6.1.1

DATE	CVE	VULNERABILITY TITLE	RISK
2011-12-15	CVE-2011-4833	SQL Injection vulnerability in Sugarcrm Multiple SQL injection vulnerabilities in the Leads module in SugarCRM 6.1 before 6.1.7, 6.2 before 6.2.4, 6.3 before 6.3.0RC3, and 6.4 before 6.4.0beta1 allow remote attackers to execute arbitrary SQL commands via the (1) where and (2) order parameters in a get_full_list action to index.php. network low complexity sugarcrm CWE-89	7.5
2011-03-16	CVE-2011-0745	Improper Input Validation vulnerability in Sugarcrm SugarCRM before 6.1.3 does not properly handle reloads and direct requests for a warning page produced by a certain duplicate check, which allows remote authenticated users to discover (1) the names of customers via a ShowDuplicates action to the Accounts module, reachable through index.php; or (2) the names of contact persons via a ShowDuplicates action to the Contacts module, reachable through index.php. network low complexity sugarcrm CWE-20	4.0