CVE-2010-1204: Search.pm in Bugzilla 2.17.1 through 3.2.6, 3.3.1 through 3.4.6, 3.5.1 through 3.6, and 3.7 allows remote a...

Security readout for executives and security teams

This vulnerability lets a remote user craft a Bugzilla search URL that may reveal sensitive time-tracking information. The business risk is exposure of internal effort, scheduling, or project data from legacy Bugzilla deployments, not direct system takeover based on the supplied sources. Exposure is most likely where legacy Bugzilla versions listed in the CVE remain reachable and contain confidential time-tracking data. Modern or upgraded Bugzilla instances may not be affected, but the supplied sources do not provide full asset discovery guidance. Prioritize if the organization still runs legacy Bugzilla with sensitive project or labor-tracking data. This is not evidenced as actively exploited, but it can disclose information useful for competitive intelligence or targeting. Mitigation focus: Identify whether any Bugzilla instance runs the affected version ranges.; Review Bugzilla security advisory guidance for fixed versions or required updates.; Upgrade affected Bugzilla deployments to a vendor-supported fixed release..

Prepared

Jun 28, 2026, 02:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.