CVSS: 6.5EPSS: 0%CPEs: 28EXPL: 2CVE-2013-5091 – vTiger CRM 5.4.0 - 'index.php?onlyforuser' SQL Injection
https://notcve.org/view.php?id=CVE-2013-5091
SQL injection vulnerability in CalendarCommon.php in vTiger CRM 5.4.0 and possibly earlier allows remote authenticated users to execute arbitrary SQL commands via the onlyforuser parameter in an index action to index.php. NOTE: this issue might be a duplicate of CVE-2011-4559. Vulnerabilidad de inyección SQL en CalendarCommon.php en vTiger CRM 5.4.0 y posiblemente anteriores versiones permite a atacantes remotos autenticados ejecutar comandos SQL arbitrarios a través del parámetro onlyforuser e una acción index a index.php. NOTA: este problema podría ser un duplicado del CVE-2011-4559. vtiger CRM version 5.4.0 suffers from a remote SQL injection vulnerability. • https://www.exploit-db.com/exploits/28409 http://archives.neohapsis.com/archives/bugtraq/2013-09/0079.html http://osvdb.org/76138 http://sourceforge.net/projects/vtigercrm/files/vtiger%20CRM%205.4.0/Core%20Product http://www.exploit-db.com/exploits/28409 https://www.htbridge.com/advisory/HTB23168 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 17%CPEs: 1EXPL: 1CVE-2013-3215 – vTiger CRM 5.4.0 SOAP - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2013-3215
vtiger CRM 5.4.0 and earlier contain an Authentication Bypass Vulnerability due to improper authentication validation in the validateSession function. vtiger CRM versión 5.4.0 y versiones anteriores, contiene una vulnerabilidad de Omisión de Autenticación debido a una comprobación de autenticación inapropiada en la función validateSession. • https://www.exploit-db.com/exploits/27279 http://www.securityfocus.com/bid/61559 https://exchange.xforce.ibmcloud.com/vulnerabilities/86163 • CWE-287: Improper Authentication •
CVSS: 7.5EPSS: 0%CPEs: 12EXPL: 3CVE-2013-3213 – vTiger CRM 5.4.0 SOAP - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2013-3213
Multiple SQL injection vulnerabilities in vTiger CRM 5.0.0 through 5.4.0 allow remote attackers to execute arbitrary SQL commands via the (1) picklist_name parameter in the get_picklists method to soap/customerportal.php, (2) where parameter in the get_tickets_list method to soap/customerportal.php, or (3) emailaddress parameter in the SearchContactsByEmail method to soap/vtigerolservice.php; or remote authenticated users to execute arbitrary SQL commands via the (4) emailaddress parameter in the SearchContactsByEmail method to soap/thunderbirdplugin.php. Múltiples vulnerabilidades inyección SQL en vTiger CRM 5.0.0 hasta 5.4.0 permiten a atacantes remotos ejecutar comandos SQL arbitrarios a través del (1) parámetro picklist_name en el método get_picklists hacia soap/customerportal.php, (2) parámetro where en el método get_tickets_list hacia soap/customerportal.php o (3) parámetro emailaddress en el método SearchContactsByEmail hacia soap/vtigerolservice.php; o usuarios remotos autenticados ejecutar comandos SQL arbitrarios a través del (4) parámetro emailaddress en el método SearchContactsByEmail hacia soap/thunderbirdplugin.php. • https://www.exploit-db.com/exploits/27279 http://archives.neohapsis.com/archives/bugtraq/2013-08/0001.html http://karmainsecurity.com/KIS-2013-06 http://www.securityfocus.com/bid/61563 https://exchange.xforce.ibmcloud.com/vulnerabilities/86129 https://www.vtiger.com/blogs/?p=1467 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.1EPSS: 7%CPEs: 1EXPL: 2CVE-2013-3212 – vTiger CRM 5.4.0 SOAP - Multiple Vulnerabilities
https://notcve.org/view.php?id=CVE-2013-3212
vtiger CRM 5.4.0 and earlier contain local file-include vulnerabilities in 'customerportal.php' which allows remote attackers to view files and execute local script code. vtiger CRM versiones 5.4.0 y anteriores, contienen vulnerabilidades de inclusión de archivo local en el archivo "customerportal.php" que permite a atacantes remotos visualizar archivos y ejecutar código de script local. • https://www.exploit-db.com/exploits/27279 http://www.exploit-db.com/exploits/27279 http://www.securityfocus.com/bid/61560 https://exchange.xforce.ibmcloud.com/vulnerabilities/86162 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 9.8EPSS: 83%CPEs: 1EXPL: 4CVE-2013-3214 – vTiger CRM 5.4.0 SOAP - AddEmailAttachment Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2013-3214
vtiger CRM 5.4.0 and earlier contain a PHP Code Injection Vulnerability in 'vtigerolservice.php'. vtiger CRM versiones 5.4.0 y anteriores, contiene una vulnerabilidad de inyección de código PHP en el archivo "vtigerolservice.php". • https://www.exploit-db.com/exploits/30787 https://www.exploit-db.com/exploits/27279 https://github.com/shadofren/CVE-2013-3214 http://www.exploit-db.com/exploits/30787 http://www.securityfocus.com/bid/61558 https://exchange.xforce.ibmcloud.com/vulnerabilities/86164 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •