CVSS: 5.5EPSS: 0%CPEs: 14EXPL: 0CVE-2003-0603
https://notcve.org/view.php?id=CVE-2003-0603
29 Jul 2003 — Bugzilla 2.16.x before 2.16.3, 2.17.x before 2.17.4, and earlier versions allows local users to overwrite arbitrary files via a symlink attack on temporary files that are created in directories with group-writable or world-writable permissions. Bugzilla 2.16.x anteriores a 2.16.3, 2.17.x anterioreas a 2.17.4, y versiones anteriores permite a usuarios locales sobreescribir ficheros arbitrarios mediante un ataque de enlaces simbólicos (symlink attack) en ficheros temporales que son creados en directorios con ... • http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000653 •
CVSS: 5.5EPSS: 0%CPEs: 9EXPL: 0CVE-2003-0012
https://notcve.org/view.php?id=CVE-2003-0012
17 Jan 2003 — The data collection script for Bugzilla 2.14.x before 2.14.5, 2.16.x before 2.16.2, and 2.17.x before 2.17.3 sets world-writable permissions for the data/mining directory when it runs, which allows local users to modify or delete the data. El script de recogida de datos de Bugzilla 2.14.x anteriores a 2.14.5, 2.16.x anteriores de 2.16.2, y 2.17.x anteriores a 2.17.3 establece permisos de escritura para todo el mundo en el directorio de recogida de datos cuando se ejecuta, lo que permite a usuarios locales m... • http://marc.info/?l=bugtraq&m=104154319200399&w=2 •
CVSS: 9.8EPSS: 0%CPEs: 9EXPL: 0CVE-2003-0013
https://notcve.org/view.php?id=CVE-2003-0013
17 Jan 2003 — The default .htaccess scripts for Bugzilla 2.14.x before 2.14.5, 2.16.x before 2.16.2, and 2.17.x before 2.17.3 do not include filenames for backup copies of the localconfig file that are made from editors such as vi and Emacs, which could allow remote attackers to obtain a database password by directly accessing the backup file. Los scripts .htaccess por defecto en Bugzilla 2.14.x anteriores a 2.14.5, 2.16.x anteriores a 2.16.2, y 2.17.x anteriores a 2.17.3 no bloquean el acceso a copias de seguridad del f... • http://marc.info/?l=bugtraq&m=104154319200399&w=2 •
CVSS: 6.1EPSS: 0%CPEs: 28EXPL: 0CVE-2002-2260
https://notcve.org/view.php?id=CVE-2002-2260
31 Dec 2002 — Cross-site scripting (XSS) vulnerability in the quips feature in Mozilla Bugzilla 2.10 through 2.17 allows remote attackers to inject arbitrary web script or HTML via the "show all quips" page. • http://bugzilla.mozilla.org/show_bug.cgi?id=179329 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.1EPSS: 0%CPEs: 5EXPL: 0CVE-2002-1196
https://notcve.org/view.php?id=CVE-2002-1196
28 Oct 2002 — editproducts.cgi in Bugzilla 2.14.x before 2.14.4, and 2.16.x before 2.16.1, when the "usebuggroups" feature is enabled and more than 47 groups are specified, does not properly calculate bit values for large numbers, which grants extra permissions to users via known features of Perl math that set multiple bits. editproducts.cgi en Bugzilla 2.14.x anteriores a 2.14.4 y 2.16 anteriores a 2.16.1, cuando la característica "usebuggroups" está activada y se especifican más de 47 grupos, no calcula adecuadamente v... • http://bugzilla.mozilla.org/show_bug.cgi?id=167485#c12 •
CVSS: 9.8EPSS: 1%CPEs: 5EXPL: 0CVE-2002-1197
https://notcve.org/view.php?id=CVE-2002-1197
28 Oct 2002 — bugzilla_email_append.pl in Bugzilla 2.14.x before 2.14.4, and 2.16.x before 2.16.1, allows remote attackers to execute arbitrary code via shell metacharacters in a system call to processmail. bugzilla_email_append.pl en Bugzilla 2.14.x antes de 2.14.4, y 2.16.x antes de 2.16.1, permite a atacantes remotos ejecutar código arbitrario mediante metacaracteres de shell en una llamada de sistema a processmail. • http://bugzilla.mozilla.org/show_bug.cgi?id=163024 •
CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 0CVE-2002-1198
https://notcve.org/view.php?id=CVE-2002-1198
28 Oct 2002 — Bugzilla 2.16.x before 2.16.1 does not properly filter apostrophes from an email address during account creation, which allows remote attackers to execute arbitrary SQL via a SQL injection attack. Bugzilla 2.16.x anteriores a 2.16.1 no filtra apropiadamente apóstrofes de direcciones de correo electrónico durante la creación de cuentas, lo que permite a atacantes remotos ejecutar SQL arbitrario mediante un ataque de inyección de SQL. • http://bugzilla.mozilla.org/show_bug.cgi?id=165221 •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2002-0810
https://notcve.org/view.php?id=CVE-2002-0810
12 Aug 2002 — Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, directs error messages from the syncshadowdb command to the HTML output, which could leak sensitive information, including plaintext passwords, if syncshadowdb fails. • ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SN-02:05.asc •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2002-0805
https://notcve.org/view.php?id=CVE-2002-0805
12 Aug 2002 — Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, (1) creates new directories with world-writable permissions, and (2) creates the params file with world-writable permissions, which allows local users to modify the files and execute code. • http://archives.neohapsis.com/archives/bugtraq/2002-06/0054.html •
CVSS: 8.1EPSS: 0%CPEs: 4EXPL: 0CVE-2002-0806
https://notcve.org/view.php?id=CVE-2002-0806
12 Aug 2002 — Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, allows authenticated users with editing privileges to delete other users by directly calling the editusers.cgi script with the "del" option. • http://archives.neohapsis.com/archives/bugtraq/2002-06/0054.html •