CVE-2019-17300

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Administration module by a Developer user...

CVE-2019-17300

SugarCRM is affected by a PHP code injection vulnerability (CVE-2019-17300) in the Administration module. Affected versions are SugarCRM before 8.0.4 and 9.x before 9.0.2. The root cause described across connected sources is insufficient input validation, enabling a Developer user to inject and e...

CVE-2019-17315

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Administration module by an Admin user...

PT-2019-15078 · Sugarcrm · Sugarcrm

Name of the Vulnerable Software and Affected Versions: SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description: The issue allows PHP object injection in the Administration module by an Admin user. Recommendations: For SugarCRM versions prior to 8.0.4, update to version...

PT-2019-15063

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description The issue allows PHP code injection in the Administration module by a Developer user. Recommendations For SugarCRM versions prior to 8.0.4, update to version 8.0...

PT-2019-15061

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description The issue allows SQL injection in the Administration module by a Developer user. Recommendations For SugarCRM versions prior to 8.0.4, update to version 8.0.4 or...

CVE-2019-17298: Improper Neutralization of Special Elements used in an SQL Command

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Administration module by a Developer user...

CVE-2019-17299: Improper Control of Generation of Code

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Administration module by an Admin user...

CVE-2019-17300: Improper Control of Generation of Code

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Administration module by a Developer user...

CVE-2019-17315: Improperly Controlled Modification of Object Prototype Attributes

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Administration module by an Admin user...

PT-2019-15062

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description The issue allows PHP code injection in the Administration module by an Admin user. Recommendations For SugarCRM versions prior to 8.0.4, update to version 8.0.4 ...

The Ukraine Whistle-Blower Did Everything Right

The Trump administration's attacks on the whistle-blower aren't just baseless—they could have a corrosive long-term effect...

[SECURITY] Fedora 30 Update: glpi-9.4.4-1.fc30

GLPI is the Information Resource-Manager with an additional Administration- Interface. You can use it to build up a database with an inventory for your company computer, software, printers.... It has enhanced functions to make the daily life for the administrators easier, like a job-tracking-syst...

[SECURITY] Fedora 31 Update: glpi-9.4.4-1.fc31

GLPI is the Information Resource-Manager with an additional Administration- Interface. You can use it to build up a database with an inventory for your company computer, software, printers.... It has enhanced functions to make the daily life for the administrators easier, like a job-tracking-syst...

[SECURITY] Fedora 29 Update: phpMyAdmin-4.9.1-1.fc29

phpMyAdmin is a tool written in PHP intended to handle the administration of MySQL over the World Wide Web. Most frequently used operations are supported by the user interface managing databases, tables, fields, relations, index es, users, permissions, while you still have the ability to directly...

CVE-2019-4115

IBM WebSphere eXtreme Scale 8.6 Admin API is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 158113...

CVE-2019-16993

In phpBB before 3.1.7-PL1, includes/acp/acpbbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting...

Cross site request forgery (csrf)

In phpBB before 3.1.7-PL1, includes/acp/acpbbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting...

CVE-2019-16993

In phpBB before 3.1.7-PL1, includes/acp/acpbbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting...

CVE-2019-16993

In phpBB before 3.1.7-PL1, includes/acp/acpbbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting...