Page 5 of 59 results (0.008 seconds)

CVSS: 8.1EPSS: 7%CPEs: 1EXPL: 2

CVE-2013-3212 – vTiger CRM 5.4.0 SOAP - Multiple Vulnerabilities

https://notcve.org/view.php?id=CVE-2013-3212

vtiger CRM 5.4.0 and earlier contain local file-include vulnerabilities in 'customerportal.php' which allows remote attackers to view files and execute local script code. vtiger CRM versiones 5.4.0 y anteriores, contienen vulnerabilidades de inclusión de archivo local en el archivo "customerportal.php" que permite a atacantes remotos visualizar archivos y ejecutar código de script local. • https://www.exploit-db.com/exploits/27279 http://www.exploit-db.com/exploits/27279 http://www.securityfocus.com/bid/61560 https://exchange.xforce.ibmcloud.com/vulnerabilities/86162 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •

CVSS: 9.8EPSS: 83%CPEs: 1EXPL: 4

CVE-2013-3214 – vTiger CRM 5.4.0 SOAP - AddEmailAttachment Arbitrary File Upload

https://notcve.org/view.php?id=CVE-2013-3214

vtiger CRM 5.4.0 and earlier contain a PHP Code Injection Vulnerability in 'vtigerolservice.php'. vtiger CRM versiones 5.4.0 y anteriores, contiene una vulnerabilidad de inyección de código PHP en el archivo "vtigerolservice.php". • https://www.exploit-db.com/exploits/30787 https://www.exploit-db.com/exploits/27279 https://github.com/shadofren/CVE-2013-3214 http://www.exploit-db.com/exploits/30787 http://www.securityfocus.com/bid/61558 https://exchange.xforce.ibmcloud.com/vulnerabilities/86164 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •

CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 3

CVE-2012-4867 – vTiger CRM 5.1.0 - Local File Inclusion

https://notcve.org/view.php?id=CVE-2012-4867

Directory traversal vulnerability in modules/com_vtiger_workflow/sortfieldsjson.php in vtiger CRM 5.1.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the module_name parameter. Vulnerabilidad de directorio transversal en modules/com_vtiger_workflow/sortfieldsjson.php en vtiger CRM v5.1.0 permite a atacantes remotos leer archivos de su elección a través de .. (punto punto) en el parámetro module_name. • https://www.exploit-db.com/exploits/18770 http://packetstormsecurity.org/files/111075/Vtiger-5.1.0-Local-File-Inclusion.html http://www.exploit-db.com/exploits/18635 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •

CVSS: 4.0EPSS: 0%CPEs: 1EXPL: 2

CVE-2011-4679

https://notcve.org/view.php?id=CVE-2011-4679

vtiger CRM before 5.3.0 does not properly recognize the disabled status of a field in the Leads module, which allows remote authenticated users to bypass intended access restrictions by reading a previously created report. vtiger CRM antes de v5.3.0 no reconoce adecuadamente el estado deshabilitado de un campo en el módulo Leads, lo que permite a usuarios autenticados remotamente evitar restricciones de acceso intencionadas leyendo un informe previamente creado. • http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/7003 http://trac.vtiger.com/cgi-bin/trac.cgi/ticket/7004 http://wiki.vtiger.com/index.php/Oct2011:ODUpdate • CWE-264: Permissions, Privileges, and Access Controls •

CVSS: 4.3EPSS: 0%CPEs: 26EXPL: 0

CVE-2011-4680

https://notcve.org/view.php?id=CVE-2011-4680

Multiple cross-site scripting (XSS) vulnerabilities in the customer portal in vtiger CRM before 5.2.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en el portal del cliente en vtiger CRM antes de v5.2.0, permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través de vectores no especificados. • http://wiki.vtiger.com/index.php/Jan2011:ODUpdate • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •