CVE-2020-14208

SuiteCRM 7.11.13 is affected by a stored Cross-Site Scripting (XSS) vulnerability in the Documents preview feature. The issue allows remote authenticated attackers to inject arbitrary web script or HTML via the Documents preview workflow. Root cause described across sources is stored XSS in the D...

CVE-2020-15300

SuiteCRM through 7.11.13 has an Open Redirect in the Documents module via a crafted SVG document...

CVE-2020-15300

CVE-2020-15300 affects SuiteCRM up to version 7.11.13, with an Open Redirect in the Documents module triggered by a crafted SVG document. The underlying issue is an input/redirect handling weakness in the Documents feature, enabling a user-assisted redirect to an arbitrary URL. Impact is describe...

PT-2020-14341 · Salesagility · Suitecrm

Name of the Vulnerable Software and Affected Versions: SuiteCRM versions prior to 7.11.14 Description: The issue is related to an Open Redirect in the Documents module of SuiteCRM, which can be exploited via a crafted SVG document. Recommendations: For versions prior to 7.11.14, update to version...

CVE-2020-15300: URL Redirection to Untrusted Site

SuiteCRM through 7.11.13 has an Open Redirect in the Documents module via a crafted SVG document...

CVE-2020-14208: Improper Neutralization of Input During Web Page Generation

SuiteCRM 7.11.13 is affected by stored Cross-Site Scripting XSS in the Documents preview functionality. This vulnerability could allow remote authenticated attackers to inject arbitrary web script or HTML...

SuiteCRM 输入验证错误漏洞

SuiteCRM is a free open source customer relationship management application. An open redirection vulnerability exists in the Documents module in SuiteCRM 7.11.13 and earlier versions. An attacker can exploit this vulnerability to redirect users to arbitrary URLs via specially crafted SVG document...

PT-2020-13934 · Salesagility · Suitecrm

Name of the Vulnerable Software and Affected Versions: SuiteCRM version 7.11.13 Description: The issue is related to stored Cross-Site Scripting XSS in the Documents preview functionality. This could allow remote authenticated attackers to inject arbitrary web script or HTML. Recommendations: For...

Design/Logic Flaw

A vulnerability in Apache OpenOffice scripting events allows an attacker to construct documents containing hyperlinks pointing to an executable on the target users file system. These hyperlinks can be triggered unconditionally. In fixed versions no internal protocol may be called from the documen...

PT-2020-20934

Name of the Vulnerable Software and Affected Versions macOS versions prior to 11.0.1 Description The issue allows a local application to potentially enumerate the user's iCloud documents due to inadequate permissions logic. Recommendations For versions prior to 11.0.1, update to macOS Big Sur...

Oracle Linux 8 : libreoffice (ELSA-2020-4628)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4628 advisory. libcmis 0.5.2-1 - Related: rhbz1796893 update to 0.5.2 liborcus 0.14.1-1 - Related: rhbz1796893 update to 0.14.1 libreoffice 6.3.6.2-3.0.1 - Replace...

AudimexEE SQL Injection Vulnerability

AudimexEE is a system for audit management from Audimex AG, Germany. The system meets complex audit processes around the company's business, supports customization for use and is deployed platform-independently. A SQL injection vulnerability exists in the Documents component of AudimexEE versions...

North Korean Hackers Used 'Torisma' Spyware in Job Offers-based Attacks

A cyberespionage campaign aimed at aerospace and defense sectors in order to install data gathering implants on victims' machines for purposes of surveillance and data exfiltration may have been more sophisticated than previously thought. The attacks, which targeted IP-addresses belonging to...

CVE-2020-28115

SQL Injection vulnerability in "Documents component" found in AudimexEE version 14.1.0 allows an attacker to execute arbitrary SQL commands via the objectpath parameter...

CVE-2020-28115

SQL Injection vulnerability in "Documents component" found in AudimexEE version 14.1.0 allows an attacker to execute arbitrary SQL commands via the objectpath parameter...

Sql injection

SQL Injection vulnerability in "Documents component" found in AudimexEE version 14.1.0 allows an attacker to execute arbitrary SQL commands via the objectpath parameter...

CVE-2020-28115

SQL Injection vulnerability in "Documents component" found in AudimexEE version 14.1.0 allows an attacker to execute arbitrary SQL commands via the objectpath parameter...

CVE-2020-28115

AudimexEE’s CVE-2020-28115 is a SQL injection in the Documents component of version 14.1.0, exploitable via the object_path parameter. Multiple connected sources corroborate: CNVD-2020-65171 states the vulnerability exists in AudimexEE versions prior to 14.1.1, implying a fixed version is 14.1.1....

Kaixin Electronic Document Inventory in Arbitrary File Download Vulnerability

Qixing electronic document library can be used to store departmental manuals, system specifications, mechanical drawings and other edoc. The Qixing Electronic Document Library is vulnerable to an arbitrary file download vulnerability, which can be exploited by an attacker to download any file on...

Kaixin Electronic Document Inventory in File Upload Vulnerability

Qixing electronic document library can be used to store departmental manuals, system specifications, mechanical drawings and other edoc. The Qixing Electronic Document Library suffers from a file upload vulnerability, which can be exploited by an attacker to upload a malicious file and take contr...