PT-2015-4492

Name of the Vulnerable Software and Affected Versions IBM Leads versions 7.x, 8.1.0 through 8.1.0.13, 8.2, 8.5.0 through 8.5.0.7.2, 8.6.0 through 8.6.0.8.0, 9.0.0 through 9.0.0.4, 9.1.0 through 9.1.0.6.0, 9.1.1 through 9.1.1.0.1 Description The issue allows remote authenticated users to inject...

PT-2015-4488

Name of the Vulnerable Software and Affected Versions IBM Leads versions 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, 9.1.1 before 9.1.1.0.2 Description The issue allows remote authenticated users to conduct phishi...

PT-2015-4479

Name of the Vulnerable Software and Affected Versions IBM Leads versions 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, 9.1.1 before 9.1.1.0.2 Description The issue makes it easier for remote authenticated users to...

PT-2015-4478

Name of the Vulnerable Software and Affected Versions IBM Leads versions 7.x, 8.1.0 through 8.1.0.13, 8.2, 8.5.0 through 8.5.0.7.2, 8.6.0 through 8.6.0.8.0, 9.0.0 through 9.0.0.4, 9.1.0 through 9.1.0.6.0, 9.1.1 through 9.1.1.0.1 Description A cross-site request forgery CSRF issue allows remote...

CVE-2015-0131: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified...

CVE-2015-0126: Undefined Security Weakness

IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 allows remote authenticated users to bypass intended file-upload restrictions via a modified extension...

CVE-2015-0116: Improper Neutralization of Special Elements in Output Used by a Downstream Component

IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 does not properly restrict the addition of links, which makes it easier for remote authenticated users to conduct cross-site request...

CVE-2015-0127: Undefined Security Weakness

IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 does not properly restrict use of FRAME elements, which allows remote authenticated users to conduct phishing attacks via a crafted...

PT-2015-4487

Name of the Vulnerable Software and Affected Versions IBM Leads versions 7.x, 8.1.0 before 8.1.0.14 IBM Leads versions 8.2 IBM Leads versions 8.5.0 before 8.5.0.7.3 IBM Leads versions 8.6.0 before 8.6.0.8.1 IBM Leads versions 9.0.0 through 9.0.0.4 IBM Leads versions 9.1.0 before 9.1.0.6.1 IBM Lea...

CVE-2015-0115: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in IBM Leads 7.x, 8.1.0 before 8.1.0.14, 8.2, 8.5.0 before 8.5.0.7.3, 8.6.0 before 8.6.0.8.1, 9.0.0 through 9.0.0.4, 9.1.0 before 9.1.0.6.1, and 9.1.1 before 9.1.1.0.2 allows remote authenticated users to hijack the authentication of customer accounts...

WordPress Leads Plugin <= 1.6.2 - Stored XSS

Because of this vulnerability, attackers can include arbitrary content, such as HTML or Java Script. Solution Upgrade this plugin...

WordPress Leads 1.6.1-1.6.2 - Stored XSS

The WordPress Leads plugin exposes a number of functions via AJAX to Anonymous users via the ‘nopriv’ prefix. One of these functions that is registered in ‘leads/shared/classes/class.lead-storage.php’ controls the insertion of leads into the database. A number of fields accepted as POST parameter...

Sql injection

Multiple SQL injection vulnerabilities in the Leads module in SugarCRM 6.1 before 6.1.7, 6.2 before 6.2.4, 6.3 before 6.3.0RC3, and 6.4 before 6.4.0beta1 allow remote attackers to execute arbitrary SQL commands via the 1 where and 2 order parameters in a getfulllist action to index.php...

CVE-2011-4833: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the Leads module in SugarCRM 6.1 before 6.1.7, 6.2 before 6.2.4, 6.3 before 6.3.0RC3, and 6.4 before 6.4.0beta1 allow remote attackers to execute arbitrary SQL commands via the 1 where and 2 order parameters in a getfulllist action to index.php...

CVE-2011-4679

vtiger CRM before 5.3.0 does not properly recognize the disabled status of a field in the Leads module, which allows remote authenticated users to bypass intended access restrictions by reading a previously created report...

CVE-2011-4679

vtiger CRM before 5.3.0 does not properly recognize the disabled status of a field in the Leads module, which allows remote authenticated users to bypass intended access restrictions by reading a previously created report...

CVE-2011-4679: Undefined Security Weakness

vtiger CRM before 5.3.0 does not properly recognize the disabled status of a field in the Leads module, which allows remote authenticated users to bypass intended access restrictions by reading a previously created report...

PT-2011-5025

Name of the Vulnerable Software and Affected Versions vtiger CRM versions prior to 5.3.0 Description The issue allows remote authenticated users to bypass intended access restrictions. This is due to the software not properly recognizing the disabled status of a field in the Leads module, enablin...

TinyMCE MCFileManager 2.1.2 Arbitrary arbitrary file upload vulnerability-vulnerability warning-the black bar safety net

TinyMCE MCFileManager 2.1.2 Arbitrary upload page, not the file name filtering leads to arbitrary file vulnerability google: inurl: /tinymce/plugins/filemanager/ Enter the upload page : http://www. myhack58. com/tinymce/plugins/filemanager/ Upload shell:...

CVE-2005-3820: Undefined Security Weakness

Multiple directory traversal vulnerabilities in index.php in vTiger CRM 4.2 and earlier allow remote attackers to read or include arbitrary files, an ultimately execute arbitrary PHP code, via .. dot dot and null byte "%00" sequences in the 1 module parameter and 2 action parameter in the Leads...