662 matches found
YetiForce CRM 3.1 - Persistent Cross-Site Scripting
YetiForce CRM 3.1 - Persistent Cross-Site Scripting Exploit Title: YetiForce CRM Accounts' select your prefered user, and then in the 'Comments' section input; Either refresh the current page, or navigate back to 'Accounts'...
YetiForce CRM < 3.1 - Persistent Cross-Site Scripting
Exploit Title: YetiForce CRM Accounts' select your prefered user, and then in the 'Comments' section input; Either refresh the current page, or navigate back to 'Accounts'...
Vtiger CRM Authenticated Remote Code Execution (CVE-2015-6000)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Vtiger CRM Authenticated Remote Code Execution CVE-2015-6000 http://b.fl7.de/2015/09/vtiger-crm-authenticated-rce-cve-2015-6000.html 1. Summary 2. Vulnerability Details 3. Exploitation / Proof of Concept 4. Timeline 5. See Also 1. Summary Vtiger CRM...
Vtiger CRM < = 6.3.0 远程代码执行
No description provided by source...
vtiger Company Logo Upload Arbitrary Command Execution Vulnerability
vtiger CRM is a Web-based sales force automation SFA based customer relationship management system CRM. A security vulnerability exists in the logo upload function in the vtiger CRM SettingsVtigerCompanyDetailsSaveAction class, which allows authenticated users to upload arbitrary files and execut...
Vtiger CRM 6.3 Remote Code Execution
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Vtiger CRM Authenticated Remote Code Execution CVE-2015-6000 1. Summary 2. Vulnerability Details 3. Exploitation / Proof of Concept 4. Timeline 5. See Also 1. Summary Vtiger CRM is a CRM application. Vtiger CRM version 6.3 “Open Source” branch; releas...
vTiger CRM 6.3.0 - (Authenticated) Remote Code Execution
vTiger CRM 6.3.0 - Authenticated Remote Code Execution -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Exploit Title: Vtiger CRM = 6.3.0 Authenticated Remote Code Execution Date: 2015-09-28 Exploit Author: Benjamin Daniel Mussler Vendor Homepage: https://www.vtiger.com Software Link:...
vTiger CRM 6.3.0 - (Authenticated) Remote Code Execution
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Exploit Title: Vtiger CRM --------------------...
Vtiger CRM 6.3.0 Authenticated Remote Code Execution
Exploit for php platform in category web applications Exploit Title: Vtiger CRM = 6.3.0 Authenticated Remote Code Execution Date: 2015-09-28 Exploit Author: Benjamin Daniel Mussler Vendor Homepage: https://www.vtiger.com Software Link: https://www.vtiger.com/open-source-downloads/ Version: 6.3.0...
Vtiger CRM - Authenticated Logo Upload RCE
Vtiger 6.3.0 CRM's administration interface allows for the upload of a company logo. Instead of uploading an image, an attacker may choose to upload a file containing PHP code and run this code by accessing the resulting PHP file. This module was tested against vTiger CRM v6.3.0. Module Options m...
WordPress vTiger Plugin - Unknown Vulnerability
This plugin is prone to CRM lead capture unspecified vulnerability. Solution Update the plugin...
Design/Logic Flaw
views/Index.php in the Install module in vTiger 6.0 before Security Patch 2 does not properly restrict access, which allows remote attackers to re-install the application via a request that sets the X-Requested-With HTTP header, as demonstrated by executing arbitrary PHP code via the dbname...
CVE-2014-2268
views/Index.php in the Install module in vTiger 6.0 before Security Patch 2 does not properly restrict access, which allows remote attackers to re-install the application via a request that sets the X-Requested-With HTTP header, as demonstrated by executing arbitrary PHP code via the dbname...
CVE-2014-2268
views/Index.php in the Install module in vTiger 6.0 before Security Patch 2 does not properly restrict access, which allows remote attackers to re-install the application via a request that sets the X-Requested-With HTTP header, as demonstrated by executing arbitrary PHP code via the dbname...
CVE-2014-2268
CVE-2014-2268 affects vtiger CRM 6.0 Install module prior to Security Patch 2, where access restrictions are insufficient and a crafted request (including X-Requested-With) can re-install the app and execute arbitrary PHP via the db_name parameter. Public indicators of exploitation exist (e.g., M...
Vtiger CRM <= 6.0.0 Arbitrary File Disclosure Vulnerability
Vtiger CRM is prone to an arbitrary file disclosure vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
CVE-2014-1222
Directory traversal vulnerability in kcfinder/browse.php in Vtiger CRM before 6.0.0 Security patch 1 allows remote authenticated users to read arbitrary files via a .. dot dot in the file parameter in a download action. NOTE: it is likely that this issue is actually in the KCFinder third-party...
Directory traversal
Directory traversal vulnerability in kcfinder/browse.php in Vtiger CRM before 6.0.0 Security patch 1 allows remote authenticated users to read arbitrary files via a .. dot dot in the file parameter in a download action. NOTE: it is likely that this issue is actually in the KCFinder third-party...
CVE-2014-1222
CVE-2014-1222 affects Vtiger CRM prior to 6.0.0 Security Patch 1, where a vulnerability in the kcfinder/browse.php component allows remote authenticated users to read arbitrary files via directory traversal (.. in the file parameter) in a download action. The issue is likely in KCFinder and may a...
CVE-2014-1222
Directory traversal vulnerability in kcfinder/browse.php in Vtiger CRM before 6.0.0 Security patch 1 allows remote authenticated users to read arbitrary files via a .. dot dot in the file parameter in a download action. NOTE: it is likely that this issue is actually in the KCFinder third-party...