Page 6 of 33 results (0.010 seconds)

CVSS: 8.8EPSS: 0%CPEs: 5EXPL: 1

CVE-2023-6125 – Code Injection in salesagility/suitecrm

https://notcve.org/view.php?id=CVE-2023-6125

Code Injection in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. Inyección de código en el repositorio de GitHub salesagility/suitecrm anterior a 7.14.2, 7.12.14, 8.4.2. • https://github.com/salesagility/suitecrm/commit/54bc56c3bd9f1db75408db1c1d7d652c3f5f71e9 https://huntr.com/bounties/a9462f1e-9746-4380-8228-533ff2f64691 • CWE-94: Improper Control of Generation of Code ('Code Injection') •

CVSS: 5.0EPSS: 0%CPEs: 5EXPL: 1

CVE-2023-6124 – Server-Side Request Forgery (SSRF) in salesagility/suitecrm

https://notcve.org/view.php?id=CVE-2023-6124

Server-Side Request Forgery (SSRF) in GitHub repository salesagility/suitecrm prior to 7.14.2, 8.4.2, 7.12.14. Server-Side Request Forgery (SSRF) en el repositorio de GitHub salesagility/suitecrm anterior a 7.14.2, 8.4.2, 7.12.14. • https://github.com/salesagility/suitecrm/commit/54bc56c3bd9f1db75408db1c1d7d652c3f5f71e9 https://huntr.com/bounties/aed4d8f3-ab9a-42fd-afea-b3ec288a148e • CWE-918: Server-Side Request Forgery (SSRF) •

CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1

CVE-2023-3627 – Cross-Site Request Forgery (CSRF) in salesagility/suitecrm-core

https://notcve.org/view.php?id=CVE-2023-3627

Cross-Site Request Forgery (CSRF) in GitHub repository salesagility/suitecrm-core prior to 8.3.1. • https://github.com/salesagility/suitecrm-core/commit/78285702d76317f081b1fbc59cb2754e93b9a4c3 https://huntr.dev/bounties/558b3dce-db03-47ba-b60b-c6eb578e04f1 • CWE-352: Cross-Site Request Forgery (CSRF) •

CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 2

CVE-2022-23940

https://notcve.org/view.php?id=CVE-2022-23940

SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution. Authenticated users with access to the Scheduled Reports module can achieve this by leveraging PHP deserialization in the email_recipients property. By using a crafted request, they can create a malicious report, containing a PHP-deserialization payload in the email_recipients field. Once someone accesses this report, the backend will deserialize the content of the email_recipients field and the payload gets executed. Project dependencies include a number of interesting PHP deserialization gadgets (e.g., Monolog/RCE1 from phpggc) that can be used for Code Execution. • https://github.com/manuelz120/CVE-2022-23940 https://docs.suitecrm.com/8.x/admin/releases/8.0 https://github.com/manuelz120 • CWE-502: Deserialization of Untrusted Data •

CVSS: 9.8EPSS: 0%CPEs: 6EXPL: 0

CVE-2021-45899

https://notcve.org/view.php?id=CVE-2021-45899

SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows PHAR deserialization that can lead to remote code execution. SuiteCRM versiones anteriores a 7.12.3 y 8.x versiones anteriores a 8.0.2, permite una deserialización de PHAR que puede conllevar a una ejecución de código remota • https://docs.suitecrm.com/8.x/admin/releases/8.0 https://docs.suitecrm.com/admin/releases/7.12.x • CWE-502: Deserialization of Untrusted Data •