CVE-2011-4680

Multiple cross-site scripting XSS vulnerabilities in the customer portal in vtiger CRM before 5.2.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the customer portal in vtiger CRM before 5.2.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Design/Logic Flaw

vtiger CRM before 5.3.0 does not properly recognize the disabled status of a field in the Leads module, which allows remote authenticated users to bypass intended access restrictions by reading a previously created report...

CVE-2011-4680

Multiple cross-site scripting XSS vulnerabilities in the customer portal in vtiger CRM before 5.2.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2011-4679

vtiger CRM before 5.3.0 does not properly recognize the disabled status of a field in the Leads module, which allows remote authenticated users to bypass intended access restrictions by reading a previously created report...

CVE-2011-4679

CVE-2011-4679 affects vtiger CRM prior to 5.3.0. The issue: the Leads module fails to properly recognize a field’s disabled status, allowing remote authenticated users to bypass access restrictions by reading a previously created report. Affected product/version: vtiger CRM

CVE-2011-4680

CVE-2011-4680 describes multiple XSS vulnerabilities in the vtiger CRM customer portal prior to version 5.2.0. The flaws allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. The connected documents confirm the affected product (vtiger CRM) and the affected compon...

CVE-2011-4670

Multiple cross-site scripting XSS vulnerabilities in vTiger CRM 5.2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 viewname parameter in a CalendarAjax action, 2 activitymode parameter in a DetailView action, 3 contactid and 4 parentid parameters in an...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in vTiger CRM 5.2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 viewname parameter in a CalendarAjax action, 2 activitymode parameter in a DetailView action, 3 contactid and 4 parentid parameters in an...

CVE-2011-4670

Multiple cross-site scripting XSS vulnerabilities in vTiger CRM 5.2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 viewname parameter in a CalendarAjax action, 2 activitymode parameter in a DetailView action, 3 contactid and 4 parentid parameters in an...

CVE-2011-4670

CVE-2011-4670 affects vtiger CRM up to version 5.2.1 (and earlier per sources) where multiple XSS vectors exist in the Calendar, DetailView, EditView, ListView, and other modules (Calendar, Campaigns, com_vtiger_workflow, Dashboard, Potentials, Reports, Settings, Home, phprint.php). The root caus...

Sql injection

SQL injection vulnerability in the Calendar module in vTiger CRM 5.2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the onlyforuser parameter in an index action to index.php...

CVE-2011-4559

SQL injection vulnerability in the Calendar module in vTiger CRM 5.2.1 and earlier allows remote attackers to execute arbitrary SQL commands via the onlyforuser parameter in an index action to index.php...

CVE-2011-4559

CVE-2011-4559 affects vtiger CRM (Calendar module) prior to or including vTiger 5.2.1; the vulnerability is a SQL injection in the onlyforuser parameter of the index action (index.php). This allows remote attackers to execute arbitrary SQL commands. Connected records also indicate CVE-2013-5091 a...

vtiger CRM 5.2.1 Cross Site Scripting

vtiger CRM 5.2.1 Multiple Remote Cross-Site Scripting Vulnerabilities Vendor: vTiger Product web page: http://www.vtiger.com Affected version: 5.2.1 Summary: vtiger CRM is a free, full-featured, 100% Open Source CRM software ideal for small and medium businesses, with low-cost product support...

vTiger CRM 5.2.1 - index.php Multiple Cross-Site Scripting Vulnerabilities (2)

vTiger CRM 5.2.1 - index.php Multiple Cross-Site Scripting Vulnerabilities 2 source: https://www.securityfocus.com/bid/50364/info vtiger CRM is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues t...

vtiger CRM 5.2.1 Multiple Remote Cross-Site Scripting Vulnerabilities

Summary vtiger CRM is a free, full-featured, 100% Open Source CRM software ideal for small and medium businesses, with low-cost product support available to production users that need reliable support. Description vtiger CRM suffers from a XSS vulnerability when parsing user input to the...

Local File Inclusion Vulnerabilities in vtiger CRM

High-Tech Bridge SA Security Research Lab has discovered multiple vulnerabilities in vtiger CRM which could be exploited to perform gain access to sensitive information and compromise vulnerable system. 1 Local file inclusion vulnerabilities in vtiger CRM 1.1 The vulnerability exists due to input...

vTiger CRM 5.2 - onlyforuser SQL Injection

vTiger CRM 5.2 - onlyforuser SQL Injection source: https://www.securityfocus.com/bid/49948/info vtiger CRM is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to...

vTiger CRM 5.2 - 'onlyforuser' SQL Injection

source: https://www.securityfocus.com/bid/49948/info vtiger CRM is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify...