CVE-2005-0266

Cross-site scripting XSS vulnerability in index.php in SugarCRM 1.X allows remote attackers to inject arbitrary web script or HTML via the 1 returnmodule, 2 returnaction, 3 name, 4 module, or 5 record parameter...

CVE-2004-1226

SugarCRM Sugar Sales 2.0.1c and earlier are affected by a vulnerability where remote attackers can cause an error message to reveal internal path information via requests to scripts with invalid input, demonstrated with phprint.php and an empty module parameter. The reliable sources describe the ...

CVE-2004-1228

The install scripts in SugarCRM Sugar Sales 2.0.1c and earlier are not removed after installation, which allows attackers to obtain the MySQL administrative password in cleartext from an installation form, or to cause a denial of service by changing database settings to the default...

CVE-2004-1225

CVE-2004-1225 affects SugarCRM Sugar Sales prior to 2.0.1a. The vulnerability is a SQL injection in the DetailView action to index.php (and related record parameters) that allows remote attackers to execute arbitrary SQL and potentially gain privileges. This is documented in NVD and CVE records. ...

CVE-2004-1225

SQL injection vulnerability in SugarCRM Sugar Sales before 2.0.1a allows remote attackers to execute arbitrary SQL commands and gain privileges via the record parameter in a DetailView action to index.php, and record parameters in other functionality...

CVE-2004-1227

CVE-2004-1227 affects SugarCRM Sugar Sales 2.0.1c and earlier. The vulnerability is a directory traversal flaw allowing remote attackers to read arbitrary files and potentially execute PHP code via dot-dot sequences in several parameters to index.php and Login.php (and possibly other scripts). Ro...

CVE-2004-1227

Directory traversal vulnerability in SugarCRM Sugar Sales 2.0.1c and earlier allows remote attackers to read arbitrary files and possibly execute arbitrary PHP code via .. dot dot sequences in the 1 module, 2 action, or 3 theme parameters to index.php, 4 the theme parameter to Login.php, and...

CVE-2004-1226

SugarCRM Sugar Sales 2.0.1c and earlier allows remote attackers to gain sensitive information via certain requests to scripts that contain invalid input, which reveals the path in an error message, as demonstrated using phprint.php with an empty module parameter...

CVE-2004-1228

The CVE-2004-1228 entry concerns SugarCRM Sugar Sales 2.0.1c and earlier, where install scripts are not removed after installation. This leaves the MySQL administrative password exposed in cleartext via an installation form and can also enable denial of service by resetting database settings to d...

CVE-2004-1228: Undefined Security Weakness

The install scripts in SugarCRM Sugar Sales 2.0.1c and earlier are not removed after installation, which allows attackers to obtain the MySQL administrative password in cleartext from an installation form, or to cause a denial of service by changing database settings to the default...

CVE-2004-1225: Undefined Security Weakness

SQL injection vulnerability in SugarCRM Sugar Sales before 2.0.1a allows remote attackers to execute arbitrary SQL commands and gain privileges via the record parameter in a DetailView action to index.php, and record parameters in other functionality...

CVE-2004-1227: Undefined Security Weakness

Directory traversal vulnerability in SugarCRM Sugar Sales 2.0.1c and earlier allows remote attackers to read arbitrary files and possibly execute arbitrary PHP code via .. dot dot sequences in the 1 module, 2 action, or 3 theme parameters to index.php, 4 the theme parameter to Login.php, and...

CVE-2004-1226: Undefined Security Weakness

SugarCRM Sugar Sales 2.0.1c and earlier allows remote attackers to gain sensitive information via certain requests to scripts that contain invalid input, which reveals the path in an error message, as demonstrated using phprint.php with an empty module parameter...

[SA13287] SugarCRM Unspecified Security Issues

TITLE: SugarCRM Unspecified Security Issues SECUNIA ADVISORY ID: SA13287 VERIFY ADVISORY: http://secunia.com/advisories/13287/ CRITICAL: Moderately critical IMPACT: Unknown WHERE: From remote SOFTWARE: SugarCRM 1.x http://secunia.com/product/3845/ SugarCRM 2.x http://secunia.com/product/4314/...

SugarCRM 1.x/2.0 Module - Traversal Arbitrary File Access

source: https://www.securityfocus.com/bid/11740/info SugarCRM is reported prone to multiple vulnerabilites arising from insufficient sanitization of user-supplied input. These issues can a remote attacker to carry out cross-site scripting, HTML injection, SQL injection and directory traversal...

[SA12364] SugarCRM Unspecified Login Authentication Vulnerability

TITLE: SugarCRM Unspecified Login Authentication Vulnerability SECUNIA ADVISORY ID: SA12364 VERIFY ADVISORY: http://secunia.com/advisories/12364/ CRITICAL: Moderately critical IMPACT: Unknown WHERE: From remote SOFTWARE: SugarCRM 1.x http://secunia.com/product/3845/ DESCRIPTION: An unspecified...