CVE-2010-4572

CRLF injection vulnerability in chart.cgi in Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.6.4, and 4.0.x before 4.0rc2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the query string, a different vulnerability than CVE-2010-2761 and CVE-2010-4411.

• CWE-94

• http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053665.html
• http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053678.html
• http://osvdb.org/70703
• http://secunia.com/advisories/43033Vendor Advisory
• http://secunia.com/advisories/43165Vendor Advisory
• http://www.bugzilla.org/security/3.2.9/Vendor Advisory
• http://www.debian.org/security/2011/dsa-2322
• http://www.securityfocus.com/bid/45982
• http://www.vupen.com/english/advisories/2011/0207Vendor Advisory
• http://www.vupen.com/english/advisories/2011/0271Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=621572Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/65440
• http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053665.html
• http://lists.fedoraproject.org/pipermail/package-announce/2011-February/053678.html
• http://osvdb.org/70703
• http://secunia.com/advisories/43033Vendor Advisory
• http://secunia.com/advisories/43165Vendor Advisory
• http://www.bugzilla.org/security/3.2.9/Vendor Advisory
• http://www.debian.org/security/2011/dsa-2322
• http://www.securityfocus.com/bid/45982
• http://www.vupen.com/english/advisories/2011/0207Vendor Advisory
• http://www.vupen.com/english/advisories/2011/0271Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=621572Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/65440

Published

Jan 28, 2011

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2010-4565The bcm_connect function in net/can/bcm.c (aka the Broadcast…
• CVE-2010-4566The web authentication form in the NT4 authentication compon…
• CVE-2010-4567Bugzilla before 3.2.10, 3.4.x before 3.4.10, 3.6.x before 3.…
• CVE-2010-4568Bugzilla 2.14 through 2.22.7; 3.0.x, 3.1.x, and 3.2.x before…
• CVE-2010-4569Cross-site scripting (XSS) vulnerability in Bugzilla 3.7.1, …
• CVE-2010-4570Cross-site scripting (XSS) vulnerability in the duplicate-de…
• CVE-2010-4573The Update Installer in VMware ESXi 4.1, when a modified sfc…
• CVE-2010-4574The Pickle::Pickle function in base/pickle.cc in Google Chro…
• CVE-2010-4575The ThemeInstalledInfoBarDelegate::Observe function in brows…
• CVE-2010-4576browser/worker_host/message_port_dispatcher.cc in Google Chr…
• CVE-2010-4577The CSSParser::parseFontFaceSrc function in WebCore/css/CSSP…7.5
• CVE-2010-4578Google Chrome before 8.0.552.224 and Chrome OS before 8.0.55…