JVN#30144870 SugarCRM cross-site scripting vulnerability

Impact An arbitrary script may be executed on the user's web browser. In addition, if session information from a cookie is leaked, an attacker could possibly conduct session hijacking. Solution Products Affected SugarCRM 4.2.1b and earlier SugarCRM 4.0.1g and earlier SugarCRM 3.5.1h and earlier...

CVE-2006-2460

SugarCRM (Sugar Suite Open Source)

CVE-2006-2460: Undefined Security Weakness

Sugar Suite Open Source SugarCRM 4.2 and earlier, when registerglobals is enabled, does not protect critical variables such as $GLOBALS and $SESSION from modification, which allows remote attackers to conduct attacks such as directory traversal or PHP remote file inclusion, as demonstrated by...

SugarCRM <= 4.0 beta Remote File Inclusion Vulnerability

The remote web server contains a PHP script that is prone to multiple flaws. Description : SugarCRM is a Customer Relationship Manager written in PHP. The version of SugarCRM installed on the remote host does not properly sanitize user input in the 'beanFiles' parameter in the 'acceptDecline.php'...

SugarCRM <= 4.0 beta Remote File Inclusion Vulnerability

The version of SugarCRM installed on the remote host does not properly sanitize user input in the SPDX-FileCopyrightText: 2005 Ferdy Riphagen Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

CVE-2005-4087

PHP remote file include vulnerability in acceptDecline.php in Sugar Suite Open Source Customer Relationship Management SugarCRM 4.0 beta and earlier allows remote attackers to execute arbitrary PHP code via a URL in the beanFiles array parameter...

CVE-2005-4087

PHP remote file include vulnerability in acceptDecline.php in Sugar Suite Open Source Customer Relationship Management SugarCRM 4.0 beta and earlier allows remote attackers to execute arbitrary PHP code via a URL in the beanFiles array parameter...

CVE-2005-4087

SugarCRM

CVE-2005-4086: Undefined Security Weakness

Directory traversal vulnerability in acceptDecline.php in Sugar Suite Open Source Customer Relationship Management SugarCRM 4.0 beta and earlier allows remote attackers to include arbitrary local files via ".." sequences in the beanFiles array parameter...

vTiger CRM 4.2 RSS Aggregation Module - Feed Cross-Site Scripting

vTiger CRM 4.2 RSS Aggregation Module - Feed Cross-Site Scripting source: https://www.securityfocus.com/bid/15562/info vtiger CRM is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. vTiger CRM is pro...

SugarCRM Detection

The remote host is running SugarCRM, a customer relationship management CRM application written in PHP. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid19496; scriptversion"1.23"; scriptsetattributeattribute:"pluginmodificationdate", value:"2023/05/24";...

CVE-2005-0266

The CVE-2005-0266 entry documents a Cross-site scripting (XSS) vulnerability in SugarCRM 1.X, specifically in index.php, where an attacker can inject arbitrary web script or HTML via one of five parameters: return_module, return_action, name, module, or record. The vulnerability is exploitable re...

CVE-2005-0266

Cross-site scripting XSS vulnerability in index.php in SugarCRM 1.X allows remote attackers to inject arbitrary web script or HTML via the 1 returnmodule, 2 returnaction, 3 name, 4 module, or 5 record parameter...

CVE-2005-0266: Undefined Security Weakness

Cross-site scripting XSS vulnerability in index.php in SugarCRM 1.X allows remote attackers to inject arbitrary web script or HTML via the 1 returnmodule, 2 returnaction, 3 name, 4 module, or 5 record parameter...

CVE-2004-1227

Directory traversal vulnerability in SugarCRM Sugar Sales 2.0.1c and earlier allows remote attackers to read arbitrary files and possibly execute arbitrary PHP code via .. dot dot sequences in the 1 module, 2 action, or 3 theme parameters to index.php, 4 the theme parameter to Login.php, and...

CVE-2004-1225

SQL injection vulnerability in SugarCRM Sugar Sales before 2.0.1a allows remote attackers to execute arbitrary SQL commands and gain privileges via the record parameter in a DetailView action to index.php, and record parameters in other functionality...

CVE-2004-1226

SugarCRM Sugar Sales 2.0.1c and earlier allows remote attackers to gain sensitive information via certain requests to scripts that contain invalid input, which reveals the path in an error message, as demonstrated using phprint.php with an empty module parameter...

CVE-2004-1228

The install scripts in SugarCRM Sugar Sales 2.0.1c and earlier are not removed after installation, which allows attackers to obtain the MySQL administrative password in cleartext from an installation form, or to cause a denial of service by changing database settings to the default...

sugarCRM.txt

---------------------------------------------------------------------------- Cross Site Scripting Vulnerabilities and Possible Code Execution in SugarCRM ---------------------------------------------------------------------------- Author: Jose Antonio Coret Joxean Koret Date: 2004 Location: Basqu...

Cross Site Scripting Vulnerabilities and Possible Code Execution in SugarCRM

---------------------------------------------------------------------------- Cross Site Scripting Vulnerabilities and Possible Code Execution in SugarCRM ---------------------------------------------------------------------------- Author: Jose Antonio Coret Joxean Koret Date: 2004 Location: Basqu...