CVE-2001-1404

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Bugzilla before 2.14 stores user passwords in plaintext and sends password requests in an email message, which could allow attackers to gain privileges.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

No affected versions have been published.

Timeline

Published
Sep 10, 2001
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2001

CVE-2001-14052.1Bugzilla before 2.14 does not restrict access to sanitycheck.cgi, which allows local users to cause a denial of service (CPU consumption) viCVE-2001-14062.1process_bug.cgi in Bugzilla before 2.14 does not set the "groupset" bit when a bug is moved between product groups, which will cause the bugCVE-2001-14077.5Bugzilla before 2.14 allows Bugzilla users to bypass group security checks by marking a bug as the duplicate of a restricted bug, which addsCVE-2001-14085.0Directory traversal vulnerability in readmsg.php in WebMail 2.0.1 in Cobalt Qube 3 allows remote attackers to read arbitrary files via a .. CVE-2001-14093.6dexconf in XFree86 Xserver 4.1.0-2 creates the /dev/dri directory with insecure permissions (666), which allows local users to replace or crCVE-2001-14105.0Internet Explorer 6 and earlier allows remote attackers to create chromeless windows using the Javascript window.createPopup method, which cCVE-2001-14117.2Format string vulnerability in gm4 (aka m4) on Mac OS X may allow local users to gain privileges if gm4 is called by setuid programs.CVE-2001-14122.1nidump on MacOS X before 10.3 allows local users to read the encrypted passwords from the password file by specifying passwd as a command liCVE-2001-14137.5Stack-based buffer overflow in the comprexx function for ncompress 4.2.4 and earlier, when used in situations that cross security boundariesCVE-2001-14147.5The Basic Security Module (BSM) for Solaris 2.5.1, 2.6, 7, and 8 does not log anonymous FTP access, which allows remote attackers to hide thCVE-2001-14154.6vi.recover in OpenBSD before 3.1 allows local users to remove arbitrary zero-byte files such as device nodes.CVE-2001-14165.1Multiple cross-site scripting (XSS) vulnerabilities in the log messages in certain Alpha versions of AOL Instant Messenger (AIM) 4.4 allow r