CVE-2019-17315: Improperly Controlled Modification of Object Prototype Attributes

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Administration module by an Admin user...

CVE-2019-17310: Improper Control of Generation of Code

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Campaigns module by an Admin user...

PT-2019-15077

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description The issue allows directory traversal in the Configurator module by an Admin user. Recommendations For SugarCRM versions prior to 8.0.4, update to version 8.0.4 o...

CVE-2019-17317: Improperly Controlled Modification of Object Prototype Attributes

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the UpgradeWizard module by an Admin user...

PT-2019-15067

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description The issue allows PHP code injection in the MergeRecords module by an Admin user. Recommendations For SugarCRM versions prior to 8.0.4, update to version 8.0.4 or...

CVE-2019-17314: Improper Limitation of a Pathname to a Restricted Directory

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the Configurator module by an Admin user...

PT-2019-15069

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description The issue allows PHP code injection in the Configurator module by an Admin user. Recommendations For SugarCRM versions prior to 8.0.4, update to version 8.0.4 or...

CVE-2019-17304: Improper Control of Generation of Code

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by an Admin user...

CVE-2019-17309: Improper Control of Generation of Code

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the EmailMan module by an Admin user...

CVE-2019-17301: Improper Control of Generation of Code

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the ModuleBuilder module by an Admin user...

CVE-2019-17306: Improper Control of Generation of Code

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Configurator module by an Admin user...

CVE-2019-17307: Improper Control of Generation of Code

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Tracker module by an Admin user...

PT-2019-15070

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description The issue allows PHP code injection in the Tracker module by an Admin user. Recommendations For SugarCRM versions prior to 8.0.4, update to version 8.0.4 or late...

PT-2019-15055

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description The issue allows SQL injection in the pmse Inbox module by an Admin user. Recommendations For SugarCRM versions prior to 8.0.4, update to version 8.0.4 or later...

CVE-2019-17292: Improper Neutralization of Special Elements used in an SQL Command

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmseInbox module by an Admin user...

CVE-2019-8289

Vulnerability in Online Store v1.0, stored XSS in admin/userview.php adidasmemberemail variable...

PT-2019-18966

Name of the Vulnerable Software and Affected Versions Online Store version 1.0 Description The issue concerns a stored XSS in the admin/user view.php file, specifically affecting the adidas member email variable. Recommendations For Online Store version 1.0, consider restricting access to the...

CVE-2019-3747

Dell EMC Integrated Data Protection Appliance (IDPA) versions prior to 2.3 are affected by a stored cross-site scripting vulnerability in the Cloud DR add-on field. A remote attacker with ACM admin privileges can store malicious HTML/JavaScript, which is then executed by victim users’ browsers in...

Default credentials

An issue was discovered in Grafana 5.4.0. Passwords for data sources used by Grafana e.g., MySQL are not encrypted. An admin user can reveal passwords for any data source by pressing the "Save and test" button within a data source's settings menu. When watching the transaction with Burp Proxy, th...

CVE-2019-16721

NoneCMS v1.3 has CSRF in public/index.php/admin/admin/dele.html, as demonstrated by deleting the admin user...