻击。注意：此问题不在于Bugzilla自身，而是由RSS内的设计或文档不一致，或RSS阅读器中的执行漏洞所致。虽然这种问题一般不纳入CVE，但由于Bugzilla开发者已经作了处理，所以对此进行了认定。
CVSS Information
N/A
Vulnerability Type
N/A