648 matches found
CVE-2007-3602
The SOAP webservice in vtiger CRM before 5.0.3 does not ensure that authenticated accounts are active, which allows remote authenticated users with inactive accounts to access and modify data, as demonstrated by the Thunderbird plugin...
CVE-2007-3601
Vulnerability CVE-2007-3601 affects vtiger CRM prior to 5.0.3. When a migrated build is used, remote authenticated users can read certain other users’ calendar activities via the home page or the event list view. The connected documents provide the affected product and the exposure method, but do...
CVE-2007-3617
The CVE-2007-3617 issue affects vtiger CRM prior to 5.0.3, where the report module fails to enforce security rules. This allows remote authenticated users to read arbitrary private module entries via the report functionality. Affected component: vtiger CRM report module; root cause: improper appl...
CVE-2007-3616
CVE-2007-3616 affects vtiger CRM prior to 5.0.3. The vulnerability in the Users module profilePrivileges action allows remote authenticated users to perform administrative changes to arbitrary profile settings. No additional exploit details or remediation are provided in the connected documents; ...
CVE-2007-3604
CVE-2007-3604 affects vtiger CRM prior to 5.0.3. The issue allows remote authenticated users with access to the Analytics Dashboard to bypass data restrictions and read the pipeline of the entire organization, potentially involving modules/Potentials/Potentials.php. The available documents do not...
CVE-2007-3603
CVE-2007-3603 affects vtiger CRM prior to 5.0.3. A SQL injection vulnerability exists in the dashboard (include/utils/SearchUtils.php) allowing remote authenticated users to execute arbitrary SQL via the assigned_user_id parameter in a Potentials ListView action to index.php. This is supported by...
CVE-2007-3600
The vulnerability (CVE-2007-3600) affects vtiger CRM prior to 5.0.3, specifically the WordPlugin in the wordintegration component. An authenticated remote user can bypass field-level security permissions and merge arbitrary fields within an Email template, demonstrated by fields in the Contact mo...
CVE-2007-3598
index.php in vtiger CRM before 5.0.3 allows remote authenticated users to obtain all users' names and e-mail addresses, and possibly change user settings, via a modified record parameter in a DetailView action to the Users module. NOTE: the vendor disputes the changing of settings, reporting that...
CVE-2007-3604
vtiger CRM before 5.0.3 allows remote authenticated users with access to the Analytics DashBoard menu to bypass data restrictions and read the pipeline of the entire organization, possibly involving modules/Potentials/Potentials.php...
CVE-2007-3603
SQL injection vulnerability in the dashboard include/utils/SearchUtils.php in vtiger CRM before 5.0.3 allows remote authenticated users to execute arbitrary SQL commands via the assigneduserid parameter in a Potentials ListView action to index.php...
CVE-2007-3617
The report module in vtiger CRM before 5.0.3 does not properly apply security rules, which allows remote authenticated users to read arbitrary private module entries...
CVE-2007-3599
vtiger CRM before 5.0.3 allows remote authenticated users to import and export the information for a contact even when they only have the View permission...
CVE-2007-3601
vtiger CRM before 5.0.3, when a migrated build is used, allows remote authenticated users to read certain other users' calendar activities via a 1 home page or 2 event list view...
FreeBSD : vtiger -- multiple remote file inclusion vulnerabilities (2c8a84d9-5bee-11db-a5ae-00508d6a62df)
Dedi Dwianto a.k.a theday reports : Input passed to the '$calpath' parameter in update.php is not properly verified before being used. This can be exploited to execute arbitrary PHP code by including files from local or external resources. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...
CVE-2006-5289
Multiple PHP remote file inclusion vulnerabilities in Vtiger CRM 4.2 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the calpath parameter to 1 modules/Calendar/admin/update.php, 2 modules/Calendar/admin/scheme.php, or 3 modules/Calendar/calendar.php...
CVE-2006-5289
Multiple PHP remote file inclusion vulnerabilities in Vtiger CRM 4.2 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the calpath parameter to 1 modules/Calendar/admin/update.php, 2 modules/Calendar/admin/scheme.php, or 3 modules/Calendar/calendar.php...
CVE-2006-5289
Vulnerability summary (CVE-2006-5289): Vtiger CRM 4.2 and earlier is affected by multiple PHP remote file inclusion flaws in the Calendar module (calpath parameter) affecting update.php, scheme.php, and calendar.php. The underlying issue is unsafely handling calpath, allowing an attacker to suppl...
[ECHO_ADV_54$2006]vtiger CRM <=4.2 (calpath) Multiple Remote File Inclusion Vulnerability
ECHOADV54$2006 ----------------------------------------------------------------------------------------------- ECHOADV54$2006vtiger CRM =4.2 calpath Multiple Remote File Inclusion Vulnerability ----------------------------------------------------------------------------------------------- Author ...
vtiger CRM <= 4.2 (calpath) Multiple Remote File Include Vulnerabilities
Exploit for unknown platform in category web applications ======================================================================== vtiger CRM = 4.2 calpath Multiple Remote File Include Vulnerabilities ======================================================================== \ /\ \ / | \ \ | / \ //...
vtiger CRM <= 4.2 (calpath) Multiple Remote File Include Vulnerabilities
No description provided by source. \ /\ \ / | \ \ | / \ // / | \ | \ \ Y / | \ / / \ /| /\ / / / / / .OR.ID ECHOADV54$2006 ----------------------------------------------------------------------------------------------- ECHOADV54$2006vtiger CRM =4.2 calpath Multiple Remote File Inclusion...