CVE-2009-3249

CVE-2009-3249 pertains to vtiger CRM 5.0.4 and involves multiple directory traversal/remote file inclusion weaknesses. Technical details from the sources confirm: Vulnerabilities in graph.php via the module parameter and in include/Ajax/CommonAjax.php via module/file, reachable through modules li...

CVE-2009-3247

Cross-site scripting XSS vulnerability in the Activities module in vtiger CRM 5.0.4 allows remote attackers to inject arbitrary web script or HTML via the action parameter to phprint.php. NOTE: the querystring vector is already covered by CVE-2008-3101.3...

Vtiger CRM 5.0.4 Multiple Vulnerabilities

Vtiger CRM 5.0.4 Multiple Vulnerabilities Name Multiple Vulnerabilities in Vtiger CRM Systems Affected Vtiger CRM 5.0.4 and possibly earlier versions Severity Medium Impact CVSSv2 Medium 6/10, vector: AV:N/AC:M/Au:S/C:P/I:P/A:P Vendor http://www.vtigercrm.com Advisory...

Vtiger CRM 5.0.4 (RCE/CSRF/LFI/XSS) Multiple Vulnerabilities

Exploit for unknown platform in category web applications ============================================================ Vtiger CRM 5.0.4 RCE/CSRF/LFI/XSS Multiple Vulnerabilities ============================================================ Vtiger CRM 5.0.4 Multiple Vulnerabilities Name Multiple...

Vtiger CRM 5.0.4 Code Exection / XSS / XSRF / LFI

Vtiger CRM 5.0.4 Multiple Vulnerabilities Name Multiple Vulnerabilities in Vtiger CRM Systems Affected Vtiger CRM 5.0.4 and possibly earlier versions Severity Medium Impact CVSSv2 Medium 6/10, vector: AV:N/AC:M/Au:S/C:P/I:P/A:P Vendor http://www.vtigercrm.com Advisory...

Vtiger CRM 5.0.4 (RCE/CSRF/LFI/XSS) Multiple Vulnerabilities

No description provided by source. Vtiger CRM 5.0.4 Multiple Vulnerabilities Name Multiple Vulnerabilities in Vtiger CRM Systems Affected Vtiger CRM 5.0.4 and possibly earlier versions Severity Medium Impact CVSSv2 Medium 6/10, vector: AV:N/AC:M/Au:S/C:P/I:P/A:P Vendor http://www.vtigercrm.com...

vTiger CRM 5.0.4 - Remote Code Execution / Cross-Site Request Forgery / Local File Inclusion / Cross-Site Scripting

Vtiger CRM 5.0.4 Multiple Vulnerabilities Name Multiple Vulnerabilities in Vtiger CRM Systems Affected Vtiger CRM 5.0.4 and possibly earlier versions Severity Medium Impact CVSSv2 Medium 6/10, vector: AV:N/AC:M/Au:S/C:P/I:P/A:P Vendor http://www.vtigercrm.com Advisory...

vTiger CRM 5.0.4 - Remote Code Execution Cross-Site Request Forgery Local File Inclusion Cross-Site Scripting

vTiger CRM 5.0.4 - Remote Code Execution Cross-Site Request Forgery Local File Inclusion Cross-Site Scripting Vtiger CRM 5.0.4 Multiple Vulnerabilities Name Multiple Vulnerabilities in Vtiger CRM Systems Affected Vtiger CRM 5.0.4 and possibly earlier versions Severity Medium Impact CVSSv2 Medium...

vtiger CRM多个跨站脚本漏洞

BUGTRAQ ID: 30951 CVECAN ID: CVE-2008-3101 vtiger CRM是基于web的开源客户关系管理系统。 vtiger CRM实现上存在漏洞，远程攻击者可以通过向vtiger CRM的多个模块提交恶意的认证或查询请求执行跨站脚本攻击。 1 当module设置为Users且action设置为Authenticate的时候，index.php文件没有正确的验证对userpassword参数的输入便返回给了用户，可能导致在用户浏览器会话中执行任意HTML和脚本代码。 2...

FreeBSD Ports: vtiger

The remote host is missing an update to the system as announced in the referenced advisory. VID 2c8a84d9-5bee-11db-a5ae-00508d6a62df OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

FreeBSD Ports: vtiger

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2008 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in vtiger CRM 5.0.4 allow remote attackers to inject arbitrary web script or HTML via 1 the parenttab parameter in an index action to the Products module, as reachable through index.php; 2 the userpassword parameter in an Authenticate action to th...

CVE-2008-3101

Multiple cross-site scripting XSS vulnerabilities in vtiger CRM 5.0.4 allow remote attackers to inject arbitrary web script or HTML via 1 the parenttab parameter in an index action to the Products module, as reachable through index.php; 2 the userpassword parameter in an Authenticate action to th...

CVE-2008-3101

Multiple cross-site scripting XSS vulnerabilities in vtiger CRM 5.0.4 allow remote attackers to inject arbitrary web script or HTML via 1 the parenttab parameter in an index action to the Products module, as reachable through index.php; 2 the userpassword parameter in an Authenticate action to th...

CVE-2008-3101

CVE-2008-3101 affects vtiger CRM 5.0.4. The vulnerability consists of multiple XSS flaws triggered by unvalidated input in index.php across three paths: (1) Products module, index action via the parenttab parameter; (2) Users module, Authenticate action via the user_password parameter; (3) Home m...

vTiger CRM 5.0.4 - Multiple Cross-Site Scripting Vulnerabilities

vTiger CRM 5.0.4 - Multiple Cross-Site Scripting Vulnerabilities source: https://www.securityfocus.com/bid/30951/info vtiger CRM is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute...

vTiger CRM 5.0.4 - Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/30951/info vtiger CRM is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the...

Improper access control

Vtiger CRM before 5.0.4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read mail merge templates via a direct request to the wordtemplatedownload directory...

CVE-2008-3458

Vtiger CRM before 5.0.4 stores sensitive information under the web root with insufficient access control, which allows remote attackers to read mail merge templates via a direct request to the wordtemplatedownload directory...

CVE-2008-3458

Vuln CVE-2008-3458 affects vTiger CRM prior to version 5.0.4 . The issue is inadequate access control that stores sensitive information under the web root, enabling remote attackers to read mail merge templates by directly requesting the wordtemplatedownload directory. This is confirmed across mu...