CVE-2010-0180

Install/Filesystem.pm in Bugzilla 3.5.1 through 3.6 and 3.7, when use_suexec is enabled, uses world-readable permissions for the localconfig files, which allows local users to read sensitive configuration fields, as demonstrated by the database password field and the site_wide_secret field.

• CWE-264

• http://secunia.com/advisories/40300Vendor Advisory
• http://www.bugzilla.org/security/3.2.6/Vendor Advisory
• http://www.securityfocus.com/bid/41144
• http://www.vupen.com/english/advisories/2010/1595Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=561797
• http://secunia.com/advisories/40300Vendor Advisory
• http://www.bugzilla.org/security/3.2.6/Vendor Advisory
• http://www.securityfocus.com/bid/41144
• http://www.vupen.com/english/advisories/2010/1595Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=561797

Published

Jun 28, 2010

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2010-0174Multiple unspecified vulnerabilities in the browser engine i…
• CVE-2010-0175Use-after-free vulnerability in the nsTreeSelection implemen…
• CVE-2010-0176Mozilla Firefox before 3.0.19, 3.5.x before 3.5.9, and 3.6.x…
• CVE-2010-0177Mozilla Firefox before 3.0.19, 3.5.x before 3.5.9, and 3.6.x…
• CVE-2010-0178Mozilla Firefox before 3.0.19, 3.5.x before 3.5.9, and 3.6.x…
• CVE-2010-0179Mozilla Firefox before 3.0.19 and 3.5.x before 3.5.8, and Se…
• CVE-2010-0181Mozilla Firefox before 3.5.9 and 3.6.x before 3.6.2, and Sea…
• CVE-2010-0182The XMLDocument::load function in Mozilla Firefox before 3.5…
• CVE-2010-0183Use-after-free vulnerability in the nsCycleCollector::MarkRo…
• CVE-2010-0184The (1) domainutility and (2) domainutilitycmd components in…
• CVE-2010-0185The default configuration of Adobe ColdFusion 9.0 does not r…
• CVE-2010-0186Cross-domain vulnerability in Adobe Flash Player before 10.0…