PT-2018-14977

Name of the Vulnerable Software and Affected Versions Zurmo version 3.2.4 Description The issue allows for XSS via an admin's use of the name parameter in the reports section. This can be exploited through the /app/index.php/reports/default/details?id=1 API endpoint. Recommendations For Zurmo...

PT-2018-15016

Name of the Vulnerable Software and Affected Versions Zurmo version 3.2.4 Description The issue allows HTML Injection via an admin's use of HTML in the report section. Recommendations For Zurmo version 3.2.4, consider restricting the use of HTML in the report section to minimize the risk of...

CVE-2018-16654

Zurmo 3.2.4 Stable allows XSS via app/index.php/accounts/default/details?id=2&kanbanBoard=1&openToTaskId=1...

Design/Logic Flaw

Zurmo 3.2.4 Stable allows XSS via app/index.php/accounts/default/details?id=2&kanbanBoard=1&openToTaskId=1...

CVE-2018-16654

Zurmo 3.2.4 Stable allows XSS via app/index.php/accounts/default/details?id=2&kanbanBoard=1&openToTaskId=1...

CVE-2018-16654

Zurmo 3.2.4 Stable allows XSS via app/index.php/accounts/default/details?id=2&kanbanBoard=1&openToTaskId=1...

CVE-2018-16654

Zurmo 3.2.4 Stable is affected by a cross-site scripting (XSS) vulnerability in the endpoint app/index.php/accounts/default/details?id=2&kanbanBoard=1&openToTaskId=1. The issue allows injection of scripts via crafted URL parameters, escalating potential to modify or exfiltrate data (per CVSS metr...

CVE-2018-16654: Improper Neutralization of Input During Web Page Generation

Zurmo 3.2.4 Stable allows XSS via app/index.php/accounts/default/details?id=2&kanbanBoard=1&openToTaskId=1...

Zurmo cross-site scripting vulnerability (CNVD-2019-07202)

Zurmo is the United States Zurmo company's set of open source PHP-based customer relationship management system CRM. A cross-site scripting vulnerability exists in Zurmo version 3.2.4 Stable. A remote attacker can exploit this vulnerability to execute injected malicious script with the help of th...

PT-2018-13675

Name of the Vulnerable Software and Affected Versions Zurmo version 3.2.4 Description The issue allows for XSS via the 'app/index.php/accounts/default/details' endpoint with specific parameters, including id, kanbanBoard, and openToTaskId. Recommendations For Zurmo version 3.2.4, update to a...

Zurmo cross-site scripting vulnerability (CNVD-2018-02168)

Zurmo is the United States Zurmo company's set of open source PHP-based customer relationship management system CRM. A cross-site scripting vulnerability exists in Zurmo version 3.2.3. A remote attacker can exploit this vulnerability by sending the 'latitude' or 'longitude' parameter to...

CVE-2017-18004

Zurmo 3.2.3 allows XSS via the latitude or longitude parameter to maps/default/mapAndPoint...

Design/Logic Flaw

Zurmo 3.2.3 allows XSS via the latitude or longitude parameter to maps/default/mapAndPoint...

CVE-2017-18004

Zurmo 3.2.3 allows XSS via the latitude or longitude parameter to maps/default/mapAndPoint...

CVE-2017-18004

Zurmo 3.2.3 allows XSS via the latitude or longitude parameter to maps/default/mapAndPoint...

CVE-2017-18004

Zurmo 3.2.3 is affected by an XSS vulnerability triggered by the latitude or longitude parameter to maps/default/mapAndPoint in the Zurmo web application (PHP-based CRM). The issue is reported across multiple sources (e.g., CVE-2017-18004, CNVD-2018-02168, RH Red Hat, NVD) with consistent descrip...

PT-2017-15153

Name of the Vulnerable Software and Affected Versions Zurmo version 3.2.3 Description The issue allows for XSS attacks via the latitude or longitude parameter to the "maps/default/mapAndPoint" endpoint. Recommendations For Zurmo version 3.2.3, avoid using the latitude or longitude parameters in t...

CVE-2017-18004: Improper Neutralization of Input During Web Page Generation

Zurmo 3.2.3 allows XSS via the latitude or longitude parameter to maps/default/mapAndPoint...

Zurmo URL Redirection Vulnerability

Zurmo is the United States Zurmo company's set of open source PHP-based customer relationship management system CRM. An open redirect vulnerability exists in Zurmo version 3.2.1.57987acc3018. An attacker can exploit this vulnerability by sending the 'redirectUrl' parameter with an http: URL to...

Zurmo Cross-Site Scripting Vulnerability

Zurmo is the United States Zurmo company's set of open source PHP-based customer relationship management system CRM. A cross-site scripting vulnerability exists in Zurmo version 3.2.1.57987acc3018. A remote attacker can exploit this vulnerability by sending a 'redirectUrl' parameter with a data:...