CVE-2010-3910

Multiple directory traversal vulnerabilities in the returnapplicationlanguage function in include/utils/utils.php in vtiger CRM before 5.2.1 allow remote attackers to include and execute arbitrary local files via a .. dot dot in 1 the langcrm parameter to phprint.php or 2 the currentlanguage...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in vtiger CRM before 5.2.1 allow remote attackers to inject arbitrary web script or HTML via 1 the username aka defaultusername field or 2 the password field in a Users Login action to index.php, or 3 the label parameter in a Settings GetFieldInfo...

DSquare Exploit Pack: D2SEC_VTIGERCRM

Name| d2secvtigercrm ---|--- CVE| CVE-2010-3910 Exploit Pack| D2ExploitPack Description| vtiger CRM 5.2.0 Local File Include Vulnerability Notes|...

Design/Logic Flaw

Incomplete blacklist vulnerability in config.template.php in vtiger CRM before 5.2.1 allows remote authenticated users to execute arbitrary code by using the draft save feature in the Compose Mail component to upload a file with a .phtml extension, and then accessing this file via a direct reques...

Directory traversal

Multiple directory traversal vulnerabilities in the returnapplicationlanguage function in include/utils/utils.php in vtiger CRM before 5.2.1 allow remote attackers to include and execute arbitrary local files via a .. dot dot in 1 the langcrm parameter to phprint.php or 2 the currentlanguage...

CVE-2010-3911

CVE-2010-3911 affects vtiger CRM 5.2.0 and earlier, with multiple XSS flaws: pre-auth reflected on login (username/password) and on Settings GetFieldInfo.php (label), plus additional XSS variants in phprint.php and graph.php. Root cause is improper input handling and unfiltered user inputs reflec...

CVE-2010-3910

Multiple directory traversal vulnerabilities in the returnapplicationlanguage function in include/utils/utils.php in vtiger CRM before 5.2.1 allow remote attackers to include and execute arbitrary local files via a .. dot dot in 1 the langcrm parameter to phprint.php or 2 the currentlanguage...

CVE-2010-3910

Vuln summary (CVE-2010-3910): VTiger CRM up to version 5.2.0 is affected by local file inclusion and directory traversal issues in include/utils/utils.php (return_application_language) and in graph.php. An attacker can trigger LFI by manipulating language parameters (lang_crm in phprint.php and c...

CVE-2010-3911

Multiple cross-site scripting XSS vulnerabilities in vtiger CRM before 5.2.1 allow remote attackers to inject arbitrary web script or HTML via 1 the username aka defaultusername field or 2 the password field in a Users Login action to index.php, or 3 the label parameter in a Settings GetFieldInfo...

CVE-2010-3909

Vtiger CRM (5.2.0 and potentially earlier) contains an incomplete blacklist vulnerability in config.template.php that, via the draft save feature in Compose Mail, allows a remote authenticated user to upload a .phtml file and then access it from storage/ to execute code. The issue enables Remote ...

CVE-2010-3909

Incomplete blacklist vulnerability in config.template.php in vtiger CRM before 5.2.1 allows remote authenticated users to execute arbitrary code by using the draft save feature in the Compose Mail component to upload a file with a .phtml extension, and then accessing this file via a direct reques...

Vtiger CRM 5.2.0 Multiple Vulnerabilities

Vtiger CRM 5.2.0 Multiple Vulnerabilities Name Multiple Vulnerabilities in Vtiger CRM Systems Affected Vtiger CRM 5.2.0 and possibly earlier versions Severity Medium Impact CVSSv2 Medium 9/10, vector: AV:N/AC:L/Au:N/C:P/I:P/A:C Vendor http://www.vtigercrm.com Advisory...

Vtiger CRM Detection (HTTP)

HTTP based detection of vtiger CRM. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.100909";...

Vtiger CRM 5.2.0 Code Execution / Cross Site Scripting / Local File Inclusion

Vtiger CRM 5.2.0 Multiple Vulnerabilities Name Multiple Vulnerabilities in Vtiger CRM Systems Affected Vtiger CRM 5.2.0 and possibly earlier versions Severity Medium Impact CVSSv2 Medium 9/10, vector: AV:N/AC:L/Au:N/C:P/I:P/A:C Vendor http://www.vtigercrm.com Advisory...

vtiger CRM 5.2.0 Cross Site Request Forgery

!--========================================================================================================= //\ /\ /\ /\ /\ /\ ///\ //\ /\ /\///\ // \ // //\ \ / //\ \ / // //\ \ /\\ \ \ \ / / / / // \ \ // // // // \ // //\ \\ \ // /// \ \ / \ / // / // / / / / / \ \ / / / ...

vtiger CRM 5.2.0 Shell Upload

============================================================================================================ //\ /\ /\ /\ /\ /\ ///\ //\ /\ /\///\ // \ // //\ \ / //\ \ / // //\ \ /\\ \ \ \ / / / / // \ \ // // // // \ // //\ \\ \ // /// \ \ / \ / // / // / / / / / \ \ / / / ...

Code injection

vtiger CRM before 5.1.0 allows remote authenticated users, with certain View privileges, to delete 1 attachments, 2 reports, 3 filters, 4 views, and 5 tickets; insert 6 attachments, 7 reports, 8 filters, 9 views, and 10 tickets; and edit 11 reports, 12 filters, 13 views, and 14 tickets via...

CVE-2009-3257

vtiger CRM before 5.1.0 allows remote authenticated users to bypass the permissions on the 1 Account Billing Address and 2 Shipping Address fields in a profile by creating a Sales Order SO associated with that profile...

Design/Logic Flaw

vtiger CRM before 5.1.0 allows remote authenticated users to bypass the permissions on the 1 Account Billing Address and 2 Shipping Address fields in a profile by creating a Sales Order SO associated with that profile...

CVE-2009-3258

vtiger CRM before 5.1.0 allows remote authenticated users, with certain View privileges, to delete 1 attachments, 2 reports, 3 filters, 4 views, and 5 tickets; insert 6 attachments, 7 reports, 8 filters, 9 views, and 10 tickets; and edit 11 reports, 12 filters, 13 views, and 14 tickets via...