CVE-2015-0131

Cross-site scripting XSS vulnerability in IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified...

CVE-2015-0126

IBM Leads vulnerability CVE-2015-0126 affects IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2. It allows remote authenticated users to bypass intended file-upload restrictions via ...

CVE-2015-0116

CVE-2015-0116 affects IBM Leads versions including 7.x, 8.1.0 up to 8.1.0.14, 8.2, 8.5.0 up to 8.5.0.7.3, 8.6.0 up to 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 up to 9.1.0.6.1, and 9.1.1 up to 9.1.1.0.2. The issue is a CSRF risk caused by improper restriction of link additions, enabling remote auth...

CVE-2015-0131

CVE-2015-0131 describes a Cross-site scripting (XSS) vulnerability in IBM Leads across multiple versions (7.x; 8.1.0 prior to 8.1.0.14; 8.2; 8.5.0 prior to 8.5.0.7.3; 8.6.0 prior to 8.6.0.8.1; 9.0.0 through 9.0.0.4; 9.1.0 prior to 9.1.0.6.1; 9.1.1 before 9.1.1.0.2) that allows remote authenticate...

CVE-2015-0127

IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 does not properly restrict use of FRAME elements, which allows remote authenticated users to conduct phishing attacks via a crafted...

WordPress Leads Plugin <= 1.6.2 - Stored XSS

Because of this vulnerability, attackers can include arbitrary content, such as HTML or Java Script. Solution Upgrade this plugin...

WordPress Leads 1.6.1-1.6.2 - Stored XSS

The WordPress Leads plugin exposes a number of functions via AJAX to Anonymous users via the ‘nopriv’ prefix. One of these functions that is registered in ‘leads/shared/classes/class.lead-storage.php’ controls the insertion of leads into the database. A number of fields accepted as POST parameter...

Sql injection

Multiple SQL injection vulnerabilities in the Leads module in SugarCRM 6.1 before 6.1.7, 6.2 before 6.2.4, 6.3 before 6.3.0RC3, and 6.4 before 6.4.0beta1 allow remote attackers to execute arbitrary SQL commands via the 1 where and 2 order parameters in a getfulllist action to index.php...

CVE-2011-4679

vtiger CRM before 5.3.0 does not properly recognize the disabled status of a field in the Leads module, which allows remote authenticated users to bypass intended access restrictions by reading a previously created report...

CVE-2011-4679

vtiger CRM before 5.3.0 does not properly recognize the disabled status of a field in the Leads module, which allows remote authenticated users to bypass intended access restrictions by reading a previously created report...

TinyMCE MCFileManager 2.1.2 Arbitrary arbitrary file upload vulnerability-vulnerability warning-the black bar safety net

TinyMCE MCFileManager 2.1.2 Arbitrary upload page, not the file name filtering leads to arbitrary file vulnerability google: inurl: /tinymce/plugins/filemanager/ Enter the upload page : http://www. myhack58. com/tinymce/plugins/filemanager/ Upload shell:...

vTiger CRM 4.2 Leads Module - record Cross-Site Scripting

vTiger CRM 4.2 Leads Module - record Cross-Site Scripting source: https://www.securityfocus.com/bid/15562/info vtiger CRM is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. vTiger CRM is prone to...