816 matches found
CVE-2019-17305
CVE-2019-17305 affects SugarCRM prior to 8.0.4 and 9.x prior to 9.0.2. The vulnerability is a PHP code injection in the MergeRecords module that can be exploited by a Regular user. The connected sources consistently describe this as a PHP code injection flaw arising from insufficient input valida...
CVE-2019-17305
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the MergeRecords module by a Regular user...
CVE-2019-17306
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Configurator module by an Admin user...
CVE-2019-17306
SugarCRM versions affected:
CVE-2019-17307
Summary: CVE-2019-17307 affects SugarCRM. The vulnerability allows PHP code injection in the Tracker module when exploited by an Admin user. Affected versions are SugarCRM prior to 8.0.4 and 9.x prior to 9.0.2. The provided connected documents confirm the existence and nature of the issue but do ...
CVE-2019-17307
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Tracker module by an Admin user...
CVE-2019-17308
SugarCRM is vulnerable to PHP code injection in the Emails module (affecting versions before 8.0.4 and 9.x before 9.0.2). The issue can be triggered by a Regular user due to inadequate input validation, enabling arbitrary code execution. Affected software: SugarCRM (core product) with Email handl...
CVE-2019-17308
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Emails module by a Regular user...
CVE-2019-17309
CVE-2019-17309 affects SugarCRM: vulnerable in SugarCRM versions before 8.0.4 and 9.x before 9.0.2, in the EmailMan module. The underlying issue is PHP code injection via that module by an Admin user, enabling arbitrary code execution per the description. Remediation: upgrade to SugarCRM 8.0.4 or...
CVE-2019-17309
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the EmailMan module by an Admin user...
CVE-2019-17310
CVE-2019-17310 affects SugarCRM (Campaigns module) prior to 8.0.4 and 9.x prior to 9.0.2. An Admin can inject PHP code due to input handling in Campaigns, enabling arbitrary code execution. Impact described as PHP code injection with potential for full system compromise; no exploit details provid...
CVE-2019-17310
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Campaigns module by an Admin user...
CVE-2019-17311
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the attachment function by a Regular user...
CVE-2019-17311
SugarCRM is affected by a directory traversal vulnerability in the attachment feature affecting versions before 8.0.4 and 9.x before 9.0.2. The underlying issue is insufficient input validation, enabling a Regular user to traverse directories via the attachment function. No exploitation details a...
CVE-2019-17312
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the file function by a Regular user...
CVE-2019-17312
SugarCRM before 8.0.4 and 9.x before 9.0.2 expose a directory traversal flaw in the file function that can be triggered by a regular user. The public sources listed (including SugarCRM advisory) confirm the affected versions and the nature of the vulnerability. Remediation per the documents is up...
CVE-2019-17313
CVE-2019-17313 affects SugarCRM with versions before 8.0.4 and 9.x before 9.0.2. The vulnerability is a directory traversal in the Studio module accessible to Developer users. Public sources indicate the issue stems from input validation weaknesses in the Studio module (CNVD-2019-34432). The acco...
CVE-2019-17313
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the Studio module by a Developer user...
CVE-2019-17314
SugarCRM vulnerability CVE-2019-17314 affects SugarCRM before 8.0.4 and 9.x before 9.0.2, enabling directory traversal in the Configurator module by an Admin user. Root cause cited by CNVD: lack of input validation. Some sources describe the impact as potentially allowing an attacker to inject cu...