Cross site scripting

Cross Site Scripting XSS in the contact page of Group Office CRM 6.4.196 by uploading a crafted svg file...

Server side request forgery (ssrf)

A Server-Side Request Forgery SSRF vulnerability in Group Office 6.4.196 allows a remote attacker to forge GET requests to arbitrary URLs via the url parameter to group/api/upload.php...

CVE-2021-28060

A Server-Side Request Forgery SSRF vulnerability in Group Office 6.4.196 allows a remote attacker to forge GET requests to arbitrary URLs via the url parameter to group/api/upload.php...

CVE-2021-28060

The supplied connected sources confirm CVE-2021-28060 is a Server-Side Request Forgery in Group Office 6.4.196, allowing a remote attacker to forge GET requests to arbitrary URLs using the url parameter of group/api/upload.php. Core details provided: affected software is Group Office CRM (version...

CVE-2021-28060

A Server-Side Request Forgery SSRF vulnerability in Group Office 6.4.196 allows a remote attacker to forge GET requests to arbitrary URLs via the url parameter to group/api/upload.php...

CVE-2020-35418

The CVE-2020-35418 entry concerns Group Office CRM 6.4.196, where an XSS vulnerability exists on the Contacts/ contact page triggered by uploading a crafted SVG file. This is a server-side handling issue that allows injected script via SVG uploads, potentially impacting user sessions and data exp...

CVE-2020-35418

Cross Site Scripting XSS in the contact page of Group Office CRM 6.4.196 by uploading a crafted svg file...

CVE-2020-35419

Cross Site Scripting XSS in Group Office CRM 6.4.196 via the SETLANGUAGE parameter...

CVE-2020-35419

Group Office CRM 6.4.196 is affected by a Cross Site Scripting (XSS) vulnerability exploitable via the SET_LANGUAGE parameter. The issue is documented across multiple sources (NVD, Red Hat, CNVD, OSV, etc.) with the same vector, indicating the vulnerability resides in the handling of the SET_LANG...

Group Office CRM 代码问题漏洞

Group Office CRM is an enterprise CRM and component tool with email client, shared projects, calendar, documents and more. A server-side request forgery vulnerability exists in Group Office CRM version 6.4.196, which can be exploited by a remote attacker to forge a GET request to any URL via the...

Group Office CRM 跨站脚本漏洞

Group Office CRM is a software application. Share projects, calendars, files and emails with colleagues and clients online. Easy to use and fully customizable. A cross-site scripting vulnerability exists in the Contacts page in Group Office CRM version 6.4.196. An attacker can exploit this...

Group Office CRM 跨站脚本漏洞

Group Office CRM is a software application. Share projects, calendars, files and emails with colleagues and clients online. Easy to use and fully customizable. A cross-site scripting vulnerability exists in Group Office CRM version 6.4.196. An attacker can exploit this vulnerability via the...

CVE-2012-4240

SQL injection vulnerability in modules/calendar/json.php in Group-Office community before 4.0.90 allows remote authenticated users to execute arbitrary SQL commands via the sort parameter...

Sql injection

SQL injection vulnerability in modules/calendar/json.php in Group-Office community before 4.0.90 allows remote authenticated users to execute arbitrary SQL commands via the sort parameter...

CVE-2012-4240

SQL injection vulnerability in modules/calendar/json.php in Group-Office community before 4.0.90 allows remote authenticated users to execute arbitrary SQL commands via the sort parameter...

CVE-2012-4240

Group-Office Calendar SQL Injection (CVE-2012-4240) affects Group-Office community versions prior to 4.0.90. The vulnerability lies in modules/calendar/json.php where the sort parameter is unsafely injected into an ORDER BY SQL clause. An authenticated user can exploit this to cause database erro...

Group Office (comment_id) SQL Injection Vulnerability

No description provided by source. Title Group Office Remote SQL Injection Vulnerability Author ADEO Security Published 17/07/2010 Version 3.5.9 Possible all versions Vendor http://www.group-office.com Download...

Group Office 3.5.9 - SQL Injection Vulnerability

No description provided by source. ===================================================================================== Group Office /notes/json.php?task=category&categoryid SQL Injection Vulnerability ===================================================================================== Author :...

Group Office Remote Command Execution Vulnerability

No description provided by source. Title Group Office Remote Command Execution Vulnerability Author ADEO Security Published 16/07/2010 Version 3.5.9 Possible all versions Vendor http://www.group-office.com Download...

Group Office Calendar (calendar/json.php) SQL Injection

No description provided by source. /-------------------------------------\ | Group-Office Calendar SQL Injection | -------------------------------------/ Summary ======= Versions of Group-Office a web app for online collaboration prior to 4.0.90 are subject to a SQL injection vulnerability locate...