CVE-2009-3248: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the RSS module in vtiger CRM 5.0.4 allows remote attackers to hijack the authentication of Admin users for requests that modify the news feed system via the rssurl parameter in a Save action to index.php...

CVE-2009-3247: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Activities module in vtiger CRM 5.0.4 allows remote attackers to inject arbitrary web script or HTML via the action parameter to phprint.php. NOTE: the querystring vector is already covered by CVE-2008-3101.3...

CVE-2009-3257: Undefined Security Weakness

vtiger CRM before 5.1.0 allows remote authenticated users to bypass the permissions on the 1 Account Billing Address and 2 Shipping Address fields in a profile by creating a Sales Order SO associated with that profile...

Vtiger CRM 5.0.4 Code Exection / XSS / XSRF / LFI

Vtiger CRM 5.0.4 Multiple Vulnerabilities Name Multiple Vulnerabilities in Vtiger CRM Systems Affected Vtiger CRM 5.0.4 and possibly earlier versions Severity Medium Impact CVSSv2 Medium 6/10, vector: AV:N/AC:M/Au:S/C:P/I:P/A:P Vendor http://www.vtigercrm.com Advisory...

Vtiger CRM 5.0.4 (RCE/CSRF/LFI/XSS) Multiple Vulnerabilities

Exploit for unknown platform in category web applications ============================================================ Vtiger CRM 5.0.4 RCE/CSRF/LFI/XSS Multiple Vulnerabilities ============================================================ Vtiger CRM 5.0.4 Multiple Vulnerabilities Name Multiple...

Vtiger CRM 5.0.4 (RCE/CSRF/LFI/XSS) Multiple Vulnerabilities

No description provided by source. Vtiger CRM 5.0.4 Multiple Vulnerabilities Name Multiple Vulnerabilities in Vtiger CRM Systems Affected Vtiger CRM 5.0.4 and possibly earlier versions Severity Medium Impact CVSSv2 Medium 6/10, vector: AV:N/AC:M/Au:S/C:P/I:P/A:P Vendor http://www.vtigercrm.com...

vTiger CRM 5.0.4 - Remote Code Execution Cross-Site Request Forgery Local File Inclusion Cross-Site Scripting

vTiger CRM 5.0.4 - Remote Code Execution Cross-Site Request Forgery Local File Inclusion Cross-Site Scripting Vtiger CRM 5.0.4 Multiple Vulnerabilities Name Multiple Vulnerabilities in Vtiger CRM Systems Affected Vtiger CRM 5.0.4 and possibly earlier versions Severity Medium Impact CVSSv2 Medium...

Vtiger CRM 5.0.4 Multiple Vulnerabilities

Vtiger CRM 5.0.4 Multiple Vulnerabilities Name Multiple Vulnerabilities in Vtiger CRM Systems Affected Vtiger CRM 5.0.4 and possibly earlier versions Severity Medium Impact CVSSv2 Medium 6/10, vector: AV:N/AC:M/Au:S/C:P/I:P/A:P Vendor http://www.vtigercrm.com Advisory...

vTiger CRM 5.0.4 - Remote Code Execution / Cross-Site Request Forgery / Local File Inclusion / Cross-Site Scripting

Vtiger CRM 5.0.4 Multiple Vulnerabilities Name Multiple Vulnerabilities in Vtiger CRM Systems Affected Vtiger CRM 5.0.4 and possibly earlier versions Severity Medium Impact CVSSv2 Medium 6/10, vector: AV:N/AC:M/Au:S/C:P/I:P/A:P Vendor http://www.vtigercrm.com Advisory...

vtiger CRM多个跨站脚本漏洞

BUGTRAQ ID: 30951 CVECAN ID: CVE-2008-3101 vtiger CRM是基于web的开源客户关系管理系统。 vtiger CRM实现上存在漏洞，远程攻击者可以通过向vtiger CRM的多个模块提交恶意的认证或查询请求执行跨站脚本攻击。 1 当module设置为Users且action设置为Authenticate的时候，index.php文件没有正确的验证对userpassword参数的输入便返回给了用户，可能导致在用户浏览器会话中执行任意HTML和脚本代码。 2...

FreeBSD Ports: vtiger

The remote host is missing an update to the system as announced in the referenced advisory. VID 2c8a84d9-5bee-11db-a5ae-00508d6a62df OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

FreeBSD Ports: vtiger

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in vtiger CRM 5.0.4 allow remote attackers to inject arbitrary web script or HTML via 1 the parenttab parameter in an index action to the Products module, as reachable through index.php; 2 the userpassword parameter in an Authenticate action to th...

CVE-2008-3101

Multiple cross-site scripting XSS vulnerabilities in vtiger CRM 5.0.4 allow remote attackers to inject arbitrary web script or HTML via 1 the parenttab parameter in an index action to the Products module, as reachable through index.php; 2 the userpassword parameter in an Authenticate action to th...

CVE-2008-3101

Multiple cross-site scripting XSS vulnerabilities in vtiger CRM 5.0.4 allow remote attackers to inject arbitrary web script or HTML via 1 the parenttab parameter in an index action to the Products module, as reachable through index.php; 2 the userpassword parameter in an Authenticate action to th...

CVE-2008-3101

CVE-2008-3101 affects vtiger CRM 5.0.4. The vulnerability consists of multiple XSS flaws triggered by unvalidated input in index.php across three paths: (1) Products module, index action via the parenttab parameter; (2) Users module, Authenticate action via the user_password parameter; (3) Home m...

CVE-2008-3101: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in vtiger CRM 5.0.4 allow remote attackers to inject arbitrary web script or HTML via 1 the parenttab parameter in an index action to the Products module, as reachable through index.php; 2 the userpassword parameter in an Authenticate action to th...

vTiger CRM 5.0.4 - Multiple Cross-Site Scripting Vulnerabilities

vTiger CRM 5.0.4 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/30951/info vtiger CRM is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute...

vTiger CRM 5.0.4 - Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/30951/info vtiger CRM is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the...

Improper access control

Vtiger CRM before 5.0.4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read mail merge templates via a direct request to the wordtemplatedownload directory...