CVE-2007-3601

vtiger CRM before 5.0.3, when a migrated build is used, allows remote authenticated users to read certain other users' calendar activities via a 1 home page or 2 event list view...

CVE-2007-3598

index.php in vtiger CRM before 5.0.3 allows remote authenticated users to obtain all users' names and e-mail addresses, and possibly change user settings, via a modified record parameter in a DetailView action to the Users module. NOTE: the vendor disputes the changing of settings, reporting that...

Code injection

index.php in vtiger CRM before 5.0.3 allows remote authenticated users to obtain all users' names and e-mail addresses, and possibly change user settings, via a modified record parameter in a DetailView action to the Users module. NOTE: the vendor disputes the changing of settings, reporting that...

Code injection

vtiger CRM before 5.0.3 allows remote authenticated users to import and export the information for a contact even when they only have the View permission...

Design/Logic Flaw

vtiger CRM before 5.0.3 allows remote authenticated users with access to the Analytics DashBoard menu to bypass data restrictions and read the pipeline of the entire organization, possibly involving modules/Potentials/Potentials.php...

CVE-2007-3599

vtiger CRM before 5.0.3 allows remote authenticated users to import and export the information for a contact even when they only have the View permission...

CVE-2007-3600

WordPlugin in the wordintegration component in vtiger CRM before 5.0.3 allows remote authenticated users to bypass field level security permissions and merge arbitrary fields in an Email template, as demonstrated by the fields in the Contact module...

CVE-2007-3602

The CVE concerns vtiger CRM’s SOAP webservice prior to 5.0.3. The vulnerability arises because the service does not verify that authenticated accounts are active, allowing remote authenticated users with inactive accounts to access and modify data, as demonstrated by the Thunderbird plugin. Affec...

CVE-2007-3598

The CVE-2007-3598 issue affects vtiger CRM up to version 5.0.2 (vendor states 5.0.3) where a manipulated DetailView record parameter in the Users module allows remote authenticated users to view all users’ names and e‑mail addresses and possibly alter user settings, exposing Partial confidentiali...

CVE-2007-3599

CVE-2007-3599 affects vtiger CRM before 5.0.3. The issue allows remote authenticated users to import and export contact information even if their permissions are limited to View, indicating an authorization bypass in the contact data handling. The description does not specify the exact root cause...

CVE-2007-3616

index.php in vtiger CRM before 5.0.3 allows remote authenticated users to perform administrative changes to arbitrary profile settings via a certain profilePrivileges action in the Users module...

CVE-2007-3616

CVE-2007-3616 affects vtiger CRM prior to 5.0.3. The vulnerability in the Users module profilePrivileges action allows remote authenticated users to perform administrative changes to arbitrary profile settings. No additional exploit details or remediation are provided in the connected documents; ...

CVE-2007-3600

WordPlugin in the wordintegration component in vtiger CRM before 5.0.3 allows remote authenticated users to bypass field level security permissions and merge arbitrary fields in an Email template, as demonstrated by the fields in the Contact module...

CVE-2007-3601

Vulnerability CVE-2007-3601 affects vtiger CRM prior to 5.0.3. When a migrated build is used, remote authenticated users can read certain other users’ calendar activities via the home page or the event list view. The connected documents provide the affected product and the exposure method, but do...

CVE-2007-3604

CVE-2007-3604 affects vtiger CRM prior to 5.0.3. The issue allows remote authenticated users with access to the Analytics Dashboard to bypass data restrictions and read the pipeline of the entire organization, potentially involving modules/Potentials/Potentials.php. The available documents do not...

CVE-2007-3602

The SOAP webservice in vtiger CRM before 5.0.3 does not ensure that authenticated accounts are active, which allows remote authenticated users with inactive accounts to access and modify data, as demonstrated by the Thunderbird plugin...

CVE-2007-3603

CVE-2007-3603 affects vtiger CRM prior to 5.0.3. A SQL injection vulnerability exists in the dashboard (include/utils/SearchUtils.php) allowing remote authenticated users to execute arbitrary SQL via the assigned_user_id parameter in a Potentials ListView action to index.php. This is supported by...

CVE-2007-3617

The CVE-2007-3617 issue affects vtiger CRM prior to 5.0.3, where the report module fails to enforce security rules. This allows remote authenticated users to read arbitrary private module entries via the report functionality. Affected component: vtiger CRM report module; root cause: improper appl...

CVE-2007-3601

vtiger CRM before 5.0.3, when a migrated build is used, allows remote authenticated users to read certain other users' calendar activities via a 1 home page or 2 event list view...

CVE-2007-3604

vtiger CRM before 5.0.3 allows remote authenticated users with access to the Analytics DashBoard menu to bypass data restrictions and read the pipeline of the entire organization, possibly involving modules/Potentials/Potentials.php...