842298 - While surfing https://bugzilla.mozilla.org i have found the critical flow in that website and that is xss.

Status: VERIFIED DUPLICATE of bug 842038

(Bugzilla :: Creating/Changing Bugs, defect)

Description

[sid]

Attachment: bug.JPG

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/20100101 Firefox/18.0
Build ID: 20130201065344

Steps to reproduce:

    While surfing https://bugzilla.mozilla.org i have found the critical flow in that website and that is xss.


Actual results:

While surfing https://bugzilla.mozilla.org i have found the critical flow in that website and that is xss. you can see here how the bug looks like https://bugzilla.mozilla.org/show_bug.cgi?id=316232%22%3E%3Cscript%3Ealert%28%27XSS%20found%20by%20siddharth%27%29%3C%2Fscript%3E&format=123

i hope this kind of the information will help you to make mozilla more safe :)


Expected results:

it should not popup message box

Comment 2

[Gervase Markham [:gerv]]

sid: can you tell us exactly how you found this bug? This bug has now been reported three times within 3 days, so it seems to me to be unlikely that all 3 reporters found it independently. Were you tipped off by someone else? Did you use some sort of scanner?

Gerv

Comment 3

[sid]

(In reply to Gervase Markham [:gerv] from comment #2)
> sid: can you tell us exactly how you found this bug? This bug has now been
> reported three times within 3 days, so it seems to me to be unlikely that
> all 3 reporters found it independently. Were you tipped off by someone else?
> Did you use some sort of scanner?
> 
> Gerv

I have found this bug manually :'( :( and how can it be duplicate ?

Comment 4

[:glob ✱]

this bug has already been reported.

Comment 5

[sid]

(In reply to Byron Jones ‹:glob› from comment #4)
> this bug has already been reported.
> 
> *** This bug has been marked as a duplicate of bug 842038 ***

Okay anyways i will find new bug :((

Comment 6

[:glob ✱]

please don't change the status of this bug, it is a duplicate.

Comment 7

[Frédéric Buclin]

Please stop playing with the bug status. As glob said, it's a duplicate. Period.

Comment 10

[Frédéric Buclin]

Bug 842038 has been fixed and is now public. Removing the sec flag.