Lucene search

K

CRM Security Vulnerabilities

cve
cve

CVE-2019-14767

In DIMO YellowBox CRM before 6.3.4, Path Traversal in images/Apparence (dossier=../) and servletrecuperefichier (document=../) allows an unauthenticated user to download arbitrary files from the...

7.5CVSS

7.5AI Score

0.004EPSS

2020-01-21 04:15 PM
22
cve
cve

CVE-2020-2657

Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Supported versions that are affected are 12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle...

4.7CVSS

4.6AI Score

0.001EPSS

2020-01-15 05:15 PM
20
cve
cve

CVE-2020-2651

Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Supported versions that are affected are 12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle...

8.2CVSS

8.2AI Score

0.002EPSS

2020-01-15 05:15 PM
22
4
cve
cve

CVE-2020-2652

Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Supported versions that are affected are 12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle...

8.2CVSS

8.2AI Score

0.002EPSS

2020-01-15 05:15 PM
24
cve
cve

CVE-2020-2653

Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Supported versions that are affected are 12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle...

8.2CVSS

8.2AI Score

0.002EPSS

2020-01-15 05:15 PM
30
2
cve
cve

CVE-2020-2596

Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Message Hooks). Supported versions that are affected are 12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle....

4.7CVSS

4.6AI Score

0.001EPSS

2020-01-15 05:15 PM
32
cve
cve

CVE-2014-4984

Déjà Vu Crescendo Sales CRM has remote SQL...

9.8CVSS

9.8AI Score

0.02EPSS

2020-01-10 01:15 PM
21
cve
cve

CVE-2020-5511

PHPGurukul Small CRM v2.0 was found vulnerable to authentication bypass via SQL injection when logging into the administrator login...

8.8CVSS

9.2AI Score

0.001EPSS

2020-01-08 06:15 PM
34
cve
cve

CVE-2019-17563

When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution,...

7.5CVSS

7.7AI Score

0.004EPSS

2019-12-23 05:15 PM
838
3
cve
cve

CVE-2019-19206

Dolibarr CRM/ERP 10.0.3 allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile...

5.4CVSS

5.1AI Score

0.001EPSS

2019-11-26 03:15 PM
24
2
cve
cve

CVE-2019-19202

In Vtiger 7.x before 7.2.0, the My Preferences saving functionality allows a user without administrative privileges to change his own role by adding roleid=H2 to a POST...

8.8CVSS

8.6AI Score

0.001EPSS

2019-11-21 08:15 PM
47
cve
cve

CVE-2013-2093

Dolibarr ERP/CRM 3.3.1 does not properly validate user input in viewimage.php and barcode.lib.php which allows remote attackers to execute arbitrary...

9.8CVSS

9.6AI Score

0.037EPSS

2019-11-20 09:15 PM
65
2
cve
cve

CVE-2013-2092

Cross-site Scripting (XSS) in Dolibarr ERP/CRM 3.3.1 allows remote attackers to inject arbitrary web script or HTML in...

6.1CVSS

6AI Score

0.001EPSS

2019-11-20 09:15 PM
53
2
cve
cve

CVE-2013-2091

SQL injection vulnerability in Dolibarr ERP/CRM 3.3.1 allows remote attackers to execute arbitrary SQL commands via the 'pays' parameter in...

9.8CVSS

9.9AI Score

0.009EPSS

2019-11-20 08:15 PM
48
2
cve
cve

CVE-2019-2965

Vulnerability in the Siebel Core - DB Deployment and Configuration product of Oracle Siebel CRM (component: Install - Configuration). Supported versions that are affected are 19.8 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise....

7.5CVSS

7.2AI Score

0.003EPSS

2019-10-16 06:15 PM
39
cve
cve

CVE-2019-2896

Vulnerability in the MICROS Relate CRM Software product of Oracle Retail Applications (component: Internal Operations). Supported versions that are affected are 7.1.0, 15.0.0, 16.0.0, 17.0.0, and 18.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via...

5.9CVSS

5.6AI Score

0.002EPSS

2019-10-16 06:15 PM
18
cve
cve

CVE-2019-17576

An issue was discovered in Dolibarr 10.0.2. It has XSS via the "outgoing email setup" feature in the /admin/mails.php?action=edit URI via the "Send all emails to (instead of real recipients, for test purposes)"...

5.4CVSS

5.2AI Score

0.001EPSS

2019-10-16 06:15 PM
25
cve
cve

CVE-2019-17577

An issue was discovered in Dolibarr 10.0.2. It has XSS via the "outgoing email setup" feature in the admin/mails.php?action=edit URI via the "Email used for error returns emails (fields 'Errors-To' in emails sent)"...

5.4CVSS

5.2AI Score

0.001EPSS

2019-10-16 06:15 PM
24
cve
cve

CVE-2019-17578

An issue was discovered in Dolibarr 10.0.2. It has XSS via the "outgoing email setup" feature in the admin/mails.php?action=edit URI via the "Sender email for automatic emails (default value in php.ini: Undefined)"...

5.4CVSS

5.2AI Score

0.001EPSS

2019-10-16 06:15 PM
28
cve
cve

CVE-2019-17223

There is HTML Injection in the Note field in Dolibarr ERP/CRM 10.0.2 via...

6.1CVSS

6.3AI Score

0.001EPSS

2019-10-15 12:15 PM
29
cve
cve

CVE-2019-16686

Dolibarr 9.0.5 has stored XSS in a User Note section to note.php. A user with no privileges can inject script to attack the...

5.4CVSS

5.2AI Score

0.001EPSS

2019-09-27 08:15 PM
187
cve
cve

CVE-2019-16687

Dolibarr 9.0.5 has stored XSS in a User Profile in a Signature section to card.php. A user with the "Create/modify other users, groups and permissions" privilege can inject script and can also achieve privilege...

5.4CVSS

5.2AI Score

0.001EPSS

2019-09-27 08:15 PM
188
cve
cve

CVE-2019-16688

Dolibarr 9.0.5 has stored XSS in an Email Template section to mails_templates.php. A user with no privileges can inject script to attack the admin. (This stored XSS can affect all types of user privilege from Admin to users with no...

5.4CVSS

5.1AI Score

0.001EPSS

2019-09-27 08:15 PM
187
2
cve
cve

CVE-2019-16685

Dolibarr 9.0.5 has stored XSS vulnerability via a User Group Description section to card.php. A user with the "Create/modify other users, groups and permissions" privilege can inject script and can also achieve privilege...

5.4CVSS

5.1AI Score

0.001EPSS

2019-09-27 08:15 PM
187
2
cve
cve

CVE-2019-15301

A SQL injection vulnerability in the method Terrasoft.Core.DB.Column.Const() in Terrasoft Bpm'online CRM-System SDK 7.13 allows attackers to execute arbitrary SQL commands via the value...

9.8CVSS

9.8AI Score

0.001EPSS

2019-09-18 09:15 PM
78
cve
cve

CVE-2019-15950

The CRM Plugin before 4.2.4 for Redmine allows XSS via crafted vCard...

6.1CVSS

6AI Score

0.001EPSS

2019-09-16 04:15 PM
31
cve
cve

CVE-2019-16197

In htdocs/societe/card.php in Dolibarr 10.0.1, the value of the User-Agent HTTP header is copied into the HTML document as plain text between tags, leading to...

6.1CVSS

5.9AI Score

0.001EPSS

2019-09-16 01:15 PM
62
cve
cve

CVE-2019-11457

Multiple CSRF issues exist in MicroPyramid Django CRM 0.2.1 via /change-password-by-admin/, /api/settings/add/, /cases/create/, /change-password-by-admin/, /comment/add/, /documents/1/view/, /documents/create/, /opportunities/create/, and...

8.8CVSS

8.6AI Score

0.003EPSS

2019-08-27 03:15 PM
100
cve
cve

CVE-2018-20975

Fat Free CRM before 0.18.1 has XSS in the tags_helper in...

6.1CVSS

5.9AI Score

0.001EPSS

2019-08-20 01:15 PM
44
cve
cve

CVE-2019-15062

An issue was discovered in Dolibarr 11.0.0-alpha. A user can store an IFRAME element (containing a user/card.php CSRF request) in his Linked Files settings page. When visited by the admin, this could completely take over the admin account. (The protection mechanism for CSRF is to check the Referer....

8CVSS

7.6AI Score

0.001EPSS

2019-08-14 11:15 PM
40
2
cve
cve

CVE-2019-11200

Dolibarr ERP/CRM 9.0.1 provides a web-based functionality that backs up the database content to a dump file. However, the application performs insufficient checks on the export parameters to mysqldump, which can lead to execution of arbitrary binaries on the server. (Malicious binaries can be...

8.8CVSS

8.6AI Score

0.001EPSS

2019-07-29 04:15 PM
30
cve
cve

CVE-2019-11199

Dolibarr ERP/CRM 9.0.1 was affected by stored XSS within uploaded files. These vulnerabilities allowed the execution of a JavaScript payload each time any regular user or administrative user clicked on the malicious link hosted on the same domain. The vulnerabilities could be exploited by low...

5.4CVSS

5.7AI Score

0.001EPSS

2019-07-29 04:15 PM
19
cve
cve

CVE-2019-11201

Dolibarr ERP/CRM 9.0.1 provides a module named website that provides for creation of public websites with a WYSIWYG editor. It was identified that the editor also allowed inclusion of dynamic code, which can lead to code execution on the host machine. An attacker has to check a setting on the same....

8CVSS

7.9AI Score

0.001EPSS

2019-07-29 04:15 PM
25
cve
cve

CVE-2019-2837

Vulnerability in the Oracle CRM Technical Foundation component of Oracle E-Business Suite (subcomponent: User Interface). Supported versions that are affected are 12.1.3 and 12.2.3 - 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise....

8.2CVSS

8.1AI Score

0.002EPSS

2019-07-23 11:15 PM
70
cve
cve

CVE-2019-1010054

Dolibarr 7.0.0 is affected by: Cross Site Request Forgery (CSRF). The impact is: allow malitious html to change user password, disable users and disable password encryptation. The component is: Function User password change, user disable and password encryptation. The attack vector is: admin...

8.8CVSS

8.7AI Score

0.001EPSS

2019-07-18 01:15 PM
35
cve
cve

CVE-2019-1010016

Dolibarr 6.0.4 is affected by: Cross Site Scripting (XSS). The impact is: Cookie stealing. The component is: htdocs/product/stats/card.php. The attack vector is: Victim must click a specially crafted link sent by the...

6.1CVSS

6AI Score

0.001EPSS

2019-07-15 03:15 AM
149
2
cve
cve

CVE-2019-10226

HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI. NOTE: the vendor disputes the significance of this report because some HTML formatting (such as with an H1 element) is allowed, but there is a XSS protection...

5.4CVSS

5.2AI Score

0.015EPSS

2019-06-10 11:29 PM
97
cve
cve

CVE-2018-8047

vtiger CRM 7.0.1 is affected by one reflected Cross-Site Scripting (XSS) vulnerability affecting version 7.0.1 and probably prior versions. This vulnerability could allow remote unauthenticated attackers to inject arbitrary web script or HTML via index.php?module=Contacts&view=List (app...

6.1CVSS

6AI Score

0.001EPSS

2019-06-06 07:29 PM
145
cve
cve

CVE-2016-10754

modules/Calendar/Activity.php in Vtiger CRM 6.5.0 allows SQL injection via the contactidlist...

8.8CVSS

9AI Score

0.001EPSS

2019-05-24 06:29 PM
45
cve
cve

CVE-2019-11057

SQL injection vulnerability in Vtiger CRM before 7.1.0 hotfix3 allows authenticated users to execute arbitrary SQL...

8.8CVSS

8.9AI Score

0.003EPSS

2019-05-17 05:29 PM
24
cve
cve

CVE-2019-1008

A security feature bypass vulnerability exists in Dynamics On Premise, aka 'Microsoft Dynamics On-Premise Security Feature...

5.9CVSS

5.6AI Score

0.001EPSS

2019-05-16 07:29 PM
68
cve
cve

CVE-2019-2676

Vulnerability in the Oracle CRM Technical Foundation component of Oracle E-Business Suite (subcomponent: Preferences). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with network...

4.7CVSS

4.5AI Score

0.001EPSS

2019-04-23 07:32 PM
23
cve
cve

CVE-2019-2671

Vulnerability in the Oracle CRM Technical Foundation component of Oracle E-Business Suite (subcomponent: Preferences). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with network...

8.2CVSS

8.1AI Score

0.002EPSS

2019-04-23 07:32 PM
18
cve
cve

CVE-2019-2669

Vulnerability in the Oracle CRM Technical Foundation component of Oracle E-Business Suite (subcomponent: Preferences). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with network...

4.7CVSS

4.5AI Score

0.001EPSS

2019-04-23 07:32 PM
19
cve
cve

CVE-2019-2675

Vulnerability in the Oracle CRM Technical Foundation component of Oracle E-Business Suite (subcomponent: Preferences). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with network...

8.2CVSS

8.1AI Score

0.002EPSS

2019-04-23 07:32 PM
20
cve
cve

CVE-2019-2639

Vulnerability in the Oracle CRM Technical Foundation component of Oracle E-Business Suite (subcomponent: Preferences). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with network...

8.2CVSS

8.1AI Score

0.002EPSS

2019-04-23 07:32 PM
21
cve
cve

CVE-2019-2570

Vulnerability in the Siebel Core - Server BizLogic Script component of Oracle Siebel CRM (subcomponent: Integration - Scripting). The supported version that is affected is 19.3. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Siebel Core.....

4.7CVSS

4.4AI Score

0.001EPSS

2019-04-23 07:32 PM
18
cve
cve

CVE-2018-3314

Vulnerability in the MICROS Relate CRM Software component of Oracle Retail Applications (subcomponent: Customer). The supported version that is affected is 11.4. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise MICROS Relate CRM Software.....

8.2CVSS

8AI Score

0.001EPSS

2019-04-23 07:32 PM
19
cve
cve

CVE-2019-2497

Vulnerability in the Oracle CRM Technical Foundation component of Oracle E-Business Suite (subcomponent: Messages). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with network...

8.2CVSS

8.2AI Score

0.001EPSS

2019-01-16 07:30 PM
19
cve
cve

CVE-2019-2496

Vulnerability in the Oracle CRM Technical Foundation component of Oracle E-Business Suite (subcomponent: Messages). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, 12.2.7 and 12.2.8. Easily exploitable vulnerability allows unauthenticated attacker with network...

4.7CVSS

4.7AI Score

0.001EPSS

2019-01-16 07:30 PM
22
Total number of security vulnerabilities428