CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2001-1402
https://notcve.org/view.php?id=CVE-2001-1402
Bugzilla before 2.14 does not properly escape untrusted parameters, which could allow remote attackers to conduct unauthorized activities via cross-site scripting (CSS) and possibly SQL injection attacks on (1) the product or output form variables for reports.cgi, (2) the voteon, bug_id, and user variables for showvotes.cgi, (3) an invalid email address in createaccount.cgi, (4) an invalid ID in showdependencytree.cgi, (5) invalid usernames and other fields in process_bug.cgi, and (6) error messages in buglist.cgi. • http://bugzilla.mozilla.org/show_bug.cgi?id=38854 http://bugzilla.mozilla.org/show_bug.cgi?id=38855 http://bugzilla.mozilla.org/show_bug.cgi?id=38859 http://bugzilla.mozilla.org/show_bug.cgi?id=39536 http://bugzilla.mozilla.org/show_bug.cgi? •
CVSS: 2.1EPSS: 0%CPEs: 6EXPL: 0CVE-2001-1406
https://notcve.org/view.php?id=CVE-2001-1406
process_bug.cgi in Bugzilla before 2.14 does not set the "groupset" bit when a bug is moved between product groups, which will cause the bug to have the old group's restrictions, which might not be as stringent. • http://bugzilla.mozilla.org/show_bug.cgi?id=66235 http://marc.info/?l=bugtraq&m=99912899900567 http://www.iss.net/security_center/static/10478.php http://www.redhat.com/support/errata/RHSA-2001-107.html •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2001-1403
https://notcve.org/view.php?id=CVE-2001-1403
Bugzilla before 2.14 includes the username and password in URLs, which could allow attackers to gain privileges by reading the information from the web server logs, or by "shoulder-surfing" and observing the web browser's location bar. • http://bugzilla.mozilla.org/show_bug.cgi?id=15980 http://marc.info/?l=bugtraq&m=99912899900567 http://www.redhat.com/support/errata/RHSA-2001-107.html •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2001-1401
https://notcve.org/view.php?id=CVE-2001-1401
Bugzilla before 2.14 does not properly restrict access to confidential bugs, which could allow Bugzilla users to bypass viewing permissions via modified bug id parameters in (1) process_bug.cgi, (2) show_activity.cgi, (3) showvotes.cgi, (4) showdependencytree.cgi, (5) showdependencygraph.cgi, (6) showattachment.cgi, or (7) describecomponents.cgi. • http://bugzilla.mozilla.org/show_bug.cgi?id=39524 http://bugzilla.mozilla.org/show_bug.cgi?id=39526 http://bugzilla.mozilla.org/show_bug.cgi?id=39527 http://bugzilla.mozilla.org/show_bug.cgi?id=39531 http://bugzilla.mozilla.org/show_bug.cgi? •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 0CVE-2001-1407
https://notcve.org/view.php?id=CVE-2001-1407
Bugzilla before 2.14 allows Bugzilla users to bypass group security checks by marking a bug as the duplicate of a restricted bug, which adds the user to the CC list of the restricted bug and allows the user to view the bug. • http://bugzilla.mozilla.org/show_bug.cgi?id=96085 http://marc.info/?l=bugtraq&m=99912899900567 http://www.iss.net/security_center/static/10479.php http://www.redhat.com/support/errata/RHSA-2001-107.html •