CVE-2018-20470

An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A directory traversal arbitrary file access vulnerability exists in the web reports module. This allows an outside attacker to view contents of sensitive files...

Code injection

An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A web reports module has "export to excel features" that are vulnerable to CSV injection. An attacker can embed Excel formulas inside an automation script that, when exported after execution, results in code execution...

CVE-2018-20470

Tyto Sahi Pro through 8.0.0 is affected by a Local File Inclusion / directory traversal vulnerability in the web reports module, enabling an attacker to view sensitive server files. Affected: Tyto Sahi Pro versions through 7.x.x and 8.0.0 (per CVE-2018-20470). Root cause: improper handling of fil...

PT-2019-10072

Name of the Vulnerable Software and Affected Versions: Tyto Sahi Pro versions prior to 8.0.1 Description: An issue was discovered in the web reports module of the software, specifically in the "export to excel features", which are vulnerable to CSV injection. This allows an attacker to embed Exce...

CVE-2018-20468: Improper Neutralization of Formula Elements in a CSV File

An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A web reports module has "export to excel features" that are vulnerable to CSV injection. An attacker can embed Excel formulas inside an automation script that, when exported after execution, results in code execution...

CVE-2018-20470: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A directory traversal arbitrary file access vulnerability exists in the web reports module. This allows an outside attacker to view contents of sensitive files...

PT-2019-10075 · Tyto · Tyto Sahi Pro

Name of the Vulnerable Software and Affected Versions: Tyto Sahi Pro versions prior to 8.0.1 Description: A directory traversal issue exists in the web reports module, allowing an outside attacker to access sensitive files. Recommendations: For versions prior to 8.0.1, update to version 8.0.1 or...

CVE-2018-20469: Improper Neutralization of Special Elements used in an SQL Command

An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. A parameter in the web reports module is vulnerable to h2 SQL injection. This can be exploited to inject SQL queries and run standard h2 system functions...

PT-2019-9376

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 7.0.1 Description An issue was discovered in the expense reports module, specifically in expensereport/card.php, which allows SQL injection via the integer parameters qty and value unit. Recommendations For versions...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in vTiger CRM 5.2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 viewname parameter in a CalendarAjax action, 2 activitymode parameter in a DetailView action, 3 contactid and 4 parentid parameters in an...

CVE-2011-4670

Multiple cross-site scripting XSS vulnerabilities in vTiger CRM 5.2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 viewname parameter in a CalendarAjax action, 2 activitymode parameter in a DetailView action, 3 contactid and 4 parentid parameters in an...