816 matches found
[RT-SA-2011-002] SugarCRM list privilege restriction bypass
Advisory: SugarCRM list privilege restriction bypass RedTeam Pentesting discovered a vulnerability in SugarCRM that allows logged in users to bypass restrictions of their list privilege, allowing to list all entries. Details ======= Product: SugarCRM Community Edition SugarCRM Professional SugarC...
SugarCRM 6.1.1 - Information Disclosure
source: https://www.securityfocus.com/bid/46885/info SugarCRM is prone to an information-disclosure vulnerability because it fails to restrict access to certain application data. Attackers can exploit this issue to obtain sensitive information that may lead to further attacks...
SugarCRM Community Edition 5.5.2 Cross Site Request Forgery
!--========================================================================================================= //\ /\ /\ /\ /\ /\ ///\ //\ /\ /\///\ // \ // //\ \ / //\ \ / // //\ \ /\\ \ \ \ / / / / // \ \ // // // // \ // //\ \\ \ // /// \ \ / \ / // / // / / / / / \ \ / / / ...
Cross site scripting
Cross-site scripting XSS vulnerability in the online Documents functionality in SugarCRM 5.2.x before 5.2.0l and 5.5.x before 5.5.0a allows remote authenticated users to inject arbitrary web script or HTML via the Document Name field...
CVE-2010-0465
Cross-site scripting XSS vulnerability in the online Documents functionality in SugarCRM 5.2.x before 5.2.0l and 5.5.x before 5.5.0a allows remote authenticated users to inject arbitrary web script or HTML via the Document Name field...
CVE-2010-0465
CVE-2010-0465 is a stored XSS in SugarCRM’s online Documents feature. Affected: SugarCRM 5.2.x before 5.2.0l and 5.5.x before 5.5.0a. Root cause: insufficient sanitization of the Document Name field in the Documents UI, allowing remote authenticated users to inject arbitrary script/HTML. Impact: ...
CVE-2010-0465
Cross-site scripting XSS vulnerability in the online Documents functionality in SugarCRM 5.2.x before 5.2.0l and 5.5.x before 5.5.0a allows remote authenticated users to inject arbitrary web script or HTML via the Document Name field...
CVE-2010-0465: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the online Documents functionality in SugarCRM 5.2.x before 5.2.0l and 5.5.x before 5.5.0a allows remote authenticated users to inject arbitrary web script or HTML via the Document Name field...
SugarCRM Stored XSS vulnerability
Class: Stored Cross Site Scripting XSS CVE: CVE-2010-0465 Remote: Yes Local: Yes Published: Jan 1, 2010 12:01AM Timeline: Submission to Mitre: January 29, 2010 Vendor Contact: February 18, 2010 Vendor Response: February 19, 2010 Patch Available: March 10, 2010 Credit: Jeromie Jackson CISSP, CISM...
SugarCRM Cross Site Scripting
Class: Stored Cross Site Scripting XSS CVE: CVE-2010-0465 Remote: Yes Local: Yes Published: Jan 1, 2010 12:01AM Timeline: Submission to Mitre: January 29, 2010 Vendor Contact: February 18, 2010 Vendor Response: February 19, 2010 Patch Available: March 10, 2010 Credit: Jeromie Jackson CISSP, CISM...
SugarCRM SQL Injection / Access / Code Execution
Author: Janek Vind 'waraxe' Vulnerable: SugarCRM SugarCRM 5.5.0.RC2 SugarCRM SugarCRM 5.2.0j Product: http://www.sugarcrm.com/crm/ Description: SugarCRM is prone to multiple remote vulnerabilities, including: 1. Multiple SQL-injection vulnerabilities 2. Multiple unauthorized access vulnerabilitie...
SugarCRM on Apache / Windows .htaccess Direct Request Arbitrary File Access
The version of SugarCRM running on the remote host has an information disclosure vulnerability. When Apache is running on Windows, .htaccess restrictions are case-sensitive, but filenames are not. A remote attacker can bypass .htaccess restrictions by using uppercase letters when requesting files...
Sugar CRM 5.5.0.RC2 and 5.2.0j Multiple Remote Vulnerabilities
Exploit for unknown platform in category web applications ============================================================== Sugar CRM 5.5.0.RC2 and 5.2.0j Multiple Remote Vulnerabilities ============================================================== Vulnerable: SugarCRM SugarCRM 5.5.0.RC2 SugarCRM...
Sugar CRM 5.5.0.rc25.2.0j - Multiple Vulnerabilities
Sugar CRM 5.5.0.rc25.2.0j - Multiple Vulnerabilities Author: Janek Vind 'waraxe' Vulnerable: SugarCRM SugarCRM 5.5.0.RC2 SugarCRM SugarCRM 5.2.0j Product: http://www.sugarcrm.com/crm/ Description: SugarCRM is prone to multiple remote vulnerabilities, including: 1. Multiple SQL-injection...
Sugar CRM 5.5.0.rc2/5.2.0j - Multiple Vulnerabilities
Author: Janek Vind 'waraxe' Vulnerable: SugarCRM SugarCRM 5.5.0.RC2 SugarCRM SugarCRM 5.2.0j Product: http://www.sugarcrm.com/crm/ Description: SugarCRM is prone to multiple remote vulnerabilities, including: 1. Multiple SQL-injection vulnerabilities 2. Multiple unauthorized access vulnerabilitie...
SugarCRM vulnerable to cross-site scripting
Overview SugarCRM contains a cross-site scripting vulnerability. SugarCRM is a customer relationship management CRM software. SugarCRM contains a cross-site scripting vulnerability. Takeshi Terada of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated...
JVN#84396512 SugarCRM vulnerable to cross-site scripting
SugarCRM is a customer relationship management CRM software. SugarCRM contains a cross-site scripting vulnerability. Impact If a user views a malicious page and clicks the print icon while logged in, an arbitrary script may be executed on the user's web browser. Solution Update the Software Updat...
CVE-2009-2978
SQL injection vulnerability in SugarCRM 4.5.1o and earlier, 5.0.0k and earlier, and 5.2.0g and earlier, allows remote attackers to execute arbitrary SQL commands via unspecified vectors...
Sql injection
SQL injection vulnerability in SugarCRM 4.5.1o and earlier, 5.0.0k and earlier, and 5.2.0g and earlier, allows remote attackers to execute arbitrary SQL commands via unspecified vectors...