Updated 6 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

588new WordPress flaws this week

391,288entries in the database

1,808 results · page 27 of 37

Feb 13, 2020SuiteCRM through 7.11.11 has Incorrect Access Control via action_saveHTMLField Bean Manipulation.CVE-2020-8802 · Other software · Salesagility · reported by MITRECritical 9.8
SuiteCRM through 7.11.11 has Incorrect Access Control via action_saveHTMLField Bean Manipulation.
Product
Suitecrm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Feb 13, 2020SuiteCRM through 7.11.11 allows PHAR Deserialization.CVE-2020-8801 · Other software · Salesagility · reported by MITREHigh 7.2
SuiteCRM through 7.11.11 allows PHAR Deserialization.
Product
Suitecrm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Feb 13, 2020SuiteCRM through 7.11.11 allows EmailsControllerActionGetFromFields PHP Object Injection.CVE-2020-8800 · Other software · Salesagility · reported by MITREHigh 8.8
SuiteCRM through 7.11.11 allows EmailsControllerActionGetFromFields PHP Object Injection.
Product
Suitecrm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com seclists.org
Feb 7, 2020vTiger CRM 5.3 and 5.4: 'files' Upload Folder Arbitrary PHP Code Execution VulnerabilityCVE-2013-3591 · Other software · vTiger CRM · reported by cret@cert.orgHigh 8.8
vTiger CRM 5.3 and 5.4: 'files' Upload Folder Arbitrary PHP Code Execution Vulnerability
Product
vTiger CRM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com securityfocus.com
Feb 7, 2020Possible use after free issue while CRM is accessing the link pointer from device private data due to lack of resource protection in Snapdragon Auto, SnapdragonCVE-2019-14088 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 7.8
Possible use after free issue while CRM is accessing the link pointer from device private data due to lack of resource protection in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, MDM9206, MDM9207C, MDM9607, QCS605, SDM429W, SDX24, SM8150, SXR1130
Product
Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record qualcomm.com zerodayinitiative.com
Feb 6, 2020Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in VtigeCVE-2015-6000 · Other software · Vtiger · reported by cret@cert.orgHigh 8.8
Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtiger CRM 6.3.0 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in test/logo/.
Product
Vtiger CRM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record b.fl7.de securityfocus.com
Jan 29, 2020vtiger CRM 5.4.0 and earlier contain an Authentication Bypass Vulnerability due to improper authentication validation in the validateSession function.CVE-2013-3215 · Other software · Vtiger · reported by MITRECritical 9.8
vtiger CRM 5.4.0 and earlier contain an Authentication Bypass Vulnerability due to improper authentication validation in the validateSession function.
Product
Vtiger CRM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record securityfocus.com exchange.xforce.ibmcloud.com
Jan 28, 2020vtiger CRM 5.4.0 and earlier contain a PHP Code Injection Vulnerability in 'vtigerolservice.php'.CVE-2013-3214 · Other software · Vtiger · reported by MITRECritical 9.8
vtiger CRM 5.4.0 and earlier contain a PHP Code Injection Vulnerability in 'vtigerolservice.php'.
Product
Vtiger CRM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com securityfocus.com
Jan 28, 2020vtiger CRM 5.4.0 and earlier contain local file-include vulnerabilities in 'customerportal.php' which allows remote attackers to view files and execute local scCVE-2013-3212 · Other software · Vtiger · reported by MITREHigh 8.1
vtiger CRM 5.4.0 and earlier contain local file-include vulnerabilities in 'customerportal.php' which allows remote attackers to view files and execute local script code.
Product
Vtiger CRM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exploit-db.com securityfocus.com
Jan 27, 2020Cross-site scripting vulnerability in F-RevoCRM 6.0 to F-RevoCRM 6.5 patch6 (version 6 series) allows remote attackers to inject arbitrary web script or HTML viCVE-2019-6036 · Other software · ThinkingReed inc. · reported by vultures@jpcert.or.jpMedium 6.1
Cross-site scripting vulnerability in F-RevoCRM 6.0 to F-RevoCRM 6.5 patch6 (version 6 series) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Product
F-RevoCRM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp f-revocrm.jp
Jan 26, 2020htdocs/user/passwordforgotten.php in Dolibarr 10.0.6 allows XSS via the Referer HTTP header.CVE-2020-7996 · Other software · Dolibarr · reported by MITREMedium 6.1
htdocs/user/passwordforgotten.php in Dolibarr 10.0.6 allows XSS via the Referer HTTP header.
Product
Dolibarr Erp/crm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com tufangungor.github.io
Jan 26, 2020The htdocs/index.php?mainmenu=home login page in Dolibarr 10.0.6 allows an unlimited rate of failed authentication attempts.CVE-2020-7995 · Other software · Dolibarr · reported by MITRECritical 9.8
The htdocs/index.php?mainmenu=home login page in Dolibarr 10.0.6 allows an unlimited rate of failed authentication attempts.
Product
Dolibarr Erp/crm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com github.com
Jan 26, 2020Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 10.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) label[libelle] CVE-2020-7994 · Other software · Dolibarr · reported by MITREMedium 6.1
Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 10.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) label[libelle] parameter to the /htdocs/admin/dict.php?id=3 page; the (2) name[constname] parameter to the /htdocs/admin/const.php?mainmenu=home page; the (3) note[note] parameter to the /htdocs/admin/dict.php?id=10 page; the (4) zip[MAIN_INFO_SOCIETE_ZIP] or email[mail] parameter to the /htdocs/admin/company.php page; the (5) url[defaulturl], field[defaultkey], or value[defaultvalue] parameter to the /htdocs/admin/defaultvalues.php page; the (6) key[transkey] or key[transvalue] parameter to the /htdocs/admin/translation.php page; or the (7) [main_motd] or [main_home] parameter to the /htdocs/admin/ihm.php page.
Product
Dolibarr Erp/crm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com tufangungor.github.io
Jan 21, 2020An Arbitrary File Upload issue in the file browser of DIMO YellowBox CRM before 6.3.4 allows a standard authenticated user to deploy a new WebApp WAR file to thCVE-2019-14768 · Other software · Dimo-crm · reported by MITREHigh 8.8
An Arbitrary File Upload issue in the file browser of DIMO YellowBox CRM before 6.3.4 allows a standard authenticated user to deploy a new WebApp WAR file to the Tomcat server via Path Traversal, allowing remote code execution with SYSTEM privileges.
Product
Yellowbox CRM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com dimo-crm.fr
Jan 21, 2020In DIMO YellowBox CRM before 6.3.4, Path Traversal in images/Apparence (dossier=../) and servletrecuperefichier (document=../) allows an unauthenticated user toCVE-2019-14767 · Other software · Dimo-crm · reported by MITREHigh 7.5
In DIMO YellowBox CRM before 6.3.4, Path Traversal in images/Apparence (dossier=../) and servletrecuperefichier (document=../) allows an unauthenticated user to download arbitrary files from the server.
Product
Yellowbox CRM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com dimo-crm.fr
Jan 21, 2020Path Traversal in the file browser of DIMO YellowBox CRM before 6.3.4 allows a standard authenticated user to browse the server filesystem.CVE-2019-14766 · Other software · Dimo-crm · reported by MITREMedium 6.5
Path Traversal in the file browser of DIMO YellowBox CRM before 6.3.4 allows a standard authenticated user to browse the server filesystem.
Product
Yellowbox CRM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com dimo-crm.fr
Jan 21, 2020Incorrect Access Control in AfficheExplorateurParam() in DIMO YellowBox CRM before 6.3.4 allows a standard authenticated user to use administrative controllers.CVE-2019-14765 · Other software · Dimo-crm · reported by MITREHigh 8.8
Incorrect Access Control in AfficheExplorateurParam() in DIMO YellowBox CRM before 6.3.4 allows a standard authenticated user to use administrative controllers.
Product
Yellowbox CRM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com dimo-crm.fr
Jan 15, 2020Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences).CVE-2020-2657 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.7
Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Supported versions that are affected are 12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle CRM Technical Foundation. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle CRM Technical Foundation, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle CRM Technical Foundation accessible data. CVSS 3.0 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N).
Product
CRM Technical Foundation
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com oracle.com
Jan 15, 2020Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences).CVE-2020-2653 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.2
Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Supported versions that are affected are 12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle CRM Technical Foundation. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle CRM Technical Foundation, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle CRM Technical Foundation accessible data as well as unauthorized update, insert or delete access to some of Oracle CRM Technical Foundation accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).
Product
CRM Technical Foundation
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com oracle.com
Jan 15, 2020Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences).CVE-2020-2652 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.2
Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Supported versions that are affected are 12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle CRM Technical Foundation. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle CRM Technical Foundation, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle CRM Technical Foundation accessible data as well as unauthorized update, insert or delete access to some of Oracle CRM Technical Foundation accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).
Product
CRM Technical Foundation
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com oracle.com
Jan 15, 2020Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences).CVE-2020-2651 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.2
Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Supported versions that are affected are 12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle CRM Technical Foundation. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle CRM Technical Foundation, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle CRM Technical Foundation accessible data as well as unauthorized update, insert or delete access to some of Oracle CRM Technical Foundation accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).
Product
CRM Technical Foundation
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com oracle.com
Jan 15, 2020Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Message Hooks).CVE-2020-2596 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.7
Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Message Hooks). Supported versions that are affected are 12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle CRM Technical Foundation. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle CRM Technical Foundation, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle CRM Technical Foundation accessible data. CVSS 3.0 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N).
Product
CRM Technical Foundation
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com oracle.com
Jan 15, 2020Vulnerability in the Siebel UI Framework product of Oracle Siebel CRM (component: EAI).CVE-2020-2564 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.3
Vulnerability in the Siebel UI Framework product of Oracle Siebel CRM (component: EAI). Supported versions that are affected are 19.10 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel UI Framework. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel UI Framework accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Product
Siebel UI Framework
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com oracle.com
Jan 15, 2020Vulnerability in the Siebel UI Framework product of Oracle Siebel CRM (component: SWSE Server).CVE-2020-2560 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.7
Vulnerability in the Siebel UI Framework product of Oracle Siebel CRM (component: SWSE Server). Supported versions that are affected are 19.10 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel UI Framework. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel UI Framework, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel UI Framework accessible data. CVSS 3.0 Base Score 4.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N).
Product
Siebel UI Framework
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com oracle.com
Jan 15, 2020Vulnerability in the Siebel UI Framework product of Oracle Siebel CRM (component: UIF Open UI).CVE-2020-2559 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.3
Vulnerability in the Siebel UI Framework product of Oracle Siebel CRM (component: UIF Open UI). Supported versions that are affected are 19.7 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel UI Framework. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel UI Framework accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Product
Siebel UI Framework
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com oracle.com
Jan 10, 2020Déjà Vu Crescendo Sales CRM has remote SQL InjectionCVE-2014-4984 · Other software · Dejavuprotech · reported by MITRECritical 9.8
Déjà Vu Crescendo Sales CRM has remote SQL Injection
Product
Crescendo - Sales CRM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record packetstormsecurity.com exchange.xforce.ibmcloud.com
Nov 26, 2019The Zoho CRM Lead Magnet plugin 1.6.9.1 for WordPress allows XSS via module, EditShortcode, or LayoutName.CVE-2019-19306 · WordPress plugins & themes · reported by MITREMedium 5.4
The Zoho CRM Lead Magnet plugin 1.6.9.1 for WordPress allows XSS via module, EditShortcode, or LayoutName.
Affected
1.6.9.1 to 1.6.9.1
What to do
Affects 1.6.9.1 to 1.6.9.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record cybersecurityworks.com github.com
Nov 26, 2019Dolibarr CRM/ERP 10.0.3 allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile picture.CVE-2019-19206 · Other software · Dolibarr · reported by MITREMedium 5.4
Dolibarr CRM/ERP 10.0.3 allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile picture.
Product
Dolibarr Erp/crm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record medium.com dolibarr.org
Nov 21, 2019In Vtiger 7.x before 7.2.0, the My Preferences saving functionality allows a user without administrative privileges to change his own role by adding roleid=H2 tCVE-2019-19202 · Other software · Vtiger · reported by MITREHigh 8.8
In Vtiger 7.x before 7.2.0, the My Preferences saving functionality allows a user without administrative privileges to change his own role by adding roleid=H2 to a POST request.
Product
Vtiger CRM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.vtigercrm.com code.vtiger.com
Nov 20, 2019Dolibarr ERP/CRM 3.3.1 does not properly validate user input in viewimage.php and barcode.lib.php which allows remote attackers to execute arbitrary commands.CVE-2013-2093 · Other software · dolibarr · reported by Red HatCritical 9.8
Dolibarr ERP/CRM 3.3.1 does not properly validate user input in viewimage.php and barcode.lib.php which allows remote attackers to execute arbitrary commands.
Product
dolibarr
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com exchange.xforce.ibmcloud.com
Nov 20, 2019Cross-site Scripting (XSS) in Dolibarr ERP/CRM 3.3.1 allows remote attackers to inject arbitrary web script or HTML in functions.lib.php.CVE-2013-2092 · Other software · dolibarr · reported by Red HatMedium 6.1
Cross-site Scripting (XSS) in Dolibarr ERP/CRM 3.3.1 allows remote attackers to inject arbitrary web script or HTML in functions.lib.php.
Product
dolibarr
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com github.com
Nov 20, 2019SQL injection vulnerability in Dolibarr ERP/CRM 3.3.1 allows remote attackers to execute arbitrary SQL commands via the 'pays' parameter in fiche.php.CVE-2013-2091 · Other software · dolibarr · reported by Red HatCritical 9.8
SQL injection vulnerability in Dolibarr ERP/CRM 3.3.1 allows remote attackers to execute arbitrary SQL commands via the 'pays' parameter in fiche.php.
Product
dolibarr
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record openwall.com exchange.xforce.ibmcloud.com
Nov 5, 2019SuiteCRM 7.10.x versions prior to 7.10.21 and 7.11.x versions prior to 7.11.9 allow SQL Injection.CVE-2019-18784 · Other software · Salesagility · reported by MITRECritical 9.8
SuiteCRM 7.10.x versions prior to 7.10.21 and 7.11.x versions prior to 7.11.9 allow SQL Injection.
Product
Suitecrm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.suitecrm.com docs.suitecrm.com
Oct 29, 2019SugarCRM CE <= 6.3.1 contains scripts that use "unserialize()" with user controlled input which allows remote attackers to execute arbitrary PHP code.CVE-2012-0694 · Other software · Sugarcrm · reported by MITRECritical 9.8
SugarCRM CE <= 6.3.1 contains scripts that use "unserialize()" with user controlled input which allows remote attackers to execute arbitrary PHP code.
Product
Sugarcrm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record seclists.org security-tracker.debian.org
Oct 16, 2019Vulnerability in the Siebel Core - DB Deployment and Configuration product of Oracle Siebel CRM (component: Install - Configuration).CVE-2019-2965 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.5
Vulnerability in the Siebel Core - DB Deployment and Configuration product of Oracle Siebel CRM (component: Install - Configuration). Supported versions that are affected are 19.8 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Core - DB Deployment and Configuration. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel Core - DB Deployment and Configuration accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Product
Siebel Core - DB Deployment and Configuration
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com oracle.com
Oct 16, 2019Vulnerability in the Siebel UI Framework product of Oracle Siebel CRM (component: EAI).CVE-2019-2935 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.3
Vulnerability in the Siebel UI Framework product of Oracle Siebel CRM (component: EAI). Supported versions that are affected are 19.8 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel UI Framework. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Siebel UI Framework accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Product
Siebel UI Framework
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com oracle.com
Oct 16, 2019Vulnerability in the MICROS Relate CRM Software product of Oracle Retail Applications (component: Internal Operations).CVE-2019-2896 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.9
Vulnerability in the MICROS Relate CRM Software product of Oracle Retail Applications (component: Internal Operations). Supported versions that are affected are 7.1.0, 15.0.0, 16.0.0, 17.0.0, and 18.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise MICROS Relate CRM Software. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MICROS Relate CRM Software accessible data. CVSS 3.0 Base Score 5.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
Product
MICROS Relate CRM Software
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record oracle.com oracle.com
Oct 16, 2019An issue was discovered in Dolibarr 10.0.2.CVE-2019-17578 · Other software · Dolibarr · reported by MITREMedium 5.4
An issue was discovered in Dolibarr 10.0.2. It has XSS via the "outgoing email setup" feature in the admin/mails.php?action=edit URI via the "Sender email for automatic emails (default value in php.ini: Undefined)" field.
Product
Dolibarr Erp/crm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mycvee.blogspot.com mycvee.blogspot.com
Oct 16, 2019An issue was discovered in Dolibarr 10.0.2.CVE-2019-17577 · Other software · Dolibarr · reported by MITREMedium 5.4
An issue was discovered in Dolibarr 10.0.2. It has XSS via the "outgoing email setup" feature in the admin/mails.php?action=edit URI via the "Email used for error returns emails (fields 'Errors-To' in emails sent)" field.
Product
Dolibarr Erp/crm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mycvee.blogspot.com mycvee.blogspot.com
Oct 16, 2019An issue was discovered in Dolibarr 10.0.2.CVE-2019-17576 · Other software · Dolibarr · reported by MITREMedium 5.4
An issue was discovered in Dolibarr 10.0.2. It has XSS via the "outgoing email setup" feature in the /admin/mails.php?action=edit URI via the "Send all emails to (instead of real recipients, for test purposes)" field.
Product
Dolibarr Erp/crm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record mycvee.blogspot.com mycvee.blogspot.com
Oct 15, 2019There is HTML Injection in the Note field in Dolibarr ERP/CRM 10.0.2 via user/note.php.CVE-2019-17223 · Other software · Dolibarr · reported by MITREMedium 6.1
There is HTML Injection in the Note field in Dolibarr ERP/CRM 10.0.2 via user/note.php.
Product
Dolibarr Erp/crm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record medium.com dolibarr.org
Oct 8, 2019SAP Customer Relationship Management (Email Management), versions: S4CRM before 1.0 and 2.0, BBPCRM before 7.0, 7.01, 7.02, 7.12, 7.13 and 7.14, does not sufficCVE-2019-0368 · Network & remote access · SAP SE · reported by cna@sap.comMedium 5.4
SAP Customer Relationship Management (Email Management), versions: S4CRM before 1.0 and 2.0, BBPCRM before 7.0, 7.01, 7.02, 7.12, 7.13 and 7.14, does not sufficiently encode user-controlled inputs within the mail client resulting in Cross-Site Scripting vulnerability.
Product
SAP Customer Relationship Management (Email Management - S4CRM)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record launchpad.support.sap.com wiki.scn.sap.com
Oct 7, 2019SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the Configurator module by an Admin user.CVE-2019-17314 · Other software · Sugarcrm · reported by MITREHigh 7.2
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the Configurator module by an Admin user.
Product
Sugarcrm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.sugarcrm.com support.sugarcrm.com
Oct 7, 2019SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the Studio module by a Developer user.CVE-2019-17313 · Other software · Sugarcrm · reported by MITREHigh 8.8
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the Studio module by a Developer user.
Product
Sugarcrm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.sugarcrm.com support.sugarcrm.com
Oct 7, 2019SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the file function by a Regular user.CVE-2019-17312 · Other software · Sugarcrm · reported by MITREHigh 8.8
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the file function by a Regular user.
Product
Sugarcrm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.sugarcrm.com support.sugarcrm.com
Oct 7, 2019SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the attachment function by a Regular user.CVE-2019-17311 · Other software · Sugarcrm · reported by MITREHigh 8.8
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows directory traversal in the attachment function by a Regular user.
Product
Sugarcrm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.sugarcrm.com support.sugarcrm.com
Oct 7, 2019SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Campaigns module by an Admin user.CVE-2019-17310 · Other software · Sugarcrm · reported by MITREHigh 7.2
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Campaigns module by an Admin user.
Product
Sugarcrm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.sugarcrm.com support.sugarcrm.com
Oct 7, 2019SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the EmailMan module by an Admin user.CVE-2019-17309 · Other software · Sugarcrm · reported by MITREHigh 7.2
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the EmailMan module by an Admin user.
Product
Sugarcrm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.sugarcrm.com support.sugarcrm.com
Oct 7, 2019SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Emails module by a Regular user.CVE-2019-17308 · Other software · Sugarcrm · reported by MITREHigh 8.8
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Emails module by a Regular user.
Product
Sugarcrm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.sugarcrm.com support.sugarcrm.com
Oct 7, 2019SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Tracker module by an Admin user.CVE-2019-17307 · Other software · Sugarcrm · reported by MITREHigh 7.2
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Tracker module by an Admin user.
Product
Sugarcrm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.sugarcrm.com support.sugarcrm.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.