CVE-2010-4568

Bugzilla 2.14 through 2.22.7; 3.0.x, 3.1.x, and 3.2.x before 3.2.10; 3.4.x before 3.4.10; 3.6.x before 3.6.4; and 4.0.x before 4.0rc2 does not properly generate random values for cookies and tokens, which allows remote attackers to obtain access to arbitrary accounts via unspecified vectors, related to an insufficient number of calls to the srand function.

• CWE-264

• http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053665.html
• http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053678.html
• http://osvdb.org/70700
• http://secunia.com/advisories/43033Vendor Advisory
• http://secunia.com/advisories/43165
• http://www.bugzilla.org/security/3.2.9/Vendor Advisory
• http://www.debian.org/security/2011/dsa-2322
• http://www.securityfocus.com/bid/45982
• http://www.vupen.com/english/advisories/2011/0207Vendor Advisory
• http://www.vupen.com/english/advisories/2011/0271
• https://bugzilla.mozilla.org/attachment.cgi?id=506031&action=diff
• https://bugzilla.mozilla.org/show_bug.cgi?id=619594
• https://bugzilla.mozilla.org/show_bug.cgi?id=621591
• https://exchange.xforce.ibmcloud.com/vulnerabilities/65001
• http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053665.html
• http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053678.html
• http://osvdb.org/70700
• http://secunia.com/advisories/43033Vendor Advisory
• http://secunia.com/advisories/43165
• http://www.bugzilla.org/security/3.2.9/Vendor Advisory
• http://www.debian.org/security/2011/dsa-2322
• http://www.securityfocus.com/bid/45982
• http://www.vupen.com/english/advisories/2011/0207Vendor Advisory
• http://www.vupen.com/english/advisories/2011/0271
• https://bugzilla.mozilla.org/attachment.cgi?id=506031&action=diff
• https://bugzilla.mozilla.org/show_bug.cgi?id=619594
• https://bugzilla.mozilla.org/show_bug.cgi?id=621591
• https://exchange.xforce.ibmcloud.com/vulnerabilities/65001

Published

Jan 28, 2011

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2010-4560Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2010-4562Microsoft Windows 2008, 7, Vista, 2003, 2000, and XP, when u…
• CVE-2010-4563The Linux kernel, when using IPv6, allows remote attackers t…
• CVE-2010-4565The bcm_connect function in net/can/bcm.c (aka the Broadcast…
• CVE-2010-4566The web authentication form in the NT4 authentication compon…
• CVE-2010-4567Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.…
• CVE-2010-4569Cross-site scripting (XSS) vulnerability in Bugzilla 3.7.1, …
• CVE-2010-4570Cross-site scripting (XSS) vulnerability in the duplicate-de…
• CVE-2010-4572CRLF injection vulnerability in chart.cgi in Bugzilla before…
• CVE-2010-4573The Update Installer in VMware ESXi 4.1, when a modified sfc…
• CVE-2010-4574The Pickle::Pickle function in base/pickle.cc in Google Chro…
• CVE-2010-4575The ThemeInstalledInfoBarDelegate::Observe function in brows…