EUVD-2017-6514

Malware in sbrugna...

EUVD-2019-5657

Malware in sbrugna...

EUVD-2017-7761

Malware in sbrugna...

Default credentials

Zurmo 3.2.7-2 has XSS via the app/index.php/zurmo/default PATHINFO...

CVE-2019-14472: Improper Neutralization of Input During Web Page Generation

Zurmo 3.2.7-2 has XSS via the app/index.php/zurmo/default PATHINFO...

PT-2019-13716

Name of the Vulnerable Software and Affected Versions Zurmo version 3.2.7-2 Description The issue is related to a security problem where an attacker can inject malicious code. The problem occurs via the "app/index.php/zurmo/default" API endpoint, specifically through the PATH INFO. Recommendation...

PT-2018-14977

Name of the Vulnerable Software and Affected Versions Zurmo version 3.2.4 Description The issue allows for XSS via an admin's use of the name parameter in the reports section. This can be exploited through the /app/index.php/reports/default/details?id=1 API endpoint. Recommendations For Zurmo...

CVE-2018-16654: Improper Neutralization of Input During Web Page Generation

Zurmo 3.2.4 Stable allows XSS via app/index.php/accounts/default/details?id=2&kanbanBoard=1&openToTaskId=1...

PT-2018-13675

Name of the Vulnerable Software and Affected Versions Zurmo version 3.2.4 Description The issue allows for XSS via the 'app/index.php/accounts/default/details' endpoint with specific parameters, including id, kanbanBoard, and openToTaskId. Recommendations For Zurmo version 3.2.4, update to a...

CVE-2017-16569: URL Redirection to Untrusted Site

An Open URL Redirect issue exists in Zurmo 3.2.1.57987acc3018 via an http: URL in the redirectUrl parameter to app/index.php/meetings/default/createMeeting...

CVE-2017-15039: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS exists in Zurmo 3.2.1.57987acc3018 via a data: URL in the redirectUrl parameter to app/index.php/meetings/default/createMeeting...

PT-2017-14453

Name of the Vulnerable Software and Affected Versions Zurmo version 3.2.1.57987acc3018 Description A redirect issue exists via an http: URL in the redirectUrl parameter to "app/index.php/meetings/default/createMeeting" endpoint. Recommendations For version 3.2.1.57987acc3018, avoid using the...