Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,807 results · page 26 of 37
Oct 21, 2020Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Flex Fields).CVE-2020-14850 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.2
Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Flex Fields). Supported versions that are affected are 12.1.3 and 12.2.3 - 12.2.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle CRM Technical Foundation. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle CRM Technical Foundation, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle CRM Technical Foundation accessible data as well as unauthorized update, insert or delete access to some of Oracle CRM Technical Foundation accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).
- Product
- CRM Technical Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2020Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences).CVE-2020-14823 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5
Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Supported versions that are affected are 12.2.3 - 12.2.10. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle CRM Technical Foundation. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle CRM Technical Foundation accessible data as well as unauthorized access to critical data or complete access to all Oracle CRM Technical Foundation accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N).
- Product
- CRM Technical Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2020Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences).CVE-2020-14774 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.5
Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Supported versions that are affected are 12.1.1 - 12.1.3 and 12.2.3 - 12.2.10. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle CRM Technical Foundation. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle CRM Technical Foundation. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
- Product
- CRM Technical Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2020An issue was discovered in 1CRM System through 8.6.7.CVE-2020-15958 · Other software · 1crm · reported by MITREHigh 8.6
An issue was discovered in 1CRM System through 8.6.7. An insecure direct object reference to internally stored files allows a remote attacker to access various sensitive information via an unauthenticated request with a predictable URL.
- Product
- 1crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Sep 14, 2020A CSRF issue in vtecrm vtenext 19 CE allows attackers to carry out unwanted actions on an administrator's behalf, such as uploading files, adding users, and delCVE-2020-10229 · Other software · Vtenext · reported by MITREHigh 8.8
A CSRF issue in vtecrm vtenext 19 CE allows attackers to carry out unwanted actions on an administrator's behalf, such as uploading files, adding users, and deleting accounts.
- Product
- Vtenext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netvtenext.com
Sep 14, 2020A file upload vulnerability in vtecrm vtenext 19 CE allows authenticated users to upload files with a .pht extension, resulting in remote code execution.CVE-2020-10228 · Other software · Vtenext · reported by MITREHigh 8.8
A file upload vulnerability in vtecrm vtenext 19 CE allows authenticated users to upload files with a .pht extension, resulting in remote code execution.
- Product
- Vtenext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netvtenext.com
Sep 14, 2020A cross-site scripting (XSS) vulnerability in the messages module of vtecrm vtenext 19 CE allows attackers to inject arbitrary JavaScript code via the From fielCVE-2020-10227 · Other software · Vtenext · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the messages module of vtecrm vtenext 19 CE allows attackers to inject arbitrary JavaScript code via the From field of an email.
- Product
- Vtenext
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsourceforge.netvtenext.com
Sep 14, 2020Wordpress Plugin Store / SoftradeWeb SNC WP SMART CRM V1.8.7 is affected by: Cross Site Scripting via the Business Name field, Tax Code field, First Name field,CVE-2020-25375 · WordPress plugins & themes · reported by MITREMedium 5.4
Wordpress Plugin Store / SoftradeWeb SNC WP SMART CRM V1.8.7 is affected by: Cross Site Scripting via the Business Name field, Tax Code field, First Name field, Address field, Town field, Phone field, Mobile field, Place of Birth field, Web Site field, VAT Number field, Last Name field, Fax field, Email field, and Skype field.
- Affected
- 1.8.7 to 1.8.7
- What to do
- Affects 1.8.7 to 1.8.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordzeroaptitude.comzeroaptitude.com
Aug 31, 2020Dolibarr 11.0.4 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities that could allow remote authenticated attackers to inject arbitrary weCVE-2020-13828 · Other software · Dolibarr · reported by MITREMedium 5.4
Dolibarr 11.0.4 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities that could allow remote authenticated attackers to inject arbitrary web script or HTML via ticket/card.php?action=create with the subject, message, or address parameter; adherents/card.php with the societe or address parameter; product/card.php with the label or customcode parameter; or societe/card.php with the alias or barcode parameter.
- Product
- Dolibarr Erp/crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwizlynxgroup.comwizlynxgroup.com
Aug 21, 2020Dolibarr CRM before 11.0.5 allows privilege escalation.CVE-2020-14201 · Other software · Dolibarr · reported by MITREMedium 6.5
Dolibarr CRM before 11.0.5 allows privilege escalation. This could allow remote authenticated attackers to upload arbitrary files via societe/document.php in which "disabled" is changed to "enabled" in the HTML source code.
- Product
- Dolibarr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comwizlynxgroup.com
Aug 12, 2020SugarCRM before 10.1.0 (Q3 2020) allows SQL Injection.CVE-2020-17373 · Other software · Sugarcrm · reported by MITREMedium 5.3
SugarCRM before 10.1.0 (Q3 2020) allows SQL Injection.
- Product
- Sugarcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Aug 12, 2020SugarCRM before 10.1.0 (Q3 2020) allows XSS.CVE-2020-17372 · Other software · Sugarcrm · reported by MITREMedium 5.4
SugarCRM before 10.1.0 (Q3 2020) allows XSS.
- Product
- Sugarcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jul 15, 2020Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: CRM User Management Framework).CVE-2020-14717 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.7
Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: CRM User Management Framework). Supported versions that are affected are 12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Common Applications. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Common Applications, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Common Applications accessible data. CVSS 3.1 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N).
- Product
- Common Applications
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2020Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: CRM User Management Framework).CVE-2020-14716 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.7
Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: CRM User Management Framework). Supported versions that are affected are 12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Common Applications. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Common Applications, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Common Applications accessible data. CVSS 3.1 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N).
- Product
- Common Applications
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2020Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: CRM User Management Framework).CVE-2020-14688 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.2
Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: CRM User Management Framework). Supported versions that are affected are 12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Common Applications. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Common Applications, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Common Applications accessible data as well as unauthorized update, insert or delete access to some of Oracle Common Applications accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).
- Product
- Common Applications
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2020Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences).CVE-2020-14679 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.5
Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Supported versions that are affected are 12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle CRM Technical Foundation. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle CRM Technical Foundation. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
- Product
- CRM Technical Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2020Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences).CVE-2020-14667 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.6
Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Supported versions that are affected are 12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle CRM Technical Foundation. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle CRM Technical Foundation, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle CRM Technical Foundation accessible data as well as unauthorized update, insert or delete access to some of Oracle CRM Technical Foundation accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N).
- Product
- CRM Technical Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2020Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences).CVE-2020-14661 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.7
Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Supported versions that are affected are 12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle CRM Technical Foundation. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle CRM Technical Foundation, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle CRM Technical Foundation accessible data. CVSS 3.1 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N).
- Product
- CRM Technical Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2020Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences).CVE-2020-14660 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.2
Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Supported versions that are affected are 12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle CRM Technical Foundation. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle CRM Technical Foundation, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle CRM Technical Foundation accessible data as well as unauthorized update, insert or delete access to some of Oracle CRM Technical Foundation accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).
- Product
- CRM Technical Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2020Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences).CVE-2020-14659 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.7
Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Supported versions that are affected are 12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle CRM Technical Foundation. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle CRM Technical Foundation, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle CRM Technical Foundation accessible data. CVSS 3.1 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N).
- Product
- CRM Technical Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2020Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences).CVE-2020-14657 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.6
Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Supported versions that are affected are 12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle CRM Technical Foundation. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle CRM Technical Foundation, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle CRM Technical Foundation accessible data as well as unauthorized update, insert or delete access to some of Oracle CRM Technical Foundation accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N).
- Product
- CRM Technical Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2020Vulnerability in the Oracle CRM Gateway for Mobile Devices product of Oracle E-Business Suite (component: Setup of Mobile Applications).CVE-2020-14599 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.1
Vulnerability in the Oracle CRM Gateway for Mobile Devices product of Oracle E-Business Suite (component: Setup of Mobile Applications). Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle CRM Gateway for Mobile Devices. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle CRM Gateway for Mobile Devices accessible data as well as unauthorized access to critical data or complete access to all Oracle CRM Gateway for Mobile Devices accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
- Product
- CRM Gateway for Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2020Vulnerability in the Oracle CRM Gateway for Mobile Devices product of Oracle E-Business Suite (component: Setup of Mobile Applications).CVE-2020-14598 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.1
Vulnerability in the Oracle CRM Gateway for Mobile Devices product of Oracle E-Business Suite (component: Setup of Mobile Applications). Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle CRM Gateway for Mobile Devices. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle CRM Gateway for Mobile Devices accessible data as well as unauthorized access to critical data or complete access to all Oracle CRM Gateway for Mobile Devices accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
- Product
- CRM Gateway for Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 15, 2020Vulnerability in the Siebel UI Framework product of Oracle Siebel CRM (component: SWSE Server).CVE-2020-14531 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.9
Vulnerability in the Siebel UI Framework product of Oracle Siebel CRM (component: SWSE Server). Supported versions that are affected are 20.6 and prior. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel UI Framework. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel UI Framework accessible data as well as unauthorized update, insert or delete access to some of Siebel UI Framework accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N).
- Product
- Siebel UI Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2020A reflected cross-site scripting (XSS) vulnerability in Dolibarr 11.0.3 allows remote attackers to inject arbitrary web script or HTML into public/notice.php (rCVE-2020-14475 · Other software · Dolibarr · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in Dolibarr 11.0.3 allows remote attackers to inject arbitrary web script or HTML into public/notice.php (related to transphrase and transkey).
- Product
- Dolibarr Erp/crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2020The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions.CVE-2020-13240 · Other software · Dolibarr · reported by MITREMedium 5.4
The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. This bypasses the .noexe protection mechanism against XSS.
- Product
- Dolibarr Erp/crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2020The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link.CVE-2020-13239 · Other software · Dolibarr · reported by MITREMedium 5.4
The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link. This causes XSS.
- Product
- Dolibarr Erp/crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2020In Dolibarr 10.0.6, forms are protected with a CSRF token against CSRF attacks.CVE-2020-11825 · Other software · Dolibarr · reported by MITREHigh 8.8
In Dolibarr 10.0.6, forms are protected with a CSRF token against CSRF attacks. The problem is any CSRF token in any user's session can be used in another user's session. CSRF tokens should not be valid in this situation.
- Product
- Dolibarr Erp/crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfatihhcelik.blogspot.comfatihhcelik.blogspot.com
Apr 16, 2020In Dolibarr 10.0.6, if USER_LOGIN_FAILED is active, there is a stored XSS vulnerability on the admin tools --> audit page.CVE-2020-11823 · Other software · Dolibarr · reported by MITREMedium 5.4
In Dolibarr 10.0.6, if USER_LOGIN_FAILED is active, there is a stored XSS vulnerability on the admin tools --> audit page. This may lead to stealing of the admin account.
- Product
- Dolibarr Erp/crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordfatihhcelik.blogspot.comfatihhcelik.blogspot.com
Apr 15, 2020Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences).CVE-2020-2889 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.3
Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Supported versions that are affected are 12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle CRM Technical Foundation. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle CRM Technical Foundation accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
- Product
- CRM Technical Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2020Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences).CVE-2020-2886 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.7
Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Supported versions that are affected are 12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle CRM Technical Foundation. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle CRM Technical Foundation, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle CRM Technical Foundation accessible data. CVSS 3.0 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N).
- Product
- CRM Technical Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2020Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences).CVE-2020-2881 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.2
Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle CRM Technical Foundation. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle CRM Technical Foundation, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle CRM Technical Foundation accessible data as well as unauthorized update, insert or delete access to some of Oracle CRM Technical Foundation accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).
- Product
- CRM Technical Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2020Vulnerability in the Oracle CRM Gateway for Mobile Devices product of Oracle E-Business Suite (component: Setup of Mobile Applications).CVE-2020-2838 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.6
Vulnerability in the Oracle CRM Gateway for Mobile Devices product of Oracle E-Business Suite (component: Setup of Mobile Applications). Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle CRM Gateway for Mobile Devices. While the vulnerability is in Oracle CRM Gateway for Mobile Devices, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle CRM Gateway for Mobile Devices accessible data. CVSS 3.0 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
- Product
- CRM Gateway for Mobile Devices
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 15, 2020Vulnerability in the Siebel UI Framework product of Oracle Siebel CRM (component: EAI, SWSE).CVE-2020-2738 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.3
Vulnerability in the Siebel UI Framework product of Oracle Siebel CRM (component: EAI, SWSE). Supported versions that are affected are 20.2 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel UI Framework. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel UI Framework accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
- Product
- Siebel UI Framework
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 14, 2020SAP NetWeaver AS ABAP (Business Server Pages application CRM_BSP_FRAME), versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75ECVE-2020-6229 · Network & remote access · SAP SE · reported by cna@sap.comMedium 6.1
SAP NetWeaver AS ABAP (Business Server Pages application CRM_BSP_FRAME), versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A, 75B, 75C, 75D, 75E, does not sufficiently encode user controlled inputs, resulting in reflected Cross-Site Scripting (XSS) vulnerability.
- Product
- SAP NetWeaver AS ABAP (Business Server Pages application CRM_BSP_FRAME)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comwiki.scn.sap.com
Mar 19, 2020SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 mishandles API access tokens and credentials.CVE-2019-18785 · Other software · Suitecrm · reported by MITREHigh 7.5
SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 mishandles API access tokens and credentials.
- Product
- Suitecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.suitecrm.comdocs.suitecrm.com
Mar 19, 2020SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 does not correctly implement the .htaccess protection mechanism.CVE-2019-18782 · Other software · Salesagility · reported by MITREMedium 5.3
SuiteCRM 7.10.x prior to 7.10.21 and 7.11.x prior to 7.11.9 does not correctly implement the .htaccess protection mechanism.
- Product
- Suitecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.suitecrm.comdocs.suitecrm.com
Mar 16, 2020SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow for an invalid Bean ID to be submitted.CVE-2020-8787 · Other software · Salesagility · reported by MITREHigh 7.5
SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow for an invalid Bean ID to be submitted.
- Product
- Suitecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.suitecrm.comdocs.suitecrm.com
Mar 16, 2020SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 4 of 4).CVE-2020-8786 · Other software · Salesagility · reported by MITRECritical 9.8
SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 4 of 4).
- Product
- Suitecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.suitecrm.comdocs.suitecrm.com
Mar 16, 2020SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 3 of 4).CVE-2020-8785 · Other software · Salesagility · reported by MITRECritical 9.8
SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 3 of 4).
- Product
- Suitecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.suitecrm.comdocs.suitecrm.com
Mar 16, 2020SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 2 of 4).CVE-2020-8784 · Other software · Salesagility · reported by MITRECritical 9.8
SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 2 of 4).
- Product
- Suitecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.suitecrm.comdocs.suitecrm.com
Mar 16, 2020SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 1 of 4).CVE-2020-8783 · Other software · Salesagility · reported by MITRECritical 9.8
SuiteCRM 7.10.x versions prior to 7.10.23 and 7.11.x versions prior to 7.11.11 allow SQL Injection (issue 1 of 4).
- Product
- Suitecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.suitecrm.comdocs.suitecrm.com
Mar 16, 2020Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php (product price screen).CVE-2019-19212 · Other software · Dolibarr · reported by MITRECritical 9.8
Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php (product price screen).
- Product
- Dolibarr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.deherolab.usd.de
Mar 16, 2020Dolibarr ERP/CRM before 10.0.3 has an Insufficient Filtering issue that can lead to user/card.php XSS.CVE-2019-19211 · Other software · Dolibarr · reported by MITREMedium 6.1
Dolibarr ERP/CRM before 10.0.3 has an Insufficient Filtering issue that can lead to user/card.php XSS.
- Product
- Dolibarr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.deherolab.usd.de
Mar 16, 2020Dolibarr ERP/CRM before 10.0.3 allows XSS because uploaded HTML documents are served as text/html despite being renamed to .noexe files.CVE-2019-19210 · Other software · Dolibarr · reported by MITREMedium 5.4
Dolibarr ERP/CRM before 10.0.3 allows XSS because uploaded HTML documents are served as text/html despite being renamed to .noexe files.
- Product
- Dolibarr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.deherolab.usd.de
Mar 16, 2020Dolibarr ERP/CRM before 10.0.3 allows SQL Injection.CVE-2019-19209 · Other software · Dolibarr · reported by MITREHigh 7.5
Dolibarr ERP/CRM before 10.0.3 allows SQL Injection.
- Product
- Dolibarr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordherolab.usd.deherolab.usd.de
Feb 16, 2020Dolibarr 11.0 allows XSS via the joinfiles, topic, or code parameter, or the HTTP Referer header.CVE-2020-9016 · Other software · Dolibarr · reported by MITREMedium 5.4
Dolibarr 11.0 allows XSS via the joinfiles, topic, or code parameter, or the HTTP Referer header.
- Product
- Dolibarr Erp/crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcode610.blogspot.comcode610.blogspot.com
Feb 13, 2020SuiteCRM through 7.11.10 allows SQL Injection via the SOAP API, the EmailUIAjax interface, or the MailMerge module.CVE-2020-8804 · Other software · Salesagility · reported by MITREMedium 6.5
SuiteCRM through 7.11.10 allows SQL Injection via the SOAP API, the EmailUIAjax interface, or the MailMerge module.
- Product
- Suitecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Feb 13, 2020SuiteCRM through 7.11.11 allows Directory Traversal to include arbitrary .php files within the webroot via add_to_prospect_list.CVE-2020-8803 · Other software · Salesagility · reported by MITRECritical 9.8
SuiteCRM through 7.11.11 allows Directory Traversal to include arbitrary .php files within the webroot via add_to_prospect_list.
- Product
- Suitecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Feb 13, 2020SuiteCRM through 7.11.11 has Incorrect Access Control via action_saveHTMLField Bean Manipulation.CVE-2020-8802 · Other software · Salesagility · reported by MITRECritical 9.8
SuiteCRM through 7.11.11 has Incorrect Access Control via action_saveHTMLField Bean Manipulation.
- Product
- Suitecrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.