vtiger -- multiple remote file inclusion vulnerabilities

Dedi Dwianto a.k.a theday reports: Input passed to the "$calpath" parameter in update.php is not properly verified before being used. This can be exploited to execute arbitrary PHP code by including files from local or external resources...

vtiger CRM 5 Beta Remote File Include Vulnerability

!!!!!!!!!WWW.SiBERSAVASCiLAR.COM!!!!!!!!! -------------------------------------------------------------------------------- Title : vtiger CRM 5 Beta Remote File Include Vulnerability -------------------------------------------------------------------------------- Author: CrackersChild cont@ct:...

CVE-2006-4617

Unrestricted file upload vulnerability in fileupload.html in vtiger CRM 4.2.4, and possibly earlier versions, allows remote attackers to upload and execute arbitrary files with executable extensions in the /cashe/mails folder...

CVE-2006-4617

Unrestricted file upload vulnerability in fileupload.html in vtiger CRM 4.2.4, and possibly earlier versions, allows remote attackers to upload and execute arbitrary files with executable extensions in the /cashe/mails folder...

CVE-2006-4617

The CVE-2006-4617 entry documents an unrestricted file upload vulnerability in vtiger CRM 4.2.4 (and possibly earlier). The flaw is triggered via fileupload.html, permitting remote attackers to upload and execute arbitrary files with executable extensions in the /cashe/mails directory. The associ...

CVE-2006-4617: Undefined Security Weakness

Unrestricted file upload vulnerability in fileupload.html in vtiger CRM 4.2.4, and possibly earlier versions, allows remote attackers to upload and execute arbitrary files with executable extensions in the /cashe/mails folder...

CVE-2006-4587

Multiple cross-site scripting XSS vulnerabilities in vtiger CRM 4.2.4, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the 1 description parameter in unspecified modules or the 2 solution parameter in the HelpDesk module...

CVE-2006-4588

vtiger CRM 4.2.4, and possibly earlier, allows remote attackers to bypass authentication and access administrative modules via a direct request to index.php with a modified module parameter, as demonstrated using the Settings module...

CVE-2006-4587

Multiple cross-site scripting XSS vulnerabilities in vtiger CRM 4.2.4, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the 1 description parameter in unspecified modules or the 2 solution parameter in the HelpDesk module...

CVE-2006-4588

vtiger CRM 4.2.4, and possibly earlier, allows remote attackers to bypass authentication and access administrative modules via a direct request to index.php with a modified module parameter, as demonstrated using the Settings module...

CVE-2006-4587

The CVE-2006-4587 entry documents multiple XSS flaws in vtiger CRM 4.2.4 (and possibly earlier) that allow remote attackers to inject arbitrary scripts via the (1) description parameter in unspecified modules or the (2) solution parameter in the HelpDesk module. The NVD data lists a CVSS v2 base ...

CVE-2006-4588

vtiger CRM 4.2.4 (and possibly earlier) contains an authentication-bypass vulnerability that lets remote attackers access administrative modules by issuing a direct request to index.php with a modified module parameter, demonstrated via the Settings module. Root cause: improper validation of the ...

CVE-2006-4588: Undefined Security Weakness

vtiger CRM 4.2.4, and possibly earlier, allows remote attackers to bypass authentication and access administrative modules via a direct request to index.php with a modified module parameter, as demonstrated using the Settings module...

CVE-2006-4587: Undefined Security Weakness

Multiple cross-site scripting XSS vulnerabilities in vtiger CRM 4.2.4, and possibly earlier, allow remote attackers to inject arbitrary web script or HTML via the 1 description parameter in unspecified modules or the 2 solution parameter in the HelpDesk module...

[SA21728] vtiger CRM Script Insertion and Administrative Modules Access

TITLE: vtiger CRM Script Insertion and Administrative Modules Access SECUNIA ADVISORY ID: SA21728 VERIFY ADVISORY: http://secunia.com/advisories/21728/ CRITICAL: Moderately critical IMPACT: Security Bypass, Cross Site Scripting WHERE: From remote SOFTWARE: vtiger CRM 4.x...

Vtiger < 4.5 Alpha 2 Multiple Vulnerabilities - Active Check

Vtiger is prone to arbitrary code execution, directory traversal, SQL injection SQLi allowing authentication bypass and cross-site scripting XSS vulnerabilities. SPDX-FileCopyrightText: 2005 David Maciejak Some text descriptions might be excerpted from a referenced sources, and are Copyright C by...

vTiger < 4.5a2 Multiple Vulnerabilities

The remote version of this software is prone to arbitrary code execution, directory traversal, SQL injection allowing authentication bypass, cross-site scripting attacks. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description...

Hardened-PHP Project Security Advisory 2005-23.105

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hardened PHP Project www.hardened-php.net -= Security Advisory =- Advisory: Multiple vulnerabilities in vTiger CRM Release Date: 2005/11/24 Last Modified: 2005/11/24 Author: Christopher Kunz Application: vTiger 4.2 and prior Severity: Cross-Site...

SEC-20051125-0.txt

SEC-CONSULT Security Advisory ======================================================================= title: Even More Vulnerabilities in VTiger CRM program: vtiger CRM vulnerable version: 4.2 and earlier homepage: http://www.vtiger.com found: 2005-11-06 by: D. Fabian / SEC-CONSULT /...

CVE-2005-3818

Multiple cross-site scripting XSS vulnerabilities in vTiger CRM 4.2 and earlier allow remote attackers to inject arbitrary web script or HTML via 1 various input fields, including the contact, lead, and first or last name fields, 2 the record parameter in a DetailView action in the Leads module f...