CVE-2019-17308

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Emails module by a Regular user...

CVE-2019-17308

SugarCRM is vulnerable to PHP code injection in the Emails module (affecting versions before 8.0.4 and 9.x before 9.0.2). The issue can be triggered by a Regular user due to inadequate input validation, enabling arbitrary code execution. Affected software: SugarCRM (core product) with Email handl...

CVE-2019-17309

CVE-2019-17309 affects SugarCRM: vulnerable in SugarCRM versions before 8.0.4 and 9.x before 9.0.2, in the EmailMan module. The underlying issue is PHP code injection via that module by an Admin user, enabling arbitrary code execution per the description. Remediation: upgrade to SugarCRM 8.0.4 or...

CVE-2019-17309

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the EmailMan module by an Admin user...

CVE-2019-17310

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Campaigns module by an Admin user...

CVE-2019-17310

CVE-2019-17310 affects SugarCRM (Campaigns module) prior to 8.0.4 and 9.x prior to 9.0.2. An Admin can inject PHP code due to input handling in Campaigns, enabling arbitrary code execution. Impact described as PHP code injection with potential for full system compromise; no exploit details provid...

CVE-2019-17311

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the attachment function by a Regular user...

CVE-2019-17311

SugarCRM is affected by a directory traversal vulnerability in the attachment feature affecting versions before 8.0.4 and 9.x before 9.0.2. The underlying issue is insufficient input validation, enabling a Regular user to traverse directories via the attachment function. No exploitation details a...

CVE-2019-17312

SugarCRM before 8.0.4 and 9.x before 9.0.2 expose a directory traversal flaw in the file function that can be triggered by a regular user. The public sources listed (including SugarCRM advisory) confirm the affected versions and the nature of the vulnerability. Remediation per the documents is up...

CVE-2019-17312

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the file function by a Regular user...

CVE-2019-17313

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the Studio module by a Developer user...

CVE-2019-17313

CVE-2019-17313 affects SugarCRM with versions before 8.0.4 and 9.x before 9.0.2. The vulnerability is a directory traversal in the Studio module accessible to Developer users. Public sources indicate the issue stems from input validation weaknesses in the Studio module (CNVD-2019-34432). The acco...

CVE-2019-17314

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the Configurator module by an Admin user...

CVE-2019-17314

SugarCRM vulnerability CVE-2019-17314 affects SugarCRM before 8.0.4 and 9.x before 9.0.2, enabling directory traversal in the Configurator module by an Admin user. Root cause cited by CNVD: lack of input validation. Some sources describe the impact as potentially allowing an attacker to inject cu...

CVE-2019-17315

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Administration module by an Admin user...

CVE-2019-17315

SugarCRM is affected by a PHP object injection in the Administration module. The vulnerability exists in SugarCRM versions prior to 8.0.4 and 9.x prior to 9.0.2, exploitable by an Admin user without required complex interactions. Root cause is inadequate validation in the Administration module th...

CVE-2019-17316

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the Import module by a Regular user...

CVE-2019-17316

CVE-2019-17316 affects SugarCRM: versions prior to 8.0.4 and 9.x prior to 9.0.2. The vulnerability is a PHP object injection in the Import module exploitable by a regular user, due to insufficient input validation. Multiple connected sources (Red Hat, CNVD, CVE list) confirm the affected versions...

CVE-2019-17317

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP object injection in the UpgradeWizard module by an Admin user...

CVE-2019-17317

SugarCRM vulnerability CVE-2019-17317 affects SugarCRM before 8.0.4 and 9.x before 9.0.2, where an Admin can trigger PHP object injection via the UpgradeWizard module. The root cause is input handling in UpgradeWizard that allows object injection, enabling impact as described in affected advisori...