TI-2019-10791 CVE-2019-14472 · GHSA-fv58-wq42-9xxc
Zurmo 3.2.7-2 has XSS via the app/index.php/zurmo/default PATH_INFO.
Priority LOW 29
Zurmo 3.2.7-2 has XSS via the app/index.php/zurmo/default PATH_INFO.
Zurmo
Records9All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9
Exploited now
Zurmo records in CISA KEVNo Zurmo vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
9 records
TI-2018-11939 CVE-2018-16654 · GHSA-wf8x-hmr2-hwcp
Zurmo 3.2.4 Stable allows XSS via app/index.php/accounts/default/details?id=2&kanbanBoard=1&openToTaskId=1.
Priority LOW 29
Zurmo 3.2.4 Stable allows XSS via app/index.php/accounts/default/details?id=2&kanbanBoard=1&openToTaskId=1.
TI-2017-04884 CVE-2017-7188 · GHSA-f568-8xjv-v824
Zurmo 3.1.1 Stable allows a Cross-Site Scripting (XSS) attack with a base64-encoded…
Priority LOW 27
Zurmo 3.1.1 Stable allows a Cross-Site Scripting (XSS) attack with a base64-encoded SCRIPT element within a data: URL in the returnUrl parameter to default/toggleCollapse.
TI-2017-13214 CVE-2017-18004 · GHSA-9c8c-gm9g-cpf3
Zurmo 3.2.3 allows XSS via the latitude or longitude parameter to maps/default/mapAndPoint.
Priority LOW 25
Zurmo 3.2.3 allows XSS via the latitude or longitude parameter to maps/default/mapAndPoint.
TI-2018-13890 CVE-2018-19596 · GHSA-vwcq-8p9q-4p7m
Zurmo 3.2.4 allows HTML Injection via an admin's use of HTML in the report section, a related issue to CVE-2018-19506.
Priority LOW 23
Zurmo 3.2.4 allows HTML Injection via an admin's use of HTML in the report section, a related issue to CVE-2018-19506.
TI-2018-13811 CVE-2018-19506 · GHSA-gq62-j432-7wc3
Zurmo 3.2.4 has XSS via an admin's use of the name parameter in the reports section, aka…
Priority LOW 23
Zurmo 3.2.4 has XSS via an admin's use of the name parameter in the reports section, aka the app/index.php/reports/default/details?id=1 URI.
TI-2017-12180 CVE-2017-16569 · GHSA-9fpr-8cm5-jhjr
An Open URL Redirect issue exists in Zurmo 3.2.1.57987acc3018 via an http: URL in the…
Priority LOW 23
An Open URL Redirect issue exists in Zurmo 3.2.1.57987acc3018 via an http: URL in the redirectUrl parameter to app/index.php/meetings/default/createMeeting.
TI-2017-11039 CVE-2017-15039 · GHSA-j7hj-87mj-49qj
Cross-site scripting (XSS) exists in Zurmo 3.2.1.57987acc3018 via a data: URL in the…
Priority LOW 23
Cross-site scripting (XSS) exists in Zurmo 3.2.1.57987acc3018 via a data: URL in the redirectUrl parameter to app/index.php/meetings/default/createMeeting.
TI-2015-04519 CVE-2015-5365 · GHSA-mmmg-v2cp-x4xq
Cross-site scripting (XSS) vulnerability in Zurmo CRM 3.0.2 allows remote authenticated…
Priority LOW 19
Cross-site scripting (XSS) vulnerability in Zurmo CRM 3.0.2 allows remote authenticated users to inject arbitrary web script or HTML via the "What's going on?" profile field.