CVSS: 6.1EPSS: 0%CPEs: 10EXPL: 1CVE-2017-14510
https://notcve.org/view.php?id=CVE-2017-14510
17 Sep 2017 — An issue was discovered in SugarCRM before 7.7.2.3, 7.8.x before 7.8.2.2, and 7.9.x before 7.9.2.0 (and Sugar Community Edition 6.5.26). The WebToLeadCapture functionality is found vulnerable to unauthenticated cross-site scripting (XSS) attacks. This attack vector is mitigated by proper validating the redirect URL values being passed along. Existe un problema en SugarCRM en versiones anteriores a la 7.7.2.3, en versiones 7.8.x anteriores a la 7.8.2.2 y en versiones 7.9.x anteriores a la 7.9.2.0 (y Sugar Co... • https://blog.ripstech.com/2017/sugarcrm-security-diet-multiple-vulnerabilities • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2015-5946
https://notcve.org/view.php?id=CVE-2015-5946
07 Aug 2017 — Incomplete blacklist vulnerability in SuiteCRM 7.2.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension. Una vulnerabilidad de lista negra (blacklist) incompleta en SuiteCRM versión 7.2.2, permite a los usuarios autenticados remotos ejecutar código arbitrario al cargar un archivo con una extensión ejecutable. • http://www.openwall.com/lists/oss-security/2015/08/06/6 • CWE-184: Incomplete List of Disallowed Inputs •
CVSS: 9.8EPSS: 83%CPEs: 1EXPL: 4CVE-2012-0694 – SugarCRM unserialize() PHP Code Execution
https://notcve.org/view.php?id=CVE-2012-0694
25 Jun 2012 — SugarCRM CE <= 6.3.1 contains scripts that use "unserialize()" with user controlled input which allows remote attackers to execute arbitrary PHP code. SugarCRM CE versiones anteriores a 6.3.1 incluyéndola, contiene scripts que usan la función "unserialize()" con entrada controlada por el usuario lo que permite a atacantes remotos ejecutar código PHP arbitrario. SugarCRM CE versions 6.3.1 and below suffer from an unserialize() PHP code execution vulnerability. • https://packetstorm.news/files/id/114144 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 1%CPEs: 14EXPL: 8CVE-2011-4833 – SugarCRM Community Edition 6.3.0RC1 - 'index.php' Multiple SQL Injections
https://notcve.org/view.php?id=CVE-2011-4833
15 Dec 2011 — Multiple SQL injection vulnerabilities in the Leads module in SugarCRM 6.1 before 6.1.7, 6.2 before 6.2.4, 6.3 before 6.3.0RC3, and 6.4 before 6.4.0beta1 allow remote attackers to execute arbitrary SQL commands via the (1) where and (2) order parameters in a get_full_list action to index.php. Múltiples vulnerabilidades de inyección SQL en el módulo Leads en SugarCRM v6.1 antes de v6.1.7, v6.2 antes de v6.2.4, v6.3 antes de v6.3.0RC3, y v6.4 antes de v6.4.0beta1, permite a atacantes remotos ejecutar comandos... • https://www.exploit-db.com/exploits/36384 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2011-3803
https://notcve.org/view.php?id=CVE-2011-3803
24 Sep 2011 — SugarCRM 6.1.0 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by themes/Sugar5/layout_utils.php and certain other files. SugarCRM v6.1.0 permite a atacantes remotos obtener información sensible a través de una petición directa a un archivo .php, lo que revela la ruta de instalación en un mensaje de error, como se demostró con themes/Sugar5/layout_utils.php y algunos otros archivos. • http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 6%CPEs: 63EXPL: 3CVE-2011-0745 – SugarCRM 6.1.1 - Information Disclosure
https://notcve.org/view.php?id=CVE-2011-0745
16 Mar 2011 — SugarCRM before 6.1.3 does not properly handle reloads and direct requests for a warning page produced by a certain duplicate check, which allows remote authenticated users to discover (1) the names of customers via a ShowDuplicates action to the Accounts module, reachable through index.php; or (2) the names of contact persons via a ShowDuplicates action to the Contacts module, reachable through index.php. SugarCRM en versiones anteriores a la 6.1.3 no maneja apropiadamente las recargas y peticiones directa... • https://packetstorm.news/files/id/99378 • CWE-20: Improper Input Validation •
CVSS: 5.4EPSS: 0%CPEs: 11EXPL: 1CVE-2010-0465 – SugarCRM Cross Site Scripting
https://notcve.org/view.php?id=CVE-2010-0465
16 Mar 2010 — Cross-site scripting (XSS) vulnerability in the online Documents functionality in SugarCRM 5.2.x before 5.2.0l and 5.5.x before 5.5.0a allows remote authenticated users to inject arbitrary web script or HTML via the Document Name field. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en la funcionalidad de documentos en línea en SugarCRM v5.2.x anterior a v5.2.0l y v5.5.x anterior a v5.5.0a permite a usuarios autenticados remotamente inyectar secuencias de comandos web o HTML ... • https://packetstorm.news/files/id/87330 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 36EXPL: 0CVE-2009-2978
https://notcve.org/view.php?id=CVE-2009-2978
27 Aug 2009 — SQL injection vulnerability in SugarCRM 4.5.1o and earlier, 5.0.0k and earlier, and 5.2.0g and earlier, allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Vulnerabilidad de inyección SQL en SugarCRM v4.5.1o y anteriores, v5.0.0k y anteriores, y v5.2.0g y anteriores, permite a los atacantes remotos ejecutar arbitrariamente comandos SQL a través de vectores no especificados. • http://jvn.jp/en/jp/JVN31035930/index.html • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 7%CPEs: 9EXPL: 3CVE-2009-2146 – SugarCRM 5.2.0e - Remote Code Execution
https://notcve.org/view.php?id=CVE-2009-2146
22 Jun 2009 — Unrestricted file upload vulnerability in the Compose Email feature in the Emails module in Sugar Community Edition (aka SugarCRM) before 5.2f allows remote authenticated users to execute arbitrary code by uploading a file with only an extension in its name, then accessing the file via a direct request to a modified filename under cache/modules/Emails/, as demonstrated using .php as the entire original name. Vulnerabilidad de subida de fichero sin restricción en la caracteristica Compose Email del módulo Em... • https://www.exploit-db.com/exploits/8949 •
CVSS: 7.5EPSS: 9%CPEs: 2EXPL: 1CVE-2008-2045 – SugarCRM Community Edition 4.5.1/5.0.0 - File Disclosure
https://notcve.org/view.php?id=CVE-2008-2045
01 May 2008 — Absolute path traversal vulnerability in SugarCRM Sugar Community Edition 4.5.1 and 5.0.0 allows remote attackers to read arbitrary files via a full path in the URL parameter to modules/Feeds/Feed.php, which places the contents into a related cache file in the .cache/feeds directory. Vulnerabilidad de salto de ruta absoluta en SugarCRM Sugar Community Edition 4.5.1 y 5.0.0, permite a atacantes remotos leer los ficheros que deseen escribiendo una ruta completa en el parámetro URL de modules/Feeds/Feed.php, e... • https://www.exploit-db.com/exploits/5521 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •