PT-2019-15060

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description The issue allows SQL injection in the Quotes module by a Regular user. Recommendations For SugarCRM versions prior to 8.0.4, update to version 8.0.4 or later. Fo...

PT-2019-15071

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description The issue allows PHP code injection in the Emails module by a regular user. Recommendations For SugarCRM versions prior to 8.0.4, update to version 8.0.4 or late...

CVE-2019-17300: Improper Control of Generation of Code

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Administration module by a Developer user...

CVE-2019-17312: Improper Limitation of a Pathname to a Restricted Directory

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the file function by a Regular user...

PT-2019-15075

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description The issue allows directory traversal in the file function by a regular user. Recommendations For SugarCRM versions prior to 8.0.4, update to version 8.0.4 or...

PT-2019-15082

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description The issue allows SQL injection in the Emails module by a regular user. Recommendations For SugarCRM versions prior to 8.0.4, update to version 8.0.4 or later. Fo...

PT-2019-15066

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description The issue allows PHP code injection in the MergeRecords module by a Developer user. Recommendations For SugarCRM versions prior to 8.0.4, update to version 8.0.4...

PT-2019-15067

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description The issue allows PHP code injection in the MergeRecords module by an Admin user. Recommendations For SugarCRM versions prior to 8.0.4, update to version 8.0.4 or...

PT-2019-15064

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description The issue allows PHP code injection in the ModuleBuilder module by an Admin user. Recommendations For SugarCRM versions prior to 8.0.4, update to version 8.0.4 o...

PT-2019-15073

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description The issue allows PHP code injection in the Campaigns module by an Admin user. Recommendations For SugarCRM versions prior to 8.0.4, update to version 8.0.4 or...

PT-2019-15081

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description The issue allows SQL injection in the pmse Inbox module by a regular user. Recommendations For SugarCRM versions prior to 8.0.4, update to version 8.0.4 or later...

PT-2019-15056

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description The issue allows SQL injection in the pmse Project module by a Regular user. Recommendations For SugarCRM versions prior to 8.0.4, update to version 8.0.4 or...

PT-2019-15059

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description The issue allows SQL injection in the Contacts module by a regular user. Recommendations For SugarCRM versions prior to 8.0.4, update to version 8.0.4 or later...

PT-2019-15076

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description The issue allows directory traversal in the Studio module by a Developer user. Recommendations For SugarCRM versions prior to 8.0.4, update to version 8.0.4 or...

CVE-2019-17302: Improper Control of Generation of Code

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the ModuleBuilder module by a Developer user...

PT-2019-15070

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description The issue allows PHP code injection in the Tracker module by an Admin user. Recommendations For SugarCRM versions prior to 8.0.4, update to version 8.0.4 or late...

CVE-2019-17298: Improper Neutralization of Special Elements used in an SQL Command

SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Administration module by a Developer user...

PT-2019-15061

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description The issue allows SQL injection in the Administration module by a Developer user. Recommendations For SugarCRM versions prior to 8.0.4, update to version 8.0.4 or...

PT-2019-15057

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description The issue allows SQL injection in the export function by a regular user. Recommendations For SugarCRM versions prior to 8.0.4, update to version 8.0.4 or later...

PT-2019-15058

Name of the Vulnerable Software and Affected Versions SugarCRM versions prior to 8.0.4 SugarCRM versions 9.x prior to 9.0.2 Description The issue allows SQL injection in the history function by a regular user. Recommendations For SugarCRM versions prior to 8.0.4, update to version 8.0.4 or later...