CVE-2010-3911

Multiple cross-site scripting XSS vulnerabilities in vtiger CRM before 5.2.1 allow remote attackers to inject arbitrary web script or HTML via 1 the username aka defaultusername field or 2 the password field in a Users Login action to index.php, or 3 the label parameter in a Settings GetFieldInfo...

CVE-2010-3911

CVE-2010-3911 affects vtiger CRM 5.2.0 and earlier, with multiple XSS flaws: pre-auth reflected on login (username/password) and on Settings GetFieldInfo.php (label), plus additional XSS variants in phprint.php and graph.php. Root cause is improper input handling and unfiltered user inputs reflec...

CVE-2010-3910

Vuln summary (CVE-2010-3910): VTiger CRM up to version 5.2.0 is affected by local file inclusion and directory traversal issues in include/utils/utils.php (return_application_language) and in graph.php. An attacker can trigger LFI by manipulating language parameters (lang_crm in phprint.php and c...

CVE-2010-3909

Vtiger CRM (5.2.0 and potentially earlier) contains an incomplete blacklist vulnerability in config.template.php that, via the draft save feature in Compose Mail, allows a remote authenticated user to upload a .phtml file and then access it from storage/ to execute code. The issue enables Remote ...

CVE-2010-3910

Multiple directory traversal vulnerabilities in the returnapplicationlanguage function in include/utils/utils.php in vtiger CRM before 5.2.1 allow remote attackers to include and execute arbitrary local files via a .. dot dot in 1 the langcrm parameter to phprint.php or 2 the currentlanguage...

CVE-2010-3909

Incomplete blacklist vulnerability in config.template.php in vtiger CRM before 5.2.1 allows remote authenticated users to execute arbitrary code by using the draft save feature in the Compose Mail component to upload a file with a .phtml extension, and then accessing this file via a direct reques...

Vtiger CRM 5.2.0 Multiple Vulnerabilities

Vtiger CRM 5.2.0 Multiple Vulnerabilities Name Multiple Vulnerabilities in Vtiger CRM Systems Affected Vtiger CRM 5.2.0 and possibly earlier versions Severity Medium Impact CVSSv2 Medium 9/10, vector: AV:N/AC:L/Au:N/C:P/I:P/A:C Vendor http://www.vtigercrm.com Advisory...

Vtiger CRM 5.2.0 Code Execution / Cross Site Scripting / Local File Inclusion

Vtiger CRM 5.2.0 Multiple Vulnerabilities Name Multiple Vulnerabilities in Vtiger CRM Systems Affected Vtiger CRM 5.2.0 and possibly earlier versions Severity Medium Impact CVSSv2 Medium 9/10, vector: AV:N/AC:L/Au:N/C:P/I:P/A:C Vendor http://www.vtigercrm.com Advisory...

Vtiger CRM Detection (HTTP)

HTTP based detection of vtiger CRM. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.100909";...

vtiger CRM 5.2.0 Cross Site Request Forgery

!--========================================================================================================= //\ /\ /\ /\ /\ /\ ///\ //\ /\ /\///\ // \ // //\ \ / //\ \ / // //\ \ /\\ \ \ \ / / / / // \ \ // // // // \ // //\ \\ \ // /// \ \ / \ / // / // / / / / / \ \ / / / ...

vtiger CRM 5.2.0 Shell Upload

============================================================================================================ //\ /\ /\ /\ /\ /\ ///\ //\ /\ /\///\ // \ // //\ \ / //\ \ / // //\ \ /\\ \ \ \ / / / / // \ \ // // // // \ // //\ \\ \ // /// \ \ / \ / // / // / / / / / \ \ / / / ...

Code injection

vtiger CRM before 5.1.0 allows remote authenticated users, with certain View privileges, to delete 1 attachments, 2 reports, 3 filters, 4 views, and 5 tickets; insert 6 attachments, 7 reports, 8 filters, 9 views, and 10 tickets; and edit 11 reports, 12 filters, 13 views, and 14 tickets via...

Design/Logic Flaw

vtiger CRM before 5.1.0 allows remote authenticated users to bypass the permissions on the 1 Account Billing Address and 2 Shipping Address fields in a profile by creating a Sales Order SO associated with that profile...

CVE-2009-3257

vtiger CRM before 5.1.0 allows remote authenticated users to bypass the permissions on the 1 Account Billing Address and 2 Shipping Address fields in a profile by creating a Sales Order SO associated with that profile...

CVE-2009-3258

vtiger CRM before 5.1.0 allows remote authenticated users, with certain View privileges, to delete 1 attachments, 2 reports, 3 filters, 4 views, and 5 tickets; insert 6 attachments, 7 reports, 8 filters, 9 views, and 10 tickets; and edit 11 reports, 12 filters, 13 views, and 14 tickets via...

CVE-2009-3257

vtiger CRM before 5.1.0 allows remote authenticated users to bypass the permissions on the 1 Account Billing Address and 2 Shipping Address fields in a profile by creating a Sales Order SO associated with that profile...

CVE-2009-3258

vtiger CRM before 5.1.0 allows remote authenticated users, with certain View privileges, to delete 1 attachments, 2 reports, 3 filters, 4 views, and 5 tickets; insert 6 attachments, 7 reports, 8 filters, 9 views, and 10 tickets; and edit 11 reports, 12 filters, 13 views, and 14 tickets via...

CVE-2009-3258

vtiger CRM prior to version 5.1.0 is affected. Remote authenticated users with certain View privileges can perform a range of actions, including deleting (attachments, reports, filters, views, tickets), inserting (attachments, reports, filters, views, tickets), and editing (reports, filters, view...

CVE-2009-3257

CVE-2009-3257 in vtiger CRM affects vtiger CRM before 5.1.0. The vulnerability arises when remote authenticated users can bypass permissions on profile fields (Account Billing Address and Shipping Address) by creating a Sales Order associated with that profile. The description implies a permissio...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the RSS module in vtiger CRM 5.0.4 allows remote attackers to hijack the authentication of Admin users for requests that modify the news feed system via the rssurl parameter in a Save action to index.php...