CVE-2007-3604

CVE-2007-3604 affects vtiger CRM prior to 5.0.3. The issue allows remote authenticated users with access to the Analytics Dashboard to bypass data restrictions and read the pipeline of the entire organization, potentially involving modules/Potentials/Potentials.php. The available documents do not...

CVE-2007-3603

CVE-2007-3603 affects vtiger CRM prior to 5.0.3. A SQL injection vulnerability exists in the dashboard (include/utils/SearchUtils.php) allowing remote authenticated users to execute arbitrary SQL via the assigned_user_id parameter in a Potentials ListView action to index.php. This is supported by...

CVE-2007-3601

vtiger CRM before 5.0.3, when a migrated build is used, allows remote authenticated users to read certain other users' calendar activities via a 1 home page or 2 event list view...

CVE-2007-3600

WordPlugin in the wordintegration component in vtiger CRM before 5.0.3 allows remote authenticated users to bypass field level security permissions and merge arbitrary fields in an Email template, as demonstrated by the fields in the Contact module...

CVE-2007-3616

CVE-2007-3616 affects vtiger CRM prior to 5.0.3. The vulnerability in the Users module profilePrivileges action allows remote authenticated users to perform administrative changes to arbitrary profile settings. No additional exploit details or remediation are provided in the connected documents; ...

CVE-2007-3599

vtiger CRM before 5.0.3 allows remote authenticated users to import and export the information for a contact even when they only have the View permission...

CVE-2007-3602

The SOAP webservice in vtiger CRM before 5.0.3 does not ensure that authenticated accounts are active, which allows remote authenticated users with inactive accounts to access and modify data, as demonstrated by the Thunderbird plugin...

CVE-2007-3604

vtiger CRM before 5.0.3 allows remote authenticated users with access to the Analytics DashBoard menu to bypass data restrictions and read the pipeline of the entire organization, possibly involving modules/Potentials/Potentials.php...

CVE-2007-3598

index.php in vtiger CRM before 5.0.3 allows remote authenticated users to obtain all users' names and e-mail addresses, and possibly change user settings, via a modified record parameter in a DetailView action to the Users module. NOTE: the vendor disputes the changing of settings, reporting that...

CVE-2007-3617

The report module in vtiger CRM before 5.0.3 does not properly apply security rules, which allows remote authenticated users to read arbitrary private module entries...

CVE-2007-3616

index.php in vtiger CRM before 5.0.3 allows remote authenticated users to perform administrative changes to arbitrary profile settings via a certain profilePrivileges action in the Users module...

CVE-2007-3603

SQL injection vulnerability in the dashboard include/utils/SearchUtils.php in vtiger CRM before 5.0.3 allows remote authenticated users to execute arbitrary SQL commands via the assigneduserid parameter in a Potentials ListView action to index.php...

CVE-2007-3599

CVE-2007-3599 affects vtiger CRM before 5.0.3. The issue allows remote authenticated users to import and export contact information even if their permissions are limited to View, indicating an authorization bypass in the contact data handling. The description does not specify the exact root cause...

FreeBSD : vtiger -- multiple remote file inclusion vulnerabilities (2c8a84d9-5bee-11db-a5ae-00508d6a62df)

Dedi Dwianto a.k.a theday reports : Input passed to the '$calpath' parameter in update.php is not properly verified before being used. This can be exploited to execute arbitrary PHP code by including files from local or external resources. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The...

CVE-2006-5289

Multiple PHP remote file inclusion vulnerabilities in Vtiger CRM 4.2 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the calpath parameter to 1 modules/Calendar/admin/update.php, 2 modules/Calendar/admin/scheme.php, or 3 modules/Calendar/calendar.php...

CVE-2006-5289

Multiple PHP remote file inclusion vulnerabilities in Vtiger CRM 4.2 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the calpath parameter to 1 modules/Calendar/admin/update.php, 2 modules/Calendar/admin/scheme.php, or 3 modules/Calendar/calendar.php...

CVE-2006-5289

Vulnerability summary (CVE-2006-5289): Vtiger CRM 4.2 and earlier is affected by multiple PHP remote file inclusion flaws in the Calendar module (calpath parameter) affecting update.php, scheme.php, and calendar.php. The underlying issue is unsafely handling calpath, allowing an attacker to suppl...

[ECHO_ADV_54$2006]vtiger CRM <=4.2 (calpath) Multiple Remote File Inclusion Vulnerability

ECHOADV54$2006 ----------------------------------------------------------------------------------------------- ECHOADV54$2006vtiger CRM =4.2 calpath Multiple Remote File Inclusion Vulnerability ----------------------------------------------------------------------------------------------- Author ...

vtiger CRM <= 4.2 (calpath) Multiple Remote File Include Vulnerabilities

Exploit for unknown platform in category web applications ======================================================================== vtiger CRM = 4.2 calpath Multiple Remote File Include Vulnerabilities ======================================================================== \ /\ \ / | \ \ | / \ //...

vTiger CRM 4.2 - calpath Multiple Remote File Inclusions

vTiger CRM 4.2 - calpath Multiple Remote File Inclusions \ /\ \ / | \ \ | / \ // / | \ | \ \ Y / | \ / / \ /| /\ / / / / / .OR.ID ECHOADV54$2006 ----------------------------------------------------------------------------------------------- ECHOADV54$2006vtiger CRM =4.2 calpath Multiple...