vTiger CRM 5.4.0 kcfinder LFI

Local file include vulnerability in vtiger CRM kcfinder component Vulnerability Type: Local File Include For the exploit source code contact DSquare Security sales team...

vTiger CRM 5.4.0 kcfinder File Upload

File upload vulnerability in vtiger CRM kcfinder component Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

Vtiger CRM文件包含漏洞

CVE ID：CVE-2014-1222 vtiger CRM是一套基于Web以销售能力自动化SFA为主的客户关系管理系统CRM 。 本地文件包含漏洞被发现在vtigerCRM 6.0 RC的'kcfinder'组件。攻击者可以利用漏洞通过目录遍历序列包含任意文件，并泄漏任意文件内容。 0 Vtiger CRM 5.4.0 Vtiger CRM 6.0 RC Vtiger CRM 6.0.0 GA 厂商补丁： vtiger CRM ----- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.vtiger.com/ POST...

vTiger CRM 5.4.06.0 RC6.0.0 GA - browse.php Local File Inclusion

vTiger CRM 5.4.06.0 RC6.0.0 GA - browse.php Local File Inclusion CVE: CVE-2014-1222 Vendor: Vtiger Product: CRM Affected version: Vtiger 5.4.0, 6.0 RC & 6.0.0 GA Fixed version: Vtiger 6.0.0 Security patch 1 Reported by: Jerzy Kramarz Details: A local file inclusion vulnerability was discovered in...

Vtiger CRM 5.4.0, 6.0 RC, 6.0.0 GA - Local File Inclusion Vulnerability

Vtiger CRM versions 5.4.0, 6.0 RC, and 6.0.0 GA suffer from a local file inclusion vulnerability. CVE: CVE-2014-1222 Vendor: Vtiger Product: CRM Affected version: Vtiger 5.4.0, 6.0 RC & 6.0.0 GA Fixed version: Vtiger 6.0.0 Security patch 1 Reported by: Jerzy Kramarz Details: A local file inclusio...

vTiger CRM 5.4.0/6.0 RC/6.0.0 GA - 'browse.php' Local File Inclusion

CVE: CVE-2014-1222 Vendor: Vtiger Product: CRM Affected version: Vtiger 5.4.0, 6.0 RC & 6.0.0 GA Fixed version: Vtiger 6.0.0 Security patch 1 Reported by: Jerzy Kramarz Details: A local file inclusion vulnerability was discovered in the ‘kcfinder’ component of the vtiger CRM 6.0 RC. This could be...

Vtiger CRM 5.4.0 / 6.0 RC / 6.0.0 GA Local File Inclusion

Vulnerability title: Local File Inclusion in Vtiger CRM CVE: CVE-2014-1222 Vendor: Vtiger Product: CRM Affected version: Vtiger CRM 5.4.0, 6.0 RC & 6.0.0 GA Fixed version: Vtiger CRM 6.0.0 Security patch 1 Reported by: Jerzy Kramarz Details: A local file inclusion vulnerability was discovered in...

vtiger CRM 5.4.0 get_tickets_list SQLi

SQL Injection vulnerability in vtiger CRM getticketslist SOAP method in /soap/customerportal.php Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

vtiger CRM 5.4.0 get_picklists SQLi

SQL Injection vulnerability in vtiger CRM getpicklists SOAP method in /soap/customerportal.php Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

vtiger CRM 5.4.0 File Upload

File upload vulnerability in vtiger CRM SOAP AddEmailAttachment service Vulnerability Type: File Upload For the exploit source code contact DSquare Security sales team...

Vtiger Install Unauthenticated Remote Command Execution

This module exploits an arbitrary command execution vulnerability in the Vtiger install script. This module is set to ManualRanking due to this module overwriting the target database configuration, which may result in a broken web app, and you may not be able to get a session again. Module Option...

vTiger CRM SOAP AddEmailAttachment Arbitrary File Upload (CVE-2013-3215)

A remote code execution vulnerability has been reported in VTiger CRM.The vulnerability is due to lack of validation of file types uploaded to the server throught the AddEmailAttachment SOAP service. A remote attacker can exploit this vulnerability to access the script remotely and have it run th...

CVE-2013-7326

Cross-site scripting XSS vulnerability in vTiger CRM 5.4.0 allows remote attackers to inject arbitrary web script or HTML via the 1 returnurl parameter to modules\comvtigerworkflow\savetemplate.php, or unspecified vectors to 2 deletetask.php, 3 edittask.php, 4 savetask.php, or 5 saveworkflow.php...

Cross site scripting

Cross-site scripting XSS vulnerability in vTiger CRM 5.4.0 allows remote attackers to inject arbitrary web script or HTML via the 1 returnurl parameter to modules\comvtigerworkflow\savetemplate.php, or unspecified vectors to 2 deletetask.php, 3 edittask.php, 4 savetask.php, or 5 saveworkflow.php...

CVE-2013-7326

Cross-site scripting XSS vulnerability in vTiger CRM 5.4.0 allows remote attackers to inject arbitrary web script or HTML via the 1 returnurl parameter to modules\comvtigerworkflow\savetemplate.php, or unspecified vectors to 2 deletetask.php, 3 edittask.php, 4 savetask.php, or 5 saveworkflow.php...

CVE-2013-7326

Vtiger CRM 5.4.0 is affected by multiple cross-site scripting (XSS) flaws. The issue arises from unsanitized input in the return_url parameter to modules/vtiger_workflow/savetemplate.php and in endpoints deletetask.php, edittask.php, savetask.php, and saveworkflow.php, allowing injection of arbit...

PT-2014-3366 · Vtiger · Vtiger Crm

Name of the Vulnerable Software and Affected Versions: vTiger CRM version 5.4.0 Description: A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the return url parameter to the "modulescom vtiger workflowsavetemplate.php"...

Vtiger CRM 5.0.0 - 5.4.0 PHP Code Injection Vulnerability

Vtiger CRM is prone to a PHP code injection vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:vtiger:vtigercrm";...

Vtiger CRM 5.1.0 - 5.4.0 Authentication Bypass Vulnerability - Active Check

Vtiger CRM is prone to an authentication bypass vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:vtiger:vtigercrm";...

vTiger CRM AddEmailAttachment arbitrary file upload

Added: 01/10/2014 CVE: CVE-2013-3214 BID: 61558 OSVDB: 95902 Background vTiger CRM is a customer relationship management application written in PHP. Problem An arbitrary file upload vulnerability when handling SOAP AddEmailAttachment requests allows remote attackers to execute arbitrary commands ...