CVSS: 6.0EPSS: 1%CPEs: 9EXPL: 3CVE-2009-2146 – SugarCRM 5.2.0e - Remote Code Execution
https://notcve.org/view.php?id=CVE-2009-2146
Unrestricted file upload vulnerability in the Compose Email feature in the Emails module in Sugar Community Edition (aka SugarCRM) before 5.2f allows remote authenticated users to execute arbitrary code by uploading a file with only an extension in its name, then accessing the file via a direct request to a modified filename under cache/modules/Emails/, as demonstrated using .php as the entire original name. Vulnerabilidad de subida de fichero sin restricción en la caracteristica Compose Email del módulo Emails in Sugar Community Edition (también conocido como SugarCRM) versión anterior a 5.2f permite a atacantes remotos ejecutar código de su elección subiendo un fichero con una extensión ejecutable, posteriormente accediendo al fichero mediante una petición directa a un fichero modificado del directorio cache/modules/Emails/, como se ha demostrado al usar .php como el nombre completo original • https://www.exploit-db.com/exploits/8949 http://secunia.com/advisories/35445 http://www.securityfocus.com/bid/35361 http://www.sugarforge.org/frs/download.php/5598/Sugar_CommunityEdition_ReleaseNotes_5.2f.pdf http://www.ush.it/team/ush/hack-sugarcrm_520e/adv.txt •
CVSS: 5.0EPSS: 2%CPEs: 2EXPL: 1CVE-2008-2045 – SugarCRM Community Edition 4.5.1/5.0.0 - File Disclosure
https://notcve.org/view.php?id=CVE-2008-2045
Absolute path traversal vulnerability in SugarCRM Sugar Community Edition 4.5.1 and 5.0.0 allows remote attackers to read arbitrary files via a full path in the URL parameter to modules/Feeds/Feed.php, which places the contents into a related cache file in the .cache/feeds directory. Vulnerabilidad de salto de ruta absoluta en SugarCRM Sugar Community Edition 4.5.1 y 5.0.0, permite a atacantes remotos leer los ficheros que deseen escribiendo una ruta completa en el parámetro URL de modules/Feeds/Feed.php, esto guarda el contenido en un fichero de caché relacionado, en el directorio .cache/feeds. • https://www.exploit-db.com/exploits/5521 http://secunia.com/advisories/30002 http://securityreason.com/securityalert/3844 http://www.security-assessment.com/files/advisories/2008-04-29_SugarCRM_local_file_disclosure.pdf http://www.securityfocus.com/archive/1/491417/100/0/threaded http://www.securityfocus.com/bid/28981 http://www.sugarcrm.com/docs/Release_Notes/CommunityEdition_ReleaseNotes_5.0d/Sugar_Release_Notes_5.0d.2.6.html http://www.sugarcrm.com/forums/showthread.php?t=31688 http • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.8EPSS: 3%CPEs: 1EXPL: 0CVE-2006-6712
https://notcve.org/view.php?id=CVE-2006-6712
Cross-site scripting (XSS) vulnerability in SugarCRM Open Source 4.5.0f and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in crafted email messages. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en SugarCRM Open Source 4.5.0f y anteriores permite a un atacante remoto inyectar secuencias de comandos web o HTML a través de vectores no especificados en mensajes de correo manipulados. • http://dl.sugarforge.org/sugardocs/Notes/ReleaseNotes/SugarOpenSource_ReleaseNotes_4.5.0g.pdf http://jvn.jp/jp/JVN%2374079537/index.html http://secunia.com/advisories/23424 http://securitytracker.com/id?1017434 http://www.securityfocus.com/bid/21694 http://www.vupen.com/english/advisories/2006/5100 •
CVSS: 6.4EPSS: 3%CPEs: 4EXPL: 4CVE-2006-2460 – Sugar Suite Open Source 4.2 - 'OptimisticLock' Command Execution
https://notcve.org/view.php?id=CVE-2006-2460
Sugar Suite Open Source (SugarCRM) 4.2 and earlier, when register_globals is enabled, does not protect critical variables such as $_GLOBALS and $_SESSION from modification, which allows remote attackers to conduct attacks such as directory traversal or PHP remote file inclusion, as demonstrated by modifying the GLOBALS[sugarEntry] parameter. • https://www.exploit-db.com/exploits/1785 http://retrogod.altervista.org/sugar_suite_42_incl_xpl.html http://secunia.com/advisories/20072 http://securityreason.com/securityalert/921 http://securitytracker.com/id?1016087 http://www.osvdb.org/25532 http://www.securityfocus.com/archive/1/434009/100/0/threaded http://www.securityfocus.com/bid/17987 http://www.vupen.com/english/advisories/2006/1791 https://exchange.xforce.ibmcloud.com/vulnerabilities/26451 •
CVSS: 4.3EPSS: 0%CPEs: 13EXPL: 0CVE-2005-0266
https://notcve.org/view.php?id=CVE-2005-0266
Cross-site scripting (XSS) vulnerability in index.php in SugarCRM 1.X allows remote attackers to inject arbitrary web script or HTML via the (1) return_module, (2) return_action, (3) name, (4) module, or (5) record parameter. • http://marc.info/?l=bugtraq&m=110461706232174&w=2 http://www.securityfocus.com/bid/12113 https://exchange.xforce.ibmcloud.com/vulnerabilities/18719 •