CVE-2016-1713

CVE-2016-1713 concerns Vtiger CRM 6.4.0 where an unrestricted file upload in Settings_Vtiger_CompanyDetailsSave_Action (modules/Settings/Vtiger/actions/CompanyDetailsSave.php) lets a remote authenticated user upload a crafted image with an executable extension and access it via test/logo/ to exec...

CVE-2016-1713: Unrestricted Upload of File with Dangerous Type

Unrestricted file upload vulnerability in the SettingsVtigerCompanyDetailsSaveAction class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtiger CRM 6.4.0 allows remote authenticated users to execute arbitrary code by uploading a crafted image file with an executable extension, then...

PT-2017-2023

Name of the Vulnerable Software and Affected Versions Vtiger CRM version 6.4.0 Description The issue is related to an unrestricted file upload vulnerability in the Settings Vtiger CompanyDetailsSave Action class. This allows remote authenticated users to execute arbitrary code by uploading a...

Guest Post: Vtiger 6.5.0 - SQL Injection

RIPS Analysis RIPS analyzed the 27,371 files with around 650,000 lines of code in only 6 minutes. Due to the nature of a CRM system, it is necessary to have a valid user account to access any of the provided features. Nevertheless, the discovered issues allowed low-privileged users to access high...

Vtiger CRM < 6.5.0 Multiple Vulnerabilities

Vtiger CRM is prone to a privilege escalation and unrestricted file upload vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2016-4834

modules/Users/actions/Save.php in Vtiger CRM 6.4.0 and earlier does not properly restrict user-save actions, which allows remote authenticated users to create or modify user accounts via unspecified vectors...

CVE-2016-4834

modules/Users/actions/Save.php in Vtiger CRM 6.4.0 and earlier does not properly restrict user-save actions, which allows remote authenticated users to create or modify user accounts via unspecified vectors...

Code injection

modules/Users/actions/Save.php in Vtiger CRM 6.4.0 and earlier does not properly restrict user-save actions, which allows remote authenticated users to create or modify user accounts via unspecified vectors...

CVE-2016-4834

modules/Users/actions/Save.php in Vtiger CRM 6.4.0 and earlier does not properly restrict user-save actions, which allows remote authenticated users to create or modify user accounts via unspecified vectors...

CVE-2016-4834

VTiger CRM (version 6.4.0 and earlier) is affected by CVE-2016-4834 due to insufficient access control in modules/Users/actions/Save.php, allowing remote authenticated users to create or modify user accounts. The OpenVAS entry corroborates privilege escalation and unrestricted file upload vectors...

CVE-2016-4834: Undefined Security Weakness

modules/Users/actions/Save.php in Vtiger CRM 6.4.0 and earlier does not properly restrict user-save actions, which allows remote authenticated users to create or modify user accounts via unspecified vectors...

PT-2016-6174

Name of the Vulnerable Software and Affected Versions Vtiger CRM versions 6.4.0 and earlier Description The issue concerns the modules/Users/actions/Save.php file in Vtiger CRM, which does not properly restrict user-save actions. This allows remote authenticated users to create or modify user...

Vtiger CRM Incorrectly Restricts Access Vulnerability

vtiger CRM is a Web-based sales force automation SFA based customer relationship management system CRM. Vtiger CRM has a security vulnerability. The vulnerability allows an attacker to exploit the vulnerability by failing to restrict access to user information data...

Vtiger CRM < 6.5.0 Access Control Vulnerability

Vtiger CRM is prone to an access control vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:vtiger:vtigercrm"; if...

Vtiger CRM does not properly restrict access to application data

Overview Vtiger CRM is a customer relationship management CRM software. Vtiger CRM contains a vulnerability where it does not properly restrict access to user information data. Hirota Kazuki of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with th...

JVN#01956993: Vtiger CRM does not properly restrict access to application data

Vtiger CRM is a customer relationship management CRM software. Vtiger CRM contains a vulnerability where it does not properly restrict access to user information data. Impact A user with user privileges may create new users or alter existing user information. Solution Update the software Update t...

YetiForce CRM Cross Site Scripting

Exploit Title: YetiForce CRM Accounts' select your prefered user, and then in the 'Comments' section input; Either refresh the current page, or navigate back to 'Accounts'...

YetiForce CRM 3.1 - Persistent Cross-Site Scripting

YetiForce CRM 3.1 - Persistent Cross-Site Scripting Exploit Title: YetiForce CRM Accounts' select your prefered user, and then in the 'Comments' section input; Either refresh the current page, or navigate back to 'Accounts'...

YetiForce CRM < 3.1 - Persistent Cross-Site Scripting

Exploit for php platform in category web applications Exploit Title: YetiForce CRM Accounts' select your prefered user, and then in the 'Comments' section input; Either refresh the current page, or navigate back to 'Accounts' 0day.today 2018-03-28...

YetiForce CRM < 3.1 - Persistent Cross-Site Scripting

Exploit Title: YetiForce CRM Accounts' select your prefered user, and then in the 'Comments' section input; Either refresh the current page, or navigate back to 'Accounts'...