CVE-2002-0809

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, does not properly handle URL-encoded field names that are generated by some browsers, which could cause certain fields to appear to be unset, which has the effect of removing group permissions on bugs when buglist.cgi is provided with the encoded field names.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected software

No affected versions have been published.

Timeline

Published: Aug 12, 2002
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2002

CVE-2002-08105.0Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, directs error messages from the syncshadowdb command to the HTML output, which could l CVE-2002-08117.5Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, may allow remote attackers to cause a denial of service or execute certain queries via CVE-2002-08126.4Information leak in Compaq WL310, and the Orinoco Residential Gateway access point it is based on, uses a system identification string as a CVE-2002-08137.1Heap-based buffer overflow in the TFTP server capability in Cisco IOS 11.1, 11.2, and 11.3 allows remote attackers to cause a denial of serv CVE-2002-08147.5Buffer overflow in VMware Authorization Service for VMware GSX Server 2.0.0 build-2050 allows remote authenticated users to execute arbitrar CVE-2002-08157.5The Javascript "Same Origin Policy" (SOP), as implemented in (1) Netscape, (2) Mozilla, and (3) Internet Explorer, allows a remote web serve CVE-2002-08167.2Buffer overflow in su in Tru64 Unix 5.x allows local users to gain root privileges via a long username and argument.CVE-2002-08177.2Format string vulnerability in super for Linux allows local users to gain root privileges via a long command line argument.CVE-2002-08187.5wwwoffled in World Wide Web Offline Explorer (WWWOFFLE) allows remote attackers to cause a denial of service and possibly execute arbitrary CVE-2002-08197.2Format string vulnerability in artsd, when called by artswrapper, allows local users to gain privileges via format strings in the -a argumen CVE-2002-08207.2FreeBSD kernel 4.6 and earlier closes the file descriptors 0, 1, and 2 after they have already been assigned to /dev/null when the descripto CVE-2002-08217.5Buffer overflows in Ethereal 0.9.4 and earlier allow remote attackers to cause a denial of service or execute arbitrary code via (1) the BGP