CVE-2001-0329

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Bugzilla 2.10 allows remote attackers to execute arbitrary commands via shell metacharacters in a username that is then processed by (1) the Bugzilla_login cookie in post_bug.cgi, or (2) the who parameter in process_bug.cgi.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

No affected versions have been published.

Timeline

Published: Jun 27, 2001
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2001

CVE-2001-03307.5Bugzilla 2.10 allows remote attackers to access sensitive information, including the database username and password, via an HTTP request for CVE-2001-03317.5Buffer overflow in Embedded Support Partner (ESP) daemon (rpc.espd) in IRIX 6.5.8 and earlier allows remote attackers to execute arbitrary c CVE-2001-03325.0Internet Explorer 5.5 and earlier does not properly verify the domain of a frame within a browser window, which allows remote web site opera CVE-2001-03337.5Directory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding .. (dot dot) and CVE-2001-03347.5FTP service in IIS 5.0 and earlier allows remote attackers to cause a denial of service via a wildcard sequence that generates a long string CVE-2001-03355.0FTP service in IIS 5.0 and earlier allows remote attackers to enumerate Guest accounts in trusted domains by preceding the username with a s CVE-2001-03365.0The Microsoft MS00-060 patch for IIS 5.0 and earlier introduces an error which allows attackers to cause a denial of service via a malformed CVE-2001-03375.0The Microsoft MS01-014 and MS01-016 patches for IIS 5.0 and earlier introduce a memory leak which allows attackers to cause a denial of serv CVE-2001-03385.1Internet Explorer 5.5 and earlier does not properly validate digital certificates when Certificate Revocation List (CRL) checking is enabled CVE-2001-03397.5Internet Explorer 5.5 and earlier allows remote attackers to display a URL in the address bar that is different than the URL that is actuall CVE-2001-03407.5An interaction between the Outlook Web Access (OWA) service in Microsoft Exchange 2000 Server and Internet Explorer allows attackers to exec CVE-2001-03417.5Buffer overflow in Microsoft Visual Studio RAD Support sub-component of FrontPage Server Extensions allows remote attackers to execute arbit