CVE-2019-14765

CVE-2019-14765 affects DIMO YellowBox CRM prior to version 6.3.4. The root cause is Incorrect Access Control in AfficheExplorateurParam(), allowing a standard authenticated user to access administrative controllers. CVSSv3.1 base score is 8.8 (HIGH) with network access, low attack complexity, and...

CVE-2019-14768

CVE-2019-14768 affects DIMO YellowBox CRM prior to 6.3.4. An authenticated user can exploit an Arbitrary File Upload in the file browser to deploy a WebApp WAR to the Tomcat server via Path Traversal, enabling remote code execution with SYSTEM privileges. The vulnerability stems from improper val...

CVE-2019-14767

In DIMO YellowBox CRM prior to version 6.3.4, a Path Traversal vulnerability exists in images/Apparence (dossier=../) and servletrecuperefichier (document=../) that allows an unauthenticated user to download arbitrary files from the server. Affected component: the application’s file retrieval pat...

CVE-2019-14766

CVE-2019-14766 affects DIMO YellowBox CRM prior to version 6.3.4. The issue is a path traversal vulnerability in the file browser that allows a standard authenticated user to browse the server filesystem. Based on the connected Red Hat/NVD entries, the vulnerability is triggered via the file brow...