rainbutterfly/cve_corpus huggingface dataset:
CVE-2019-17202 
FastTrack Admin By Request 6.1.0.0 supports group policies that are supposed to allow only a select range of users to elevate to Administrator privilege at will. If a user does not have direct access to the elevation feature through group policies, they are prompted to enter a PIN code in a challenge-response manner upon attempting to elevate privileges. The challenge's response uses a simple algorithm that can be easily emulated via data (customer ID and device name) available to all users, and thus any user can elevate to Administrator privilege.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-01-23T00:00:00.000Z
CVE-2019-17203 
TeamPass 2.1.27.36 allows Stored XSS at the Search page by setting a crafted password for an item in any folder.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-05T21:45:09.000Z
CVE-2019-17204 
TeamPass 2.1.27.36 allows Stored XSS by setting a crafted Knowledge Base label and adding any available item.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-05T21:44:58.000Z
CVE-2019-17205 
TeamPass 2.1.27.36 allows Stored XSS by placing a payload in the username field during a login attempt. When an administrator looks at the log of failed logins, the XSS payload will be executed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-05T21:44:26.000Z
CVE-2019-17206 
Uncontrolled deserialization of a pickled object in models.py in Frost Ming rediswrapper (aka Redis Wrapper) before 0.3.0 allows attackers to execute arbitrary scripts.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-05T22:01:24.000Z
CVE-2019-17207 
A reflected XSS vulnerability was found in includes/admin/table-printer.php in the broken-link-checker (aka Broken Link Checker) plugin 1.11.8 for WordPress. This allows unauthorized users to inject client-side JavaScript into an admin-only WordPress page via the wp-admin/tools.php?page=view-broken-links s_filter parameter in a search action.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-18T15:47:35.000Z
CVE-2019-17210 
A denial-of-service issue was discovered in the MQTT library in Arm Mbed OS 2017-11-02. The function readMQTTLenString() is called by the function MQTTDeserialize_publish() to get the length and content of the MQTT topic name. In the function readMQTTLenString(), mqttstring->lenstring.len is a part of user input, which can be manipulated. An attacker can simply change it to a larger value to invalidate the if statement so that the statements inside the if statement are skipped, letting the value of mqttstring->lenstring.data default to zero. Later, curn is accessed, which points to mqttstring->lenstring.data. On an Arm Cortex-M chip, the value at address 0x0 is actually the initialization value for the MSP register. It is highly dependent on the actual firmware. Therefore, the behavior of the program is unpredictable from this time on.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-04T19:48:28.000Z
CVE-2019-17211 
An integer overflow was discovered in the CoAP library in Arm Mbed OS 5.14.0. The function sn_coap_builder_calc_needed_packet_data_size_2() is used to calculate the required memory for the CoAP message from the sn_coap_hdr_s data structure. Both returned_byte_count and src_coap_msg_ptr->payload_len are of type uint16_t. When added together, the result returned_byte_count can wrap around the maximum uint16_t value. As a result, insufficient buffer space is allocated for the corresponding CoAP message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-05T15:06:40.000Z
CVE-2019-17212 
Buffer overflows were discovered in the CoAP library in Arm Mbed OS 5.14.0. The CoAP parser is responsible for parsing received CoAP packets. The function sn_coap_parser_options_parse() parses CoAP input linearly using a while loop. Once an option is parsed in a loop, the current point (*packet_data_pptr) is increased correspondingly. The pointer is restricted by the size of the received buffer, as well as by the 0xFF delimiter byte. Inside each while loop, the check of the value of *packet_data_pptr is not strictly enforced. More specifically, inside a loop, *packet_data_pptr could be increased and then dereferenced without checking. Moreover, there are many other functions in the format of sn_coap_parser_****() that do not check whether the pointer is within the bounds of the allocated buffer. All of these lead to heap-based or stack-based buffer overflows, depending on how the CoAP packet buffer is allocated.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-05T14:53:22.000Z
CVE-2019-17213 
The WebARX plugin 1.3.0 for WordPress has unauthenticated stored XSS via the URI or the X-Forwarded-For HTTP header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-06T13:22:18.000Z
CVE-2019-17214 
The WebARX plugin 1.3.0 for WordPress allows firewall bypass by appending &cc=1 to a URI.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-06T13:21:37.000Z
CVE-2019-17215 
An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. There is no bruteforce protection (e.g., lockout) established. An attacker might be able to bruteforce the password to authenticate on the device.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-06T15:24:12.000Z
CVE-2019-17216 
An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. Password authentication uses MD5 to hash passwords. Cracking is possible with minimal effort.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-06T15:24:00.000Z
CVE-2019-17217 
An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. There is no CSRF protection established on the web service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-06T15:23:52.000Z
CVE-2019-17218 
An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. By default, the communication to the web service is unencrypted via http. An attacker is able to intercept and sniff communication to the web service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-06T15:23:44.000Z
CVE-2019-17219 
An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ethernet R07 and before WLAN R05. By default, the device does not enforce any authentication. An adjacent attacker is able to use the network interface without proper access control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-06T15:23:35.000Z
CVE-2019-17220 
Rocket.Chat before 2.1.0 allows XSS via a URL on a ![title] line.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-21T20:12:50.000Z
CVE-2019-17221 
PhantomJS through 2.1.1 has an arbitrary file read vulnerability, as demonstrated by an XMLHttpRequest for a file:// URI. The vulnerability exists in the page.open() function of the webpage module, which loads a specified URL and calls a given callback. An attacker can supply a specially crafted HTML file, as user input, that allows reading arbitrary files on the filesystem. For example, if page.render() is the function callback, this generates a PDF or an image of the targeted file. NOTE: this product is no longer developed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-05T13:10:45.000Z
CVE-2019-17222 
An issue was discovered on Intelbras WRN 150 1.0.17 devices. There is stored XSS in the Service Name tab of the WAN configuration screen, leading to a denial of service (inability to change the configuration).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-07T15:03:12.000Z
CVE-2019-17223 
There is HTML Injection in the Note field in Dolibarr ERP/CRM 10.0.2 via user/note.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-15T11:59:29.000Z
CVE-2019-17224 
The web interface of the Compal Broadband CH7465LG modem (version CH7465LG-NCIP-6.12.18.25-2p6-NOSH) is vulnerable to a /%2f/ path traversal attack, which can be exploited in order to test for the existence of a file pathname outside of the web root directory. If a file exists but is not part of the product, there is a 404 error. If a file does not exist, there is a 302 redirect to index.html.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-28T14:31:30.000Z
CVE-2019-17225 
Subrion 4.2.1 allows XSS via the panel/members/ Username, Full Name, or Email field, aka an "Admin Member JSON Update" issue.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-06T16:46:48.000Z
CVE-2019-17226 
CMS Made Simple (CMSMS) 2.2.11 allows XSS via the Site Admin > Module Manager > Search Term field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-06T17:04:36.000Z
CVE-2019-17228 
includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress allows unauthenticated options changes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-24T18:25:34.000Z
CVE-2019-17229 
includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress has multiple stored XSS issues.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-24T18:25:37.000Z
CVE-2019-17230 
includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress allows unauthenticated options changes.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-03T14:16:16.000Z
CVE-2019-17231 
includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress has multiple stored XSS issues.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-04-03T14:16:12.000Z
CVE-2019-17232 
Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows unauthenticated options import.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T22:11:30.000Z
CVE-2019-17233 
Functions/EWD_UFAQ_Import.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T22:11:20.000Z
CVE-2019-17234 
includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows unauthenticated arbitrary file deletion.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-12T16:48:54.000Z
CVE-2019-17235 
includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows information disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-12T16:50:29.000Z
CVE-2019-17236 
includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress is vulnerable to stored XSS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-12T16:52:46.000Z
CVE-2019-17237 
includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress allows CSRF.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-11-12T16:53:32.000Z
CVE-2019-17239 
includes/settings/class-alg-download-plugins-settings.php in the download-plugins-dashboard plugin through 1.5.0 for WordPress has multiple unauthenticated stored XSS issues.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T21:28:52.000Z
CVE-2019-17240 
bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-For or Client-IP HTTP headers.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-06T18:32:20.000Z
CVE-2019-17241 
IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x000000000000d563.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T11:18:17.000Z
CVE-2019-17242 
IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x000000000000966f.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T11:18:24.000Z
CVE-2019-17243 
IrfanView 4.53 allows Data from a Faulting Address to control Code Flow starting at JPEG_LS+0x0000000000003155.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T11:18:32.000Z
CVE-2019-17244 
IrfanView 4.53 allows Data from a Faulting Address to control Code Flow starting at JPEG_LS+0x0000000000001d8a.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T11:18:48.000Z
CVE-2019-17245 
IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x0000000000004359.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T11:18:54.000Z
CVE-2019-17246 
IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x000000000000258c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T11:19:01.000Z
CVE-2019-17247 
IrfanView 4.53 allows Data from a Faulting Address to control a subsequent Write Address starting at JPEG_LS+0x0000000000007da8.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T11:19:08.000Z
CVE-2019-17248 
IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x00000000000025b6.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T11:19:14.000Z
CVE-2019-17249 
IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x000000000000d57b.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T11:19:22.000Z
CVE-2019-17250 
IrfanView 4.53 allows a User Mode Write AV starting at WSQ!ReadWSQ+0x00000000000042f5.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T11:19:30.000Z
CVE-2019-17251 
IrfanView 4.53 allows a User Mode Write AV starting at FORMATS!GetPlugInInfo+0x0000000000007d43.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T11:19:37.000Z
CVE-2019-17252 
IrfanView 4.53 allows a User Mode Write AV starting at FORMATS!Read_BadPNG+0x0000000000000115.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T11:19:45.000Z
CVE-2019-17253 
IrfanView 4.53 allows a User Mode Write AV starting at JPEG_LS+0x000000000000a6b8.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T11:19:52.000Z
CVE-2019-17254 
IrfanView 4.53 allows Data from a Faulting Address to control a subsequent Write Address starting at FORMATS!Read_BadPNG+0x0000000000000101.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T11:19:59.000Z
CVE-2019-17255 
IrfanView 4.53 allows a User Mode Write AV starting at EXR!ReadEXR+0x0000000000010836.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T11:20:05.000Z
CVE-2019-17256 
IrfanView 4.53 allows a User Mode Write AV starting at DPX!ReadDPX_W+0x0000000000001203.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T11:20:12.000Z
CVE-2019-17257 
IrfanView 4.53 allows a Exception Handler Chain to be Corrupted starting at EXR!ReadEXR+0x000000000002af80.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T11:20:19.000Z
CVE-2019-17258 
IrfanView 4.53 allows Data from a Faulting Address to control a subsequent Write Address starting at JPEG_LS+0x000000000000839c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T11:20:26.000Z
CVE-2019-17259 
KMPlayer 4.2.2.31 allows a User Mode Write AV starting at utils!src_new+0x000000000014d6ee.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T11:14:57.000Z
CVE-2019-17260 
MPC-HC through 1.7.13 allows a Read Access Violation on a Block Data Move starting at mpc_hc!memcpy+0x000000000000004e.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T11:15:32.000Z
CVE-2019-17261 
XnView Classic 2.49.1 allows a User Mode Write AV starting at Xwsq+0x0000000000001e51.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T11:16:04.000Z
CVE-2019-17262 
XnView Classic 2.49.1 allows a User Mode Write AV starting at Xwsq+0x0000000000001fc0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T11:16:26.000Z
CVE-2019-17263 
In libyal libfwsi before 20191006, libfwsi_extension_block_copy_from_byte_stream in libfwsi_extension_block.c has a heap-based buffer over-read because rejection of an unsupported size only considers values less than 6, even though values of 6 and 7 are also unsupported. NOTE: the vendor has disputed this as described in the GitHub issue
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-06T21:16:50.000Z
CVE-2019-17264 
In libyal liblnk before 20191006, liblnk_location_information_read_data in liblnk_location_information.c has a heap-based buffer over-read because an incorrect variable name is used for a certain offset. NOTE: the vendor has disputed this as described in the GitHub issue
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-06T21:17:07.000Z
CVE-2019-17266 
libsoup from versions 2.65.1 until 2.68.1 have a heap-based buffer over-read because soup_ntlm_parse_challenge() in soup-auth-ntlm.c does not properly check an NTLM message's length before proceeding with a memcpy.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-06T21:48:18.000Z
CVE-2019-17267 
A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-06T23:08:53.000Z
CVE-2019-17268 
The omniauth-weibo-oauth2 gem 0.4.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions through 0.4.5, and 0.5.1 and later, are unaffected.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2020-02-07T13:51:01.000Z
CVE-2019-17269 
Intellian Remote Access 3.18 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the Ping Test field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-06T23:39:47.000Z
CVE-2019-17270 
Yachtcontrol through 2019-10-06: It's possible to perform direct Operating System commands as an unauthenticated user via the "/pages/systemcall.php?command={COMMAND}" page and parameter, where {COMMAND} will be executed and returning the results to the client. Affects Yachtcontrol webservers disclosed via Dutch GPRS/4G mobile IP-ranges. IP addresses vary due to DHCP client leasing of telco's.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-12-10T20:48:37.000Z
CVE-2019-17271 
vBulletin 5.5.4 allows SQL Injection via the ajax/api/hook/getHookList or ajax/api/widget/getWidgetList where parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-08T12:26:48.000Z
CVE-2019-17272 
All versions of ONTAP Select Deploy administration utility are susceptible to a vulnerability which when successfully exploited could allow an administrative user to escalate their privileges.
Problem types: description: Privilege Escalation
Affected products: vendor: NetApp
product: ONTAP Select Deploy administration utility
Published: 2019-11-21T15:40:03.000Z
CVE-2019-17273 
E-Series SANtricity OS Controller Software version 11.60.0 is susceptible to a vulnerability which allows an attacker to cause a Denial of Service (DoS) in IPv6 environments.
Problem types: description: Denial of Service
Affected products: vendor: NetApp
product: E-Series SANtricity OS Controller Software
Published: 2020-01-30T17:47:00.000Z
CVE-2019-17274 
NetApp FAS 8300/8700 and AFF A400 Baseboard Management Controller (BMC) firmware versions 13.x prior to 13.1P1 were shipped with a default account enabled that could allow unauthorized arbitrary command execution via local access.
Problem types: description: Default Privileged Account
Affected products: vendor: NetApp
product: NetApp FAS 8300/8700 and AFF A400 Baseboard Management Controller
Published: 2020-02-26T17:38:35.000Z
CVE-2019-17275 
OnCommand Cloud Manager versions prior to 3.8.0 are susceptible to arbitrary code execution by remote attackers.
Problem types: description: Arbitrary Code Execution
Affected products: vendor: NetApp
product: OnCommand Cloud Manager
Published: 2020-02-26T17:44:06.000Z
CVE-2019-17276 
OnCommand System Manager versions 9.3 prior to 9.3P18 and 9.4 prior to 9.4P2 are susceptible to a cross site scripting vulnerability that could allow an authenticated attacker to inject arbitrary scripts into the SNMP Community Names label field.
Problem types: description: Cross-Site Scripting
Affected products: vendor: n/a
product: OnCommand System Manager 9.x
Published: 2020-03-24T17:44:11.000Z
CVE-2019-17292 
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmse_Inbox module by an Admin user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T15:06:12.000Z
CVE-2019-17293 
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the pmse_Project module by a Regular user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T15:06:03.000Z
CVE-2019-17294 
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the export function by a Regular user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T15:05:55.000Z
CVE-2019-17295 
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the history function by a Regular user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T15:05:43.000Z
CVE-2019-17296 
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Contacts module by a Regular user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T15:05:35.000Z
CVE-2019-17297 
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Quotes module by a Regular user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T15:05:24.000Z
CVE-2019-17298 
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows SQL injection in the Administration module by a Developer user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T15:05:16.000Z
CVE-2019-17299 
SugarCRM before 8.0.4 and 9.x before 9.0.2 allows PHP code injection in the Administration module by an Admin user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2019-10-07T15:05:07.000Z