Page 6 of 34 results (0.005 seconds)

CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 1

CVE-2023-6125 – Code Injection in salesagility/suitecrm

https://notcve.org/view.php?id=CVE-2023-6125

Code Injection in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. Inyección de código en el repositorio de GitHub salesagility/suitecrm anterior a 7.14.2, 7.12.14, 8.4.2. • https://github.com/salesagility/suitecrm/commit/54bc56c3bd9f1db75408db1c1d7d652c3f5f71e9 https://huntr.com/bounties/a9462f1e-9746-4380-8228-533ff2f64691 • CWE-94: Improper Control of Generation of Code ('Code Injection') •

CVSS: 5.0EPSS: 0%CPEs: 5EXPL: 1

CVE-2023-6124 – Server-Side Request Forgery (SSRF) in salesagility/suitecrm

https://notcve.org/view.php?id=CVE-2023-6124

Server-Side Request Forgery (SSRF) in GitHub repository salesagility/suitecrm prior to 7.14.2, 8.4.2, 7.12.14. Server-Side Request Forgery (SSRF) en el repositorio de GitHub salesagility/suitecrm anterior a 7.14.2, 8.4.2, 7.12.14. • https://github.com/salesagility/suitecrm/commit/54bc56c3bd9f1db75408db1c1d7d652c3f5f71e9 https://huntr.com/bounties/aed4d8f3-ab9a-42fd-afea-b3ec288a148e • CWE-918: Server-Side Request Forgery (SSRF) •

CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1

CVE-2023-3627 – Cross-Site Request Forgery (CSRF) in salesagility/suitecrm-core

https://notcve.org/view.php?id=CVE-2023-3627

Cross-Site Request Forgery (CSRF) in GitHub repository salesagility/suitecrm-core prior to 8.3.1. • https://github.com/salesagility/suitecrm-core/commit/78285702d76317f081b1fbc59cb2754e93b9a4c3 https://huntr.dev/bounties/558b3dce-db03-47ba-b60b-c6eb578e04f1 • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 7.6EPSS: 0%CPEs: 1EXPL: 1

CVE-2023-3293 – Cross-site Scripting (XSS) - Stored in salesagility/suitecrm-core

https://notcve.org/view.php?id=CVE-2023-3293

Cross-site Scripting (XSS) - Stored in GitHub repository salesagility/suitecrm-core prior to 8.3.0. • https://github.com/salesagility/suitecrm-core/commit/1f949f1ac2b7fe82f3c2c6071f842b804ba91929 https://huntr.dev/bounties/22cb0ee3-e5da-40e0-9d2c-ace9b759f171 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •

CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 2

CVE-2022-23940

https://notcve.org/view.php?id=CVE-2022-23940

SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution. Authenticated users with access to the Scheduled Reports module can achieve this by leveraging PHP deserialization in the email_recipients property. By using a crafted request, they can create a malicious report, containing a PHP-deserialization payload in the email_recipients field. Once someone accesses this report, the backend will deserialize the content of the email_recipients field and the payload gets executed. Project dependencies include a number of interesting PHP deserialization gadgets (e.g., Monolog/RCE1 from phpggc) that can be used for Code Execution. • https://github.com/manuelz120/CVE-2022-23940 https://docs.suitecrm.com/8.x/admin/releases/8.0 https://github.com/manuelz120 • CWE-502: Deserialization of Untrusted Data •