Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2001-1402

EPSS 1.12% · P78
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2001-1402

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
Bugzilla before 2.14 does not properly escape untrusted parameters, which could allow remote attackers to conduct unauthorized activities via cross-site scripting (CSS) and possibly SQL injection attacks on (1) the product or output form variables for reports.cgi, (2) the voteon, bug_id, and user variables for showvotes.cgi, (3) an invalid email address in createaccount.cgi, (4) an invalid ID in showdependencytree.cgi, (5) invalid usernames and other fields in process_bug.cgi, and (6) error messages in buglist.cgi.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Bugzilla 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Bugzilla 2.14之前版本不能正确避免不信任参数，远程攻击者可以通过跨站脚本(CSS)和可能的在（1）reports.cgi中的产品或输出表单变量，（2）showvotes.cgi中的voteon，bug_id，以及用户变量，（3）createaccount.cgi中无效的电子邮件地址，（4）showdependencytree.cgi中无效的ID ，（5）process_bug.cgi中无效的用户名和其他领域，（6）buglist.cgi中的错误消息上的SQL注入攻击进行未授权的活动。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
-n/a n/a -

II. Public POCs for CVE-2001-1402

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2001-1402

Please Login to view more intelligence information

Same Patch Batch · n/a · 2002-08-31 · 162 CVEs total

CVE-2002-1019Adobe Content Server library eBook检验漏洞
CVE-2002-1005ArGoSoft Mail Server Pro 1.8.1.7远程拒绝服务漏洞
CVE-2002-1007Blackboard跨站脚本漏洞
CVE-2002-1008Summit Computer Networks Lil' HTTP Server URLCount.CGI HTML注入漏洞
CVE-2002-1009Summit Computer Networks Lil' HTTP Server pbcgi.cgi跨站脚本攻击（XSS）漏洞
CVE-2002-1010Lotus Domino绕过web根中的访问限制漏洞
CVE-2002-1011IBM Tivoli Management Framework Endpoint缓冲区溢出漏洞
CVE-2002-1012IBM Tivoli Management Framework 管理节点机WEB服务远程缓冲区溢出漏洞
CVE-2002-1016Adobe eBook Reader文件保护限制可突破漏洞
CVE-2002-1017Adobe eBook Reader文件传送授权凭证弱算法漏洞
CVE-2002-1018Adobe Content Server library拒绝服务漏洞
CVE-2002-1026Macromedia Sitespring数据库引擎远程拒绝服务攻击漏洞
CVE-2002-1032KeyFocus (KF) web server拒绝服务漏洞
CVE-2002-1029WorldSpan Res Manager畸形TCP数据包服务拒绝漏洞
CVE-2002-1028Oddsock Song Requester WinAmp Plugin服务拒绝漏洞
CVE-2002-1027Macromedia Sitespring默认出错页面跨站脚本漏洞
CVE-2002-1022Working Resources BadBlue明文密码本地存储漏洞
CVE-2002-1020Adobe Content Server library eBook检验漏洞
CVE-2002-1021Working Resources BadBlue NULL字节远程文件泄露漏洞
CVE-2002-1003MyWebServer GET请求远程缓冲区溢出漏洞

Showing top 20 of 162 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: n/a
Same vendor: n/a

V. Comments for CVE-2001-1402

No comments yet

Leave a comment