CVSS: 8.8EPSS: 0%CPEs: 10EXPL: 1CVE-2017-14508
https://notcve.org/view.php?id=CVE-2017-14508
17 Sep 2017 — An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). Several areas have been identified in the Documents and Emails module that could allow an authenticated user to perform SQL injection, as demonstrated by a backslash character at the end of a bean_id to modules/Emails/DetailView.php. An attacker could exploit these vulnerabilities by sending a crafted SQL request to the affected areas. An exploit could allow the attacker t... • https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 1%CPEs: 10EXPL: 1CVE-2017-14509
https://notcve.org/view.php?id=CVE-2017-14509
17 Sep 2017 — An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). A remote file inclusion has been identified in the Connectors module allowing authenticated users to include remotely accessible system files via a module=CallRest&url= query string. Proper input validation has been added to mitigate this issue. Existe un problema en SugarCRM en versiones anteriores a la 7.7.2.3, en versiones 7.8.x anteriores a la 7.8.2.2 y en versiones 7.... • https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 0%CPEs: 10EXPL: 1CVE-2017-14510
https://notcve.org/view.php?id=CVE-2017-14510
17 Sep 2017 — An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). The WebToLeadCapture functionality is found vulnerable to unauthenticated cross-site scripting (XSS) attacks. This attack vector is mitigated by proper validating the redirect URL values being passed along. Existe un problema en SugarCRM en versiones anteriores a la 7.7.2.3, en versiones 7.8.x anteriores a la 7.8.2.2 y en versiones 7.9.x anteriores a la 7.9.2.0 (y Sugar Co... • https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2015-5946
https://notcve.org/view.php?id=CVE-2015-5946
07 Aug 2017 — Incomplete blacklist vulnerability in SuiteCRM 7.2.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension. Una vulnerabilidad de lista negra (blacklist) incompleta en SuiteCRM versión 7.2.2, permite a los usuarios autenticados remotos ejecutar código arbitrario al cargar un archivo con una extensión ejecutable. • http://www.openwall.com/lists/oss-security/2015/08/06/6 • CWE-184: Incomplete List of Disallowed Inputs •
CVSS: 9.8EPSS: 0%CPEs: 14EXPL: 8CVE-2011-4833 – SugarCRM Community Edition 6.3.0RC1 - 'index.php' Multiple SQL Injections
https://notcve.org/view.php?id=CVE-2011-4833
15 Dec 2011 — Multiple SQL injection vulnerabilities in the Leads module in SugarCRM 6.1 before 6.1.7, 6.2 before 6.2.4, 6.3 before 6.3.0RC3, and 6.4 before 6.4.0beta1 allow remote attackers to execute arbitrary SQL commands via the (1) where and (2) order parameters in a get_full_list action to index.php. Múltiples vulnerabilidades de inyección SQL en el módulo Leads en SugarCRM v6.1 antes de v6.1.7, v6.2 antes de v6.2.4, v6.3 antes de v6.3.0RC3, y v6.4 antes de v6.4.0beta1, permite a atacantes remotos ejecutar comandos... • https://www.exploit-db.com/exploits/36384 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2011-3803
https://notcve.org/view.php?id=CVE-2011-3803
24 Sep 2011 — SugarCRM 6.1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by themes/Sugar5/layout_utils.php and certain other files. SugarCRM v6.1.0 permite a atacantes remotos obtener información sensible a través de una petición directa a un archivo .php, lo que revela la ruta de instalación en un mensaje de error, como se demostró con themes/Sugar5/layout_utils.php y algunos otros archivos. • http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 33%CPEs: 63EXPL: 2CVE-2011-0745 – SugarCRM 6.1.1 - Information Disclosure
https://notcve.org/view.php?id=CVE-2011-0745
16 Mar 2011 — SugarCRM before 6.1.3 does not properly handle reloads and direct requests for a warning page produced by a certain duplicate check, which allows remote authenticated users to discover (1) the names of customers via a ShowDuplicates action to the Accounts module, reachable through index.php; or (2) the names of contact persons via a ShowDuplicates action to the Contacts module, reachable through index.php. SugarCRM en versiones anteriores a la 6.1.3 no maneja apropiadamente las recargas y peticiones directa... • https://www.exploit-db.com/exploits/35467 • CWE-20: Improper Input Validation •
CVSS: 5.4EPSS: 0%CPEs: 11EXPL: 0CVE-2010-0465
https://notcve.org/view.php?id=CVE-2010-0465
19 Mar 2010 — Cross-site scripting (XSS) vulnerability in the online Documents functionality in SugarCRM 5.2.x before 5.2.0l and 5.5.x before 5.5.0a allows remote authenticated users to inject arbitrary web script or HTML via the Document Name field. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en la funcionalidad de documentos en línea en SugarCRM v5.2.x anterior a v5.2.0l y v5.5.x anterior a v5.5.0a permite a usuarios autenticados remotamente inyectar secuencias de comandos web o HTML ... • http://secunia.com/advisories/38962 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 36EXPL: 0CVE-2009-2978
https://notcve.org/view.php?id=CVE-2009-2978
27 Aug 2009 — SQL injection vulnerability in SugarCRM 4.5.1o and earlier, 5.0.0k and earlier, and 5.2.0g and earlier, allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Vulnerabilidad de inyección SQL en SugarCRM v4.5.1o y anteriores, v5.0.0k y anteriores, y v5.2.0g y anteriores, permite a los atacantes remotos ejecutar arbitrariamente comandos SQL a través de vectores no especificados. • http://jvn.jp/en/jp/JVN31035930/index.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 9EXPL: 3CVE-2009-2146 – SugarCRM 5.2.0e - Remote Code Execution
https://notcve.org/view.php?id=CVE-2009-2146
22 Jun 2009 — Unrestricted file upload vulnerability in the Compose Email feature in the Emails module in Sugar Community Edition (aka SugarCRM) before 5.2f allows remote authenticated users to execute arbitrary code by uploading a file with only an extension in its name, then accessing the file via a direct request to a modified filename under cache/modules/Emails/, as demonstrated using .php as the entire original name. Vulnerabilidad de subida de fichero sin restricción en la caracteristica Compose Email del módulo Em... • https://www.exploit-db.com/exploits/8949 •