CVE-2001-1402

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Bugzilla before 2.14 does not properly escape untrusted parameters, which could allow remote attackers to conduct unauthorized activities via cross-site scripting (CSS) and possibly SQL injection attacks on (1) the product or output form variables for reports.cgi, (2) the voteon, bug_id, and user variables for showvotes.cgi, (3) an invalid email address in createaccount.cgi, (4) an invalid ID in showdependencytree.cgi, (5) invalid usernames and other fields in process_bug.cgi, and (6) error messages in buglist.cgi.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

No affected versions have been published.

Timeline

Published: Sep 10, 2001
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2001

CVE-2001-14037.5Bugzilla before 2.14 includes the username and password in URLs, which could allow attackers to gain privileges by reading the information f CVE-2001-14047.5Bugzilla before 2.14 stores user passwords in plaintext and sends password requests in an email message, which could allow attackers to gain CVE-2001-14052.1Bugzilla before 2.14 does not restrict access to sanitycheck.cgi, which allows local users to cause a denial of service (CPU consumption) vi CVE-2001-14062.1process_bug.cgi in Bugzilla before 2.14 does not set the "groupset" bit when a bug is moved between product groups, which will cause the bug CVE-2001-14077.5Bugzilla before 2.14 allows Bugzilla users to bypass group security checks by marking a bug as the duplicate of a restricted bug, which adds CVE-2001-14085.0Directory traversal vulnerability in readmsg.php in WebMail 2.0.1 in Cobalt Qube 3 allows remote attackers to read arbitrary files via a .. CVE-2001-14093.6dexconf in XFree86 Xserver 4.1.0-2 creates the /dev/dri directory with insecure permissions (666), which allows local users to replace or cr CVE-2001-14105.0Internet Explorer 6 and earlier allows remote attackers to create chromeless windows using the Javascript window.createPopup method, which c CVE-2001-14117.2Format string vulnerability in gm4 (aka m4) on Mac OS X may allow local users to gain privileges if gm4 is called by setuid programs.CVE-2001-14122.1nidump on MacOS X before 10.3 allows local users to read the encrypted passwords from the password file by specifying passwd as a command li CVE-2001-14137.5Stack-based buffer overflow in the comprexx function for ncompress 4.2.4 and earlier, when used in situations that cross security boundaries CVE-2001-14147.5The Basic Security Module (BSM) for Solaris 2.5.1, 2.6, 7, and 8 does not log anonymous FTP access, which allows remote attackers to hide th