deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2002-0757
Published: 2002-08-12
Description: (1) Webmin 0.96 and (2) Usermin 0.90 with password timeouts enabled allow local and possibly remote attackers to bypass authentication and gain privileges via certain control characters in the authentication information, which can force Webmin or Usermin to accept arbitrary username/session ID combinations.
CVSS Score: 7.5 (HIGH)
References: http://online.securityfocus.com/archive/1/271466; http://www.iss.net/security_center/static/9037.php; http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-033.php
CVE: CVE-2002-0758
Published: 2002-08-12
Description: ifup-dhcp script in the sysconfig package for SuSE 8.0 allows remote attackers to execute arbitrary commands via spoofed DHCP responses, which are stored and executed in a file.
CVSS Score: 7.5 (HIGH)
References: http://www.iss.net/security_center/static/9040.php; http://www.novell.com/linux/security/advisories/2002_016_sysconfig_txt.html; http://www.securityfocus.com/bid/4695
CVE: CVE-2002-0759
Published: 2002-08-12
Description: bzip2 before 1.0.2 in FreeBSD 4.5 and earlier, OpenLinux 3.1 and 3.1.1, and possibly other operating systems, does not use the O_EXCL flag to create files during decompression and does not warn the user if an existing file would be overwritten, which could allow attackers to overwrite files via a bzip2 archive.
CVSS Score: 5.0 (MEDIUM)
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-039.0.txt; ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:25.bzip2.asc; http://www.iss.net/security_center/static/9126.php
CVE: CVE-2002-0760
Published: 2002-08-12
Description: Race condition in bzip2 before 1.0.2 in FreeBSD 4.5 and earlier, OpenLinux 3.1 and 3.1.1, and possibly other operating systems, decompresses files with world-readable permissions before setting the permissions to what is specified in the bzip2 archive, which could allow local users to read the files as they are being decompressed.
CVSS Score: 1.2 (LOW)
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-039.0.txt; ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:25.bzip2.asc; http://www.iss.net/security_center/static/9127.php
CVE: CVE-2002-0761
Published: 2002-08-12
Description: bzip2 before 1.0.2 in FreeBSD 4.5 and earlier, OpenLinux 3.1 and 3.1.1, and possibly systems, uses the permissions of symbolic links instead of the actual files when creating an archive, which could cause the files to be extracted with less restrictive permissions than intended.
CVSS Score: 2.1 (LOW)
References: ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2002-039.0.txt; ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:25.bzip2.asc; http://www.iss.net/security_center/static/9128.php
CVE: CVE-2002-0762
Published: 2002-08-12
Description: shadow package in SuSE 8.0 allows local users to destroy the /etc/passwd and /etc/shadow files or assign extra group privileges to some users by changing filesize limits before calling programs that modify the files.
CVSS Score: 7.2 (HIGH)
References: http://www.iss.net/security_center/static/9102.php; http://www.novell.com/linux/security/advisories/2002_17_shadow.html; http://www.securityfocus.com/bid/4757
CVE: CVE-2002-0763
Published: 2002-08-12
Description: Vulnerability in administration server for HP VirtualVault 4.5 on HP-UX 11.04 allows remote web servers or privileged external processes to bypass access restrictions and establish connections to the server.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/hp/2002-q2/0037.html; http://www.iss.net/security_center/static/9038.php; http://www.securityfocus.com/bid/4690
CVE: CVE-2002-0764
Published: 2002-08-12
Description: Phorum 3.3.2a allows remote attackers to execute arbitrary commands via an HTTP request to (1) plugin.php, (2) admin.php, or (3) del.php that modifies the PHORUM[settings_dir] variable to point to a directory that contains a PHP file with the commands.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-05/0147.html; http://archives.neohapsis.com/archives/bugtraq/2002-05/0153.html; http://www.iss.net/security_center/static/9107.php
CVE: CVE-2002-0765
Published: 2002-08-12
Description: sshd in OpenSSH 3.2.2, when using YP with netgroups and under certain conditions, may allow users to successfully authenticate and log in with another user's password.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-05/0235.html; http://www.iss.net/security_center/static/9215.php; http://www.openbsd.org/errata.html#sshbsdauth
CVE: CVE-2002-0766
Published: 2002-08-12
Description: OpenBSD 2.9 through 3.1 allows local users to cause a denial of service (resource exhaustion) and gain root privileges by filling the kernel's file descriptor table and closing file descriptors 0, 1, or 2 before executing a privileged process, which is not properly handled when OpenBSD fails to open an alternate descriptor.
CVSS Score: 7.2 (HIGH)
References: http://online.securityfocus.com/archive/1/271702; http://www.iss.net/security_center/static/9048.php; http://www.kb.cert.org/vuls/id/314963
CVE: CVE-2002-0767
Published: 2002-08-12
Description: simpleinit on Linux systems does not close a read/write FIFO file descriptor before creating a child process, which allows the child process to cause simpleinit to execute arbitrary programs with root privileges.
CVSS Score: 7.2 (HIGH)
References: http://online.securityfocus.com/archive/1/276739; http://www.iss.net/security_center/static/9357.php; http://www.securityfocus.com/bid/5001
CVE: CVE-2002-0768
Published: 2002-08-12
Description: Buffer overflow in lukemftp FTP client in SuSE 6.4 through 8.0, and possibly other operating systems, allows a malicious FTP server to execute arbitrary code via a long PASV command.
CVSS Score: 7.5 (HIGH)
References: http://www.iss.net/security_center/static/9130.php; http://www.novell.com/linux/security/advisories/2002_18_lukemftp.html; http://www.iss.net/security_center/static/9130.php
CVE: CVE-2002-0769
Published: 2002-08-12
Description: The web-based configuration interface for the Cisco ATA 186 Analog Telephone Adaptor allows remote attackers to bypass authentication via an HTTP POST request with a single byte, which allows the attackers to (1) obtain the password from the login screen, or (2) reconfigure the adaptor by modifying certain request parameters.
CVSS Score: 6.4 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-05/0083.html; http://www.cisco.com/warp/public/707/ata186-password-disclosure.shtml; http://www.iss.net/security_center/static/9056.php
CVE: CVE-2002-0770
Published: 2002-08-12
Description: Quake 2 (Q2) server 3.20 and 3.21 allows remote attackers to obtain sensitive server cvar variables, obtain directory listings, and execute Q2 server admin commands via a client that does not expand "$" macros, which causes the server to expand the macros and leak the information, as demonstrated using "say $rcon_password."
CVSS Score: 5.0 (MEDIUM)
References: http://online.securityfocus.com/archive/1/272548; http://www.iss.net/security_center/static/9095.php; http://www.kb.cert.org/vuls/id/970915
CVE: CVE-2002-0771
Published: 2002-08-12
Description: Cross-site scripting vulnerability in viewcvs.cgi for ViewCVS 0.9.2 allows remote attackers to inject script and steal cookies via the (1) cvsroot or (2) sortby parameters.
CVSS Score: 6.4 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-05/0161.html; http://www.iss.net/security_center/static/9112.php; http://www.securityfocus.com/bid/4818
CVE: CVE-2002-0772
Published: 2002-08-12
Description: Directory traversal vulnerability in dsnmanager.asp for Hosting Controller allows remote attackers to read arbitrary files and directories via a .. (dot dot) in the RootName parameter.
CVSS Score: 6.4 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-05/0142.html; http://www.iss.net/security_center/static/9104.php; http://www.securityfocus.com/bid/4759
CVE: CVE-2002-0773
Published: 2002-08-12
Description: imp_rootdir.asp for Hosting Controller allows remote attackers to copy or delete arbitrary files and directories via a direct request to imp_rootdir.asp and modifying parameters such as (1) ftp, (2) owwwPath, and (3) oftpPath.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-05/0142.html; http://www.iss.net/security_center/static/9105.php; http://www.securityfocus.com/bid/4761
CVE: CVE-2002-0774
Published: 2002-08-12
Description: Hosting Controller creates a default user AdvWebadmin with a default password, which could allow remote attackers to gain privileges if the password is not changed.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-05/0168.html; http://www.iss.net/security_center/static/9131.php; http://www.securityfocus.com/bid/4779
CVE: CVE-2002-0775
Published: 2002-08-12
Description: browse.asp in Hosting Controller allows remote attackers to view arbitrary directories by specifying the target pathname in the FilePath parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-05/0168.html; http://hostingcontroller.com/english/logs/sp2log.html; http://www.hostingcontroller.com/english/patches/ForAll/download/drivebrowse.zip
CVE: CVE-2002-0776
Published: 2002-08-12
Description: getuserdesc.asp in Hosting Controller 2002 allows remote attackers to change the passwords of arbitrary users and gain privileges by modifying the username parameter, as addressed by the "UpdateUser" hot fix.
CVSS Score: 7.5 (HIGH)
References: http://hostingcontroller.com/english/logs/sp2log.html; http://online.securityfocus.com/archive/1/282129; http://www.iss.net/security_center/static/9554.php
CVE: CVE-2002-0777
Published: 2002-08-12
Description: Buffer overflow in the LDAP component of Ipswitch IMail 7.1 and earlier allows remote attackers to execute arbitrary code via a long "bind DN" parameter.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-05/0172.html; http://www.iss.net/security_center/static/9116.php; http://www.securityfocus.com/bid/4780
CVE: CVE-2002-0778
Published: 2002-08-12
Description: The default configuration of the proxy for Cisco Cache Engine and Content Engine allows remote attackers to use HTTPS to make TCP connections to allowed IP addresses while hiding the actual source IP.
CVSS Score: 7.5 (HIGH)
References: http://www.cisco.com/warp/public/707/transparentcache-tcp-relay-vuln-pub.shtml; http://www.iss.net/security_center/static/9082.php; http://www.securityfocus.com/bid/4751
CVE: CVE-2002-0779
Published: 2002-08-12
Description: FTP proxy server for Novell BorderManager 3.6 SP 1a allows remote attackers to cause a denial of service (network connectivity loss) via a connection to port 21 with a large amount of random data.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0060.html; http://online.securityfocus.com/archive/1/271475; http://www.iss.net/security_center/static/9031.php
CVE: CVE-2002-0780
Published: 2002-08-12
Description: IP/IPX gateway for Novell BorderManager 3.6 SP 1a allows remote attackers to cause a denial of service via a connection to port 8225 with a large amount of random data, which causes ipipxgw.nlm to ABEND.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0060.html; http://online.securityfocus.com/archive/1/271475; http://www.iss.net/security_center/static/9032.php
CVE: CVE-2002-0781
Published: 2002-08-12
Description: RTSP proxy for Novell BorderManager 3.6 SP 1a allows remote attackers to cause a denial of service via a GET request to port 9090 followed by a series of carriage returns, which causes proxy.nlm to ABEND.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0060.html; http://online.securityfocus.com/archive/1/271475; http://www.iss.net/security_center/static/9033.php
CVE: CVE-2002-0782
Published: 2002-08-12
Description: Novell BorderManager 3.5 with PAT (Port-Address Translate) enabled allows remote attackers to cause a denial of service by filling the connection table with a large number of connection requests to hosts that do not have a specific route, which may be forwarded to the public interface.
CVSS Score: 5.0 (MEDIUM)
References: http://online.securityfocus.com/archive/1/271957; http://www.iss.net/security_center/static/9062.php; http://www.securityfocus.com/bid/4726
CVE: CVE-2002-0783
Published: 2002-08-12
Description: Opera 6.01, 6.0, and 5.12 allows remote attackers to execute arbitrary JavaScript in the security context of other sites by setting the location of a frame or iframe to a Javascript: URL.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-05/0117.html; http://www.iss.net/security_center/static/9096.php; http://www.securityfocus.com/bid/4745
CVE: CVE-2002-0784
Published: 2002-08-12
Description: Directory traversal vulnerability in Lysias Lidik web server 0.7b allows remote attackers to list directories via an HTTP request with a ... (modified dot dot).
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-05/0039.html; http://www.iss.net/security_center/static/9028.php; http://www.lysias.de/send/news/index.php?page=3
CVE: CVE-2002-0785
Published: 2002-08-12
Description: AOL Instant Messenger (AIM) allows remote attackers to cause a denial of service (crash) via an "AddBuddy" link with the ScreenName parameter set to a large number of comma-separated values, possibly triggering a buffer overflow.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-05/0086.html; http://www.iss.net/security_center/static/9058.php; http://www.kb.cert.org/vuls/id/259435
CVE: CVE-2002-0786
Published: 2002-08-12
Description: iCon administrative web server for Critical Path inJoin Directory Server 4.0 allows authenticated inJoin administrators to read arbitrary files by specifying the target file in the LOG parameter.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0068.html; http://www.iss.net/security_center/static/9054.php; http://www.securityfocus.com/bid/4718
CVE: CVE-2002-0787
Published: 2002-08-12
Description: Cross-site scripting vulnerabilities in iCon administrative web server for Critical Path inJoin Directory Server 4.0 allow remote attackers to execute script as the administrator via administrator URLs with modified (1) LOCID or (2) OC parameters.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0068.html; http://www.iss.net/security_center/static/9053.php; http://www.securityfocus.com/bid/4717
CVE: CVE-2002-0788
Published: 2002-08-12
Description: An interaction between PGP 7.0.3 with the "wipe deleted files" option, when used on Windows Encrypted File System (EFS), creates a cleartext temporary files that cannot be wiped or deleted due to strong permissions, which could allow certain local users or attackers with physical access to obtain cleartext information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-459
References: http://archives.neohapsis.com/archives/bugtraq/2002-05/0052.html; http://download.nai.com/products/licensed/pgp/desktop_security/windows/version_7.1/hotfix/ReadMe.txt; http://www.iss.net/security_center/static/9044.php
CVE: CVE-2002-0789
Published: 2002-08-12
Description: Buffer overflow in search.cgi in mnoGoSearch 3.1.19 and earlier allows remote attackers to execute arbitrary code via a long query (q) parameter.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-05/0092.html; http://www.iss.net/security_center/static/9060.php; http://www.mnogosearch.org/Download/mnogosearch-3.1.20.tar.gz
CVE: CVE-2002-0790
Published: 2002-08-12
Description: clchkspuser and clpasswdremote in AIX expose an encrypted password in the cspoc.log file, which could allow local users to gain privileges.
CVSS Score: 2.1 (LOW)
References: http://techsupport.services.ibm.com/server/aix.uhuic_getrec?args=DVsteamboat.boulder.ibm.com+DBAIX2+DA6854+STIY24556+USbin; http://techsupport.services.ibm.com/server/aix.uhuic_getrec?args=DVsteamboat.boulder.ibm.com+DBAIX2+DA6854+STIY24556+USbin
CVE: CVE-2002-0791
Published: 2002-08-12
Description: Novell Netware FTP server NWFTPD before 5.02r allows remote attackers to cause a denial of service (CPU consumption) via a connection to the server followed by a carriage return, and possibly other invalid commands with improper syntax or length.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0059.html; http://online.securityfocus.com/archive/1/271589; http://support.novell.com/cgi-bin/search/searchtid.cgi?/2962252.htm
CVE: CVE-2002-0792
Published: 2002-08-12
Description: The web management interface for Cisco Content Service Switch (CSS) 11000 switches allows remote attackers to cause a denial of service (soft reset) via (1) an HTTPS POST request, or (2) malformed XML data.
CVSS Score: 5.0 (MEDIUM)
References: http://www.cisco.com/warp/public/707/css-http-post-pub.shtml; http://www.iss.net/security_center/static/9083.php; http://www.kb.cert.org/vuls/id/330275
CVE: CVE-2002-0793
Published: 2002-08-12
Description: Hard link and possibly symbolic link following vulnerabilities in QNX RTOS 4.25 (aka QNX4) allow local users to overwrite arbitrary files via (1) the -f argument to the monitor utility, (2) the -d argument to dumper, (3) the -c argument to crttrap, or (4) using the Watcom sample utility.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-59
References: http://archives.neohapsis.com/archives/bugtraq/2002-05/0292.html; http://www.iss.net/security_center/static/9231.php; http://www.securityfocus.com/bid/4901
CVE: CVE-2002-0794
Published: 2002-08-12
Description: The accept_filter mechanism in FreeBSD 4 through 4.5 does not properly remove entries from the incomplete listen queue when adding a syncache, which allows remote attackers to cause a denial of service (network service availability) via a large number of connection attempts, which fills the queue.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/freebsd/2002-05/0349.html; http://www.iss.net/security_center/static/9209.php; http://www.osvdb.org/5081
CVE: CVE-2002-0795
Published: 2002-08-12
Description: The rc system startup script for FreeBSD 4 through 4.5 allows local users to delete arbitrary files via a symlink attack on X Windows lock files.
CVSS Score: 2.1 (LOW)
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SA-02:27.rc.asc; http://www.iss.net/security_center/static/9217.php; http://www.osvdb.org/5083
CVE: CVE-2002-0796
Published: 2002-08-12
Description: Format string vulnerability in the logging component of snmpdx for Solaris 5.6 through 8 allows remote attackers to gain root privileges.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4554&w=2; http://sunsolve.sun.com/pub-cgi/retrieve.pl?doctype=coll&doc=secbull/219; http://www.iss.net/security_center/static/9241.php
CVE: CVE-2002-0797
Published: 2002-08-12
Description: Buffer overflow in the MIB parsing component of mibiisa for Solaris 5.6 through 8 allows remote attackers to gain root privileges.
CVSS Score: 10.0 (HIGH)
References: http://marc.info/?l=bugtraq&m=[PII_REDACTED]4554&w=2; http://sunsolve.sun.com/pub-cgi/retrieve.pl?doctype=coll&doc=secbull/219; http://www.iss.net/security_center/static/9242.php
CVE: CVE-2002-0798
Published: 2002-08-12
Description: Vulnerability in swinstall for HP-UX 11.00 and 11.11 allows local users to view obtain data views for files that cannot be directly read by the user, which reportedly can be used to cause a denial of service.
CVSS Score: 2.1 (LOW)
References: http://archives.neohapsis.com/archives/hp/2002-q2/0059.html; http://www.iss.net/security_center/static/9207.php; http://www.securityfocus.com/bid/4886
CVE: CVE-2002-0799
Published: 2002-08-12
Description: Buffer overflow in YoungZSoft CMailServer 3.30 allows remote attackers to execute arbitrary code via a long USER argument.
CVSS Score: 7.5 (HIGH)
References: http://online.securityfocus.com/archive/1/273512; http://www.iss.net/security_center/static/9132.php; http://www.securityfocus.com/bid/4789
CVE: CVE-2002-0800
Published: 2002-08-12
Description: BadBlue 1.7.0 allows remote attackers to list the contents of directories via a URL with an encoded '%' character at the end.
CVSS Score: 5.0 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-06/0003.html; http://www.iss.net/security_center/static/9239.php; http://www.securityfocus.com/bid/4912
CVE: CVE-2002-0801
Published: 2002-08-12
Description: Buffer overflow in the ISAPI DLL filter for Macromedia JRun 3.1 allows remote attackers to execute arbitrary code via a direct request to the filter with a long HTTP host header field in a URL for a .jsp file.
CVSS Score: 10.0 (HIGH)
References: http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0085.html; http://online.securityfocus.com/archive/1/274528; http://online.securityfocus.com/archive/1/274601
CVE: CVE-2002-0802
Published: 2002-08-12
Description: The multibyte support in PostgreSQL 6.5.x with SQL_ASCII encoding consumes an extra character when processing a character that cannot be converted, which could remove an escape character from the query and make the application subject to SQL injection attacks.
CVSS Score: 7.5 (HIGH)
References: http://marc.info/?l=postgresql-general&m=[PII_REDACTED]2362; http://www.iss.net/security_center/static/10328.php; http://www.redhat.com/support/errata/RHSA-2002-149.html
CVE: CVE-2002-0803
Published: 2002-08-12
Description: Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, allows remote attackers to display restricted products and components via a direct HTTP request to queryhelp.cgi.
CVSS Score: 5.0 (MEDIUM)
References: ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SN-02%3A05.asc; ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SN-02:05.asc; http://archives.neohapsis.com/archives/bugtraq/2002-06/0054.html
CVE: CVE-2002-0804
Published: 2002-08-12
Description: Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, when configured to perform reverse DNS lookups, allows remote attackers to bypass IP restrictions by connecting from a system with a spoofed reverse DNS hostname.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-06/0054.html; http://bugzilla.mozilla.org/show_bug.cgi?id=129466; http://www.iss.net/security_center/static/9301.php
CVE: CVE-2002-0805
Published: 2002-08-12
Description: Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, (1) creates new directories with world-writable permissions, and (2) creates the params file with world-writable permissions, which allows local users to modify the files and execute code.
CVSS Score: 4.6 (MEDIUM)
References: http://archives.neohapsis.com/archives/bugtraq/2002-06/0054.html; http://bugzilla.mozilla.org/show_bug.cgi?id=134575; http://www.iss.net/security_center/static/9302.php
CVE: CVE-2002-0806
Published: 2002-08-12
Description: Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, allows authenticated users with editing privileges to delete other users by directly calling the editusers.cgi script with the "del" option.
CVSS Score: 2.1 (LOW)
References: http://archives.neohapsis.com/archives/bugtraq/2002-06/0054.html; http://bugzilla.mozilla.org/show_bug.cgi?id=141557; http://www.iss.net/security_center/static/9303.php
CVE: CVE-2002-0807
Published: 2002-08-12
Description: Cross-site scripting vulnerabilities in Bugzilla 2.14 before 2.14.2, and 2.16 before 2.16rc2, could allow remote attackers to execute script as other Bugzilla users via the full name (real name) field, which is not properly quoted by editusers.cgi.
CVSS Score: 7.5 (HIGH)
References: http://archives.neohapsis.com/archives/bugtraq/2002-06/0054.html; http://bugzilla.mozilla.org/show_bug.cgi?id=146447; http://www.iss.net/security_center/static/9304.php