Bugzilla Security Advisory – Bugzilla versions 2.20.1 and above suffer from a cross site scripting vulnerability. Version 2.23.3 suffers from a database password disclosure flaw.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/54185/bugzilla-multiple.txt
Source: https://packetstormsecurity.com/files/54185/bugzilla-multiple.txt.html