Filtered by vendor Salesagility
Subscriptions
Filtered by product Suitecrm
Subscriptions
Total
83 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-50335 | 1 Salesagility | 1 Suitecrm | 2024-11-08 | 4.9 Medium |
| SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. The "Publish Key" field in SuiteCRM's Edit Profile page is vulnerable to Reflected Cross-Site Scripting (XSS), allowing an attacker to inject malicious JavaScript code. This can be exploited to steal CSRF tokens and perform unauthorized actions, such as creating new administrative users without proper authentication. The vulnerability arises due to insufficient input validation and sanitization of the Publish Key field within the SuiteCRM application. When an attacker injects a malicious script, it gets executed within the context of an authenticated user's session. The injected script (o.js) then leverages the captured CSRF token to forge requests that create new administrative users, effectively compromising the integrity and security of the CRM instance. This issue has been addressed in versions 7.14.6 and 8.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. | ||||
| CVE-2024-49774 | 1 Salesagility | 1 Suitecrm | 2024-11-06 | 7.2 High |
| SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. SuiteCRM relies on the blacklist of functions/methods to prevent installation of malicious MLPs. But this checks can be bypassed with some syntax constructions. SuiteCRM uses token_get_all to parse PHP scripts and check the resulted AST against blacklists. But it doesn't take into account all scenarios. This issue has been addressed in versions 7.14.6 and 8.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. | ||||
| CVE-2024-49772 | 1 Salesagility | 1 Suitecrm | 2024-11-06 | 8.8 High |
| SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In SuiteCRM versions 7.14.4, poor input validation allows authenticated user do a SQL injection attack. Authenticated user with low pivilege can leak all data in database. This issue has been addressed in releases 7.14.6 and 8.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. | ||||
| CVE-2024-50333 | 1 Salesagility | 1 Suitecrm | 2024-11-06 | 6.6 Medium |
| SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. User input is not validated and is written to the filesystem. The ParserLabel::addLabels() function can be used to write attacker-controlled data into the custom language file that will be included at the runtime. This issue has been addressed in versions 7.14.6 and 8.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. | ||||
| CVE-2024-50332 | 1 Salesagility | 1 Suitecrm | 2024-11-06 | 8.8 High |
| SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Insufficient input value validation causes Blind SQL injection in DeleteRelationShip. This issue has been addressed in versions 7.14.6 and 8.7.1. Users are advised to upgrade. There are no known workarounds for this vulnerability. | ||||
| CVE-2023-3627 | 1 Salesagility | 1 Suitecrm | 2024-10-30 | 8.8 High |
| Cross-Site Request Forgery (CSRF) in GitHub repository salesagility/suitecrm-core prior to 8.3.1. | ||||
| CVE-2023-5350 | 1 Salesagility | 1 Suitecrm | 2024-09-19 | 9.1 Critical |
| SQL Injection in GitHub repository salesagility/suitecrm prior to 7.14.1. | ||||
| CVE-2023-5351 | 1 Salesagility | 1 Suitecrm | 2024-09-19 | 5.4 Medium |
| Cross-site Scripting (XSS) - Stored in GitHub repository salesagility/suitecrm prior to 7.14.1. | ||||
| CVE-2024-36419 | 1 Salesagility | 1 Suitecrm | 2024-09-19 | 4.3 Medium |
| SuiteCRM is an open-source Customer Relationship Management (CRM) software application. A vulnerability in versions prior to 8.6.1 allows for Host Header Injection when directly accessing the `/legacy` route. Version 8.6.1 contains a patch for the issue. | ||||
| CVE-2024-36418 | 1 Salesagility | 1 Suitecrm | 2024-09-19 | 8.6 High |
| SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in connectors allows an authenticated user to perform a remote code execution attack. Versions 7.14.4 and 8.6.1 contain a fix for this issue. | ||||
| CVE-2021-25961 | 1 Salesagility | 1 Suitecrm | 2024-09-17 | 8 High |
| In “SuiteCRM” application, v7.1.7 through v7.10.31 and v7.11-beta through v7.11.20 fail to properly invalidate password reset links that is associated with a deleted user id, which makes it possible for account takeover of any newly created user with the same user id. | ||||
| CVE-2021-25960 | 1 Salesagility | 1 Suitecrm | 2024-09-16 | 8 High |
| In “SuiteCRM” application, v7.11.18 through v7.11.19 and v7.10.29 through v7.10.31 are affected by “CSV Injection” vulnerability (Formula Injection). A low privileged attacker can use accounts module to inject payloads in the input fields. When an administrator access accounts module to export the data as a CSV file and opens it, the payload gets executed. This was not fixed properly as part of CVE-2020-15301, allowing the attacker to bypass the security measure. | ||||
| CVE-2023-5353 | 1 Salesagility | 1 Suitecrm | 2024-09-12 | 6.5 Medium |
| Improper Access Control in GitHub repository salesagility/suitecrm prior to 7.14.1. | ||||
| CVE-2024-45392 | 1 Salesagility | 1 Suitecrm | 2024-09-06 | 7.7 High |
| SuiteCRM is an open-source customer relationship management (CRM) system. Prior to version 7.14.5 and 8.6.2, insufficient access control checks allow a threat actor to delete records via the API. Versions 7.14.5 and 8.6.2 contain a patch for the issue. | ||||
| CVE-2023-6124 | 1 Salesagility | 1 Suitecrm | 2024-09-03 | 4.3 Medium |
| Server-Side Request Forgery (SSRF) in GitHub repository salesagility/suitecrm prior to 7.14.2, 8.4.2, 7.12.14. | ||||
| CVE-2023-6127 | 1 Salesagility | 1 Suitecrm | 2024-08-30 | 5.4 Medium |
| Unrestricted Upload of File with Dangerous Type in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. | ||||
| CVE-2023-6130 | 1 Salesagility | 1 Suitecrm | 2024-08-30 | 8.8 High |
| Path Traversal: '\..\filename' in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. | ||||
| CVE-2023-6131 | 1 Salesagility | 1 Suitecrm | 2024-08-30 | 8.8 High |
| Code Injection in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. | ||||
| CVE-2015-5948 | 1 Salesagility | 1 Suitecrm | 2024-08-06 | N/A |
| Race condition in SuiteCRM before 7.2.3 allows remote attackers to execute arbitrary code. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-5947. | ||||
| CVE-2015-5947 | 1 Salesagility | 1 Suitecrm | 2024-08-06 | 8.1 High |
| SuiteCRM before 7.2.3 allows remote attackers to execute arbitrary code. | ||||