CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 0CVE-2002-1198
https://notcve.org/view.php?id=CVE-2002-1198
28 Oct 2002 — Bugzilla 2.16.x before 2.16.1 does not properly filter apostrophes from an email address during account creation, which allows remote attackers to execute arbitrary SQL via a SQL injection attack. Bugzilla 2.16.x anteriores a 2.16.1 no filtra apropiadamente apóstrofes de direcciones de correo electrónico durante la creación de cuentas, lo que permite a atacantes remotos ejecutar SQL arbitrario mediante un ataque de inyección de SQL. • http://bugzilla.mozilla.org/show_bug.cgi?id=165221 •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2002-0810
https://notcve.org/view.php?id=CVE-2002-0810
12 Aug 2002 — Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, directs error messages from the syncshadowdb command to the HTML output, which could leak sensitive information, including plaintext passwords, if syncshadowdb fails. • ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SN-02:05.asc •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2002-0805
https://notcve.org/view.php?id=CVE-2002-0805
12 Aug 2002 — Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, (1) creates new directories with world-writable permissions, and (2) creates the params file with world-writable permissions, which allows local users to modify the files and execute code. • http://archives.neohapsis.com/archives/bugtraq/2002-06/0054.html •
CVSS: 8.1EPSS: 0%CPEs: 4EXPL: 0CVE-2002-0806
https://notcve.org/view.php?id=CVE-2002-0806
12 Aug 2002 — Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, allows authenticated users with editing privileges to delete other users by directly calling the editusers.cgi script with the "del" option. • http://archives.neohapsis.com/archives/bugtraq/2002-06/0054.html •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2002-0809
https://notcve.org/view.php?id=CVE-2002-0809
12 Aug 2002 — Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, does not properly handle URL-encoded field names that are generated by some browsers, which could cause certain fields to appear to be unset, which has the effect of removing group permissions on bugs when buglist.cgi is provided with the encoded field names. • http://archives.neohapsis.com/archives/bugtraq/2002-06/0054.html •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2002-0804
https://notcve.org/view.php?id=CVE-2002-0804
12 Aug 2002 — Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, when configured to perform reverse DNS lookups, allows remote attackers to bypass IP restrictions by connecting from a system with a spoofed reverse DNS hostname. • http://archives.neohapsis.com/archives/bugtraq/2002-06/0054.html •
CVSS: 9.1EPSS: 0%CPEs: 4EXPL: 0CVE-2002-0808
https://notcve.org/view.php?id=CVE-2002-0808
12 Aug 2002 — Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, when performing a mass change, sets the groupset of all bugs to the groupset of the first bug, which could inadvertently cause insecure groupset permissions to be assigned to some bugs. • http://archives.neohapsis.com/archives/bugtraq/2002-06/0054.html •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2002-0807
https://notcve.org/view.php?id=CVE-2002-0807
31 Jul 2002 — Cross-site scripting vulnerabilities in Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, could allow remote attackers to execute script as other Bugzilla users via the full name (real name) field, which is not properly quoted by editusers.cgi. • http://archives.neohapsis.com/archives/bugtraq/2002-06/0054.html •
CVSS: 9.1EPSS: 11%CPEs: 4EXPL: 0CVE-2002-0803
https://notcve.org/view.php?id=CVE-2002-0803
31 Jul 2002 — Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, allows remote attackers to display restricted products and components via a direct HTTP request to queryhelp.cgi. • ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SN-02%3A05.asc •
CVSS: 9.8EPSS: 0%CPEs: 4EXPL: 0CVE-2002-0811
https://notcve.org/view.php?id=CVE-2002-0811
31 Jul 2002 — Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, may allow remote attackers to cause a denial of service or execute certain queries via a SQL injection attack on the sort order parameter to buglist.cgi. • http://archives.neohapsis.com/archives/bugtraq/2002-06/0054.html •