CVE-2007-3603

CVE-2007-3603 affects vtiger CRM prior to 5.0.3. A SQL injection vulnerability exists in the dashboard (include/utils/SearchUtils.php) allowing remote authenticated users to execute arbitrary SQL via the assigned_user_id parameter in a Potentials ListView action to index.php. This is supported by...

CVE-2007-3598

The CVE-2007-3598 issue affects vtiger CRM up to version 5.0.2 (vendor states 5.0.3) where a manipulated DetailView record parameter in the Users module allows remote authenticated users to view all users’ names and e‑mail addresses and possibly alter user settings, exposing Partial confidentiali...

CVE-2007-3598

index.php in vtiger CRM before 5.0.3 allows remote authenticated users to obtain all users' names and e-mail addresses, and possibly change user settings, via a modified record parameter in a DetailView action to the Users module. NOTE: the vendor disputes the changing of settings, reporting that...

CVE-2007-3599: Undefined Security Weakness

vtiger CRM before 5.0.3 allows remote authenticated users to import and export the information for a contact even when they only have the View permission...

CVE-2007-3600: Undefined Security Weakness

WordPlugin in the wordintegration component in vtiger CRM before 5.0.3 allows remote authenticated users to bypass field level security permissions and merge arbitrary fields in an Email template, as demonstrated by the fields in the Contact module...

CVE-2007-3602: Undefined Security Weakness

The SOAP webservice in vtiger CRM before 5.0.3 does not ensure that authenticated accounts are active, which allows remote authenticated users with inactive accounts to access and modify data, as demonstrated by the Thunderbird plugin...

CVE-2007-3603: Undefined Security Weakness

SQL injection vulnerability in the dashboard include/utils/SearchUtils.php in vtiger CRM before 5.0.3 allows remote authenticated users to execute arbitrary SQL commands via the assigneduserid parameter in a Potentials ListView action to index.php...

CVE-2007-3616: Undefined Security Weakness

index.php in vtiger CRM before 5.0.3 allows remote authenticated users to perform administrative changes to arbitrary profile settings via a certain profilePrivileges action in the Users module...

CVE-2007-3617: Undefined Security Weakness

The report module in vtiger CRM before 5.0.3 does not properly apply security rules, which allows remote authenticated users to read arbitrary private module entries...

CVE-2007-3601: Undefined Security Weakness

vtiger CRM before 5.0.3, when a migrated build is used, allows remote authenticated users to read certain other users' calendar activities via a 1 home page or 2 event list view...

CVE-2007-3598: Undefined Security Weakness

index.php in vtiger CRM before 5.0.3 allows remote authenticated users to obtain all users' names and e-mail addresses, and possibly change user settings, via a modified record parameter in a DetailView action to the Users module. NOTE: the vendor disputes the changing of settings, reporting that...

CVE-2007-3604: Undefined Security Weakness

vtiger CRM before 5.0.3 allows remote authenticated users with access to the Analytics DashBoard menu to bypass data restrictions and read the pipeline of the entire organization, possibly involving modules/Potentials/Potentials.php...

CVE-2007-0018

Stack-based buffer overflow in the NCTAudioFile2.AudioFile ActiveX control NCTAudioFile2.dll, as used by multiple products, allows remote attackers to execute arbitrary code via a long argument to the SetFormatLikeSample function. NOTE: the products include 1 NCTsoft NCTAudioStudio, NCTAudioEdito...

CVE-2007-0018

CVE-2007-0018 is a stack-based buffer overflow in the NCTAudioFile2.AudioFile ActiveX control (NCTAudioFile2.dll), triggered by an overly long argument to the SetFormatLikeSample() function. The flaw is a data validation failure that allows remote code execution when a user visits a malicious web...

CVE-2007-0018

Stack-based buffer overflow in the NCTAudioFile2.AudioFile ActiveX control NCTAudioFile2.dll, as used by multiple products, allows remote attackers to execute arbitrary code via a long argument to the SetFormatLikeSample function. NOTE: the products include 1 NCTsoft NCTAudioStudio, NCTAudioEdito...

CVE-2006-6543

Multiple SQL injection vulnerabilities in login.asp in AppIntellect SpotLight CRM 1.0 allow remote attackers to execute arbitrary SQL commands via the 1 login UserName and possibly 2 password parameter. NOTE: some of these details are obtained from third party information...

CVE-2006-6543

CVE-2006-6543 affects AppIntellect SpotLight CRM 1.0, specifically the login.asp component. The vulnerability is described as multiple SQL injection flaws that allow an attacker to execute arbitrary SQL commands through the (1) login (UserName) parameter and potentially (2) the password parameter...

CVE-2006-6543

Multiple SQL injection vulnerabilities in login.asp in AppIntellect SpotLight CRM 1.0 allow remote attackers to execute arbitrary SQL commands via the 1 login UserName and possibly 2 password parameter. NOTE: some of these details are obtained from third party information...

CVE-2006-6543: Undefined Security Weakness

Multiple SQL injection vulnerabilities in login.asp in AppIntellect SpotLight CRM 1.0 allow remote attackers to execute arbitrary SQL commands via the 1 login UserName and possibly 2 password parameter. NOTE: some of these details are obtained from third party information...

SpotLight CRM 1.0 (login.asp) Remote SQL Injection Vulnerability

No description provided by source. Title : SpotLight CRM 1.0 login.asp | Remote SQL Injection Vulnerability Author : ajann Contact : : $$$ : $2,499 SQL http://target/path//login.asp=POST SQL Example: - All User UserName And Password Changed "kro" // login.asp UserName: ';update login set...