Bugzilla Multiple Vulnerabilities

A security issue and some vulnerabilities have been identified in Bugzilla, which can be exploited by malicious users to disclose potentially sensitive information and by malicious people to conduct cross-site scripting attacks and bypass certain security restrictions.

1. An error within the flagmail email template can be exploited to disclose content of private comments.
2. An error within the "confirm_create_account()" function (token.cgi) can be exploited to create account with administrator privileges.
3. Certain input is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.