Show filters
71 Total Results
Displaying 51-60 of 71
Sort by:
Attacker Value
Unknown
CVE-2003-0012
Disclosure Date: January 17, 2003 (last updated February 22, 2025)
The data collection script for Bugzilla 2.14.x before 2.14.5, 2.16.x before 2.16.2, and 2.17.x before 2.17.3 sets world-writable permissions for the data/mining directory when it runs, which allows local users to modify or delete the data.
0
Attacker Value
Unknown
CVE-2002-2260
Disclosure Date: December 31, 2002 (last updated February 22, 2025)
Cross-site scripting (XSS) vulnerability in the quips feature in Mozilla Bugzilla 2.10 through 2.17 allows remote attackers to inject arbitrary web script or HTML via the "show all quips" page.
0
Attacker Value
Unknown
CVE-2002-1197
Disclosure Date: October 28, 2002 (last updated February 22, 2025)
bugzilla_email_append.pl in Bugzilla 2.14.x before 2.14.4, and 2.16.x before 2.16.1, allows remote attackers to execute arbitrary code via shell metacharacters in a system call to processmail.
0
Attacker Value
Unknown
CVE-2002-1198
Disclosure Date: October 28, 2002 (last updated February 22, 2025)
Bugzilla 2.16.x before 2.16.1 does not properly filter apostrophes from an email address during account creation, which allows remote attackers to execute arbitrary SQL via a SQL injection attack.
0
Attacker Value
Unknown
CVE-2002-1196
Disclosure Date: October 28, 2002 (last updated February 22, 2025)
editproducts.cgi in Bugzilla 2.14.x before 2.14.4, and 2.16.x before 2.16.1, when the "usebuggroups" feature is enabled and more than 47 groups are specified, does not properly calculate bit values for large numbers, which grants extra permissions to users via known features of Perl math that set multiple bits.
0
Attacker Value
Unknown
CVE-2002-0809
Disclosure Date: August 12, 2002 (last updated February 22, 2025)
Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, does not properly handle URL-encoded field names that are generated by some browsers, which could cause certain fields to appear to be unset, which has the effect of removing group permissions on bugs when buglist.cgi is provided with the encoded field names.
0
Attacker Value
Unknown
CVE-2002-0804
Disclosure Date: August 12, 2002 (last updated February 22, 2025)
Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, when configured to perform reverse DNS lookups, allows remote attackers to bypass IP restrictions by connecting from a system with a spoofed reverse DNS hostname.
0
Attacker Value
Unknown
CVE-2002-0810
Disclosure Date: August 12, 2002 (last updated February 22, 2025)
Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, directs error messages from the syncshadowdb command to the HTML output, which could leak sensitive information, including plaintext passwords, if syncshadowdb fails.
0
Attacker Value
Unknown
CVE-2002-0811
Disclosure Date: August 12, 2002 (last updated February 22, 2025)
Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, may allow remote attackers to cause a denial of service or execute certain queries via a SQL injection attack on the sort order parameter to buglist.cgi.
0
Attacker Value
Unknown
CVE-2002-0808
Disclosure Date: August 12, 2002 (last updated February 22, 2025)
Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, when performing a mass change, sets the groupset of all bugs to the groupset of the first bug, which could inadvertently cause insecure groupset permissions to be assigned to some bugs.
0
