Fatfreecrm
Fatfreecrm FAT Free CRM: vulnerabilidades y CVE
Fatfreecrm FAT Free CRM tiene 9 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 0 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE9
Últimos 12 meses0
Críticas0
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2018-20975 | Media (6.1) | 1.2% | — | 20 ago 2019 | Fat Free CRM before 0.18.1 has XSS in the tags_helper in app/helpers/tags_helper.rb. |
| CVE-2019-10226 | Media (5.4) | 4.7% | — | 10 jun 2019 | HTML Injection has been discovered in the v0.19.0 version of the Fat Free CRM product via an authenticated request to the /comments URI. NOTE: the vendor disputes the significance of this report because some HTML… |
| CVE-2015-1585 | Media (6.8) | 1.1% | — | 19 feb 2015 | Fat Free CRM before 0.13.6 allows remote attackers to conduct cross-site request forgery (CSRF) attacks via a request without the authenticity_token, as demonstrated by a crafted HTML page that creates a new… |
| CVE-2014-5441 | Media (4.3) | 1.9% | — | 12 sept 2014 | Multiple cross-site scripting (XSS) vulnerabilities in app/views/layouts/application.html.haml in Fat Free CRM before 0.13.3 allow remote attackers to inject arbitrary web script or HTML via the (1) username, (2) first… |
| CVE-2013-7249 | Media (5) | 2.6% | — | 2 ene 2014 | Fat Free CRM before 0.12.1 does not restrict XML serialization, which allows remote attackers to obtain sensitive information via a direct request, as demonstrated by a request for users/1.xml, a different vulnerability… |
| CVE-2013-7225 | Media (6.5) | 1.9% | — | 2 ene 2014 | Multiple SQL injection vulnerabilities in app/controllers/home_controller.rb in Fat Free CRM before 0.12.1 allow remote authenticated users to execute arbitrary SQL commands via (1) the homepage timeline feature or (2)… |
| CVE-2013-7224 | Media (5) | 2.5% | — | 2 ene 2014 | Fat Free CRM before 0.12.1 does not restrict JSON serialization, which allows remote attackers to obtain sensitive information via a direct request, as demonstrated by a request for users/1.json. |
| CVE-2013-7223 | Media (6.8) | 1.2% | — | 2 ene 2014 | Multiple cross-site request forgery (CSRF) vulnerabilities in Fat Free CRM before 0.12.1 allow remote attackers to hijack the authentication of unspecified victims via unknown vectors, related to the lack of a… |
| CVE-2013-7222 | Media (5) | 2.4% | — | 2 ene 2014 | config/initializers/secret_token.rb in Fat Free CRM before 0.12.1 has a fixed FatFreeCRM::Application.config.secret_token value, which makes it easier for remote attackers to spoof signed cookies by referring to the key… |