4319 matches found
CVE-2020-14208
SuiteCRM 7.11.13 is affected by stored Cross-Site Scripting XSS in the Documents preview functionality. This vulnerability could allow remote authenticated attackers to inject arbitrary web script or HTML...
CVE-2020-15300
SuiteCRM through 7.11.13 has an Open Redirect in the Documents module via a crafted SVG document...
CVE-2020-15300
SuiteCRM through 7.11.13 has an Open Redirect in the Documents module via a crafted SVG document...
Open redirect
SuiteCRM through 7.11.13 has an Open Redirect in the Documents module via a crafted SVG document...
Cross site scripting
SuiteCRM 7.11.13 is affected by stored Cross-Site Scripting XSS in the Documents preview functionality. This vulnerability could allow remote authenticated attackers to inject arbitrary web script or HTML...
CVE-2020-14208
SuiteCRM 7.11.13 is affected by a stored Cross-Site Scripting (XSS) vulnerability in the Documents preview feature. The issue allows remote authenticated attackers to inject arbitrary web script or HTML via the Documents preview workflow. Root cause described across sources is stored XSS in the D...
CVE-2020-14208
SuiteCRM 7.11.13 is affected by stored Cross-Site Scripting XSS in the Documents preview functionality. This vulnerability could allow remote authenticated attackers to inject arbitrary web script or HTML...
CVE-2020-15300
SuiteCRM through 7.11.13 has an Open Redirect in the Documents module via a crafted SVG document...
CVE-2020-15300
CVE-2020-15300 affects SuiteCRM up to version 7.11.13, with an Open Redirect in the Documents module triggered by a crafted SVG document. The underlying issue is an input/redirect handling weakness in the Documents feature, enabling a user-assisted redirect to an arbitrary URL. Impact is describe...
SuiteCRM 输入验证错误漏洞
SuiteCRM is a free open source customer relationship management application. An open redirection vulnerability exists in the Documents module in SuiteCRM 7.11.13 and earlier versions. An attacker can exploit this vulnerability to redirect users to arbitrary URLs via specially crafted SVG document...
PT-2020-13934 · Salesagility · Suitecrm
Name of the Vulnerable Software and Affected Versions: SuiteCRM version 7.11.13 Description: The issue is related to stored Cross-Site Scripting XSS in the Documents preview functionality. This could allow remote authenticated attackers to inject arbitrary web script or HTML. Recommendations: For...
PT-2020-14341 · Salesagility · Suitecrm
Name of the Vulnerable Software and Affected Versions: SuiteCRM versions prior to 7.11.14 Description: The issue is related to an Open Redirect in the Documents module of SuiteCRM, which can be exploited via a crafted SVG document. Recommendations: For versions prior to 7.11.14, update to version...
Design/Logic Flaw
A vulnerability in Apache OpenOffice scripting events allows an attacker to construct documents containing hyperlinks pointing to an executable on the target users file system. These hyperlinks can be triggered unconditionally. In fixed versions no internal protocol may be called from the documen...
Oracle Linux 8 : libreoffice (ELSA-2020-4628)
The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4628 advisory. libcmis 0.5.2-1 - Related: rhbz1796893 update to 0.5.2 liborcus 0.14.1-1 - Related: rhbz1796893 update to 0.14.1 libreoffice 6.3.6.2-3.0.1 - Replace...
AudimexEE SQL Injection Vulnerability
AudimexEE is a system for audit management from Audimex AG, Germany. The system meets complex audit processes around the company's business, supports customization for use and is deployed platform-independently. A SQL injection vulnerability exists in the Documents component of AudimexEE versions...
North Korean Hackers Used 'Torisma' Spyware in Job Offers-based Attacks
A cyberespionage campaign aimed at aerospace and defense sectors in order to install data gathering implants on victims' machines for purposes of surveillance and data exfiltration may have been more sophisticated than previously thought. The attacks, which targeted IP-addresses belonging to...
CVE-2020-28115
SQL Injection vulnerability in "Documents component" found in AudimexEE version 14.1.0 allows an attacker to execute arbitrary SQL commands via the objectpath parameter...
CVE-2020-28115
SQL Injection vulnerability in "Documents component" found in AudimexEE version 14.1.0 allows an attacker to execute arbitrary SQL commands via the objectpath parameter...