fatfreecrm fatfreecrm vulnerabilities and exploits

(subscribe to this query)

4.3

CVSSv2

FatFreeCRM version <=0.14.1, >=0.15.0 <=0.15.1, >=0.16.0 <=0.16.3, >=0.17.0 <=0.17.2, ==0.18.0 contains a Cross Site Scripting (XSS) vulnerability in commit 6d60bc8ed010c4eda05d6645c64849f415f68d65 that can result in Javascript execution. This attack appear t...

Fatfreecrm Fatfreecrm Fatfreecrm Fatfreecrm 0.18.0

5

CVSSv2

Fat Free CRM prior to 0.12.1 does not restrict JSON serialization, which allows remote malicious users to obtain sensitive information via a direct request, as demonstrated by a request for users/1.json.

Fatfreecrm Fat Free Crm Fatfreecrm Fat Free Crm 0.9.8 Fatfreecrm Fat Free Crm 0.9.6 Fatfreecrm Fat Free Crm 0.11.1 Fatfreecrm Fat Free Crm 0.11.0 Fatfreecrm Fat Free Crm 0.10.1 Fatfreecrm Fat Free Crm 0.9.10 Fatfreecrm Fat Free Crm 0.11.2 Fatfreecrm Fat Free Crm 0.9.9 Fatfreecrm Fat Free Crm 0.9.7

5

CVSSv2

config/initializers/secret_token.rb in Fat Free CRM prior to 0.12.1 has a fixed FatFreeCRM::Application.config.secret_token value, which makes it easier for remote malicious users to spoof signed cookies by referring to the key in the source code.

Fatfreecrm Fat Free Crm 0.11.2 Fatfreecrm Fat Free Crm 0.9.9 Fatfreecrm Fat Free Crm 0.9.7 Fatfreecrm Fat Free Crm 0.11.1 Fatfreecrm Fat Free Crm 0.11.0 Fatfreecrm Fat Free Crm 0.10.1 Fatfreecrm Fat Free Crm 0.9.10 Fatfreecrm Fat Free Crm Fatfreecrm Fat Free Crm 0.9.8 Fatfreecrm Fat Free Crm 0.9.6

6.8

CVSSv2

Multiple cross-site request forgery (CSRF) vulnerabilities in Fat Free CRM prior to 0.12.1 allow remote malicious users to hijack the authentication of unspecified victims via unknown vectors, related to the lack of a protect_from_forgery line in app/controllers/application_contr...

Fatfreecrm Fat Free Crm 0.11.2 Fatfreecrm Fat Free Crm 0.11.0 Fatfreecrm Fat Free Crm 0.9.10 Fatfreecrm Fat Free Crm 0.9.9 Fatfreecrm Fat Free Crm 0.9.8 Fatfreecrm Fat Free Crm 0.9.7 Fatfreecrm Fat Free Crm Fatfreecrm Fat Free Crm 0.11.1 Fatfreecrm Fat Free Crm 0.10.1 Fatfreecrm Fat Free Crm 0.9.6

6.5

CVSSv2

Multiple SQL injection vulnerabilities in app/controllers/home_controller.rb in Fat Free CRM prior to 0.12.1 allow remote authenticated users to execute arbitrary SQL commands via (1) the homepage timeline feature or (2) the activity feature.

Fatfreecrm Fat Free Crm 0.11.0 Fatfreecrm Fat Free Crm 0.9.10 Fatfreecrm Fat Free Crm Fatfreecrm Fat Free Crm 0.11.2 Fatfreecrm Fat Free Crm 0.11.1 Fatfreecrm Fat Free Crm 0.9.8 Fatfreecrm Fat Free Crm 0.9.7 Fatfreecrm Fat Free Crm 0.9.6 Fatfreecrm Fat Free Crm 0.10.1 Fatfreecrm Fat Free Crm 0.9.9

5

CVSSv2

Fat Free CRM prior to 0.12.1 does not restrict XML serialization, which allows remote malicious users to obtain sensitive information via a direct request, as demonstrated by a request for users/1.xml, a different vulnerability than CVE-2013-7224.

Fatfreecrm Fat Free Crm 0.10.1 Fatfreecrm Fat Free Crm 0.9.10 Fatfreecrm Fat Free Crm 0.9.9 Fatfreecrm Fat Free Crm 0.9.8 Fatfreecrm Fat Free Crm Fatfreecrm Fat Free Crm 0.11.1 Fatfreecrm Fat Free Crm 0.9.6 Fatfreecrm Fat Free Crm 0.9.7 Fatfreecrm Fat Free Crm 0.11.2 Fatfreecrm Fat Free Crm 0.11.0

NA

fat_free_crm is a an open source, Ruby on Rails customer relationship management platform (CRM). In versions before 0.20.1 an authenticated user can perform a remote Denial of Service attack against Fat Free CRM via bucket access. The vulnerability has been patched in commit `c85...

Fatfreecrm Fatfreecrm

4.3

CVSSv2

Multiple cross-site scripting (XSS) vulnerabilities in app/views/layouts/application.html.haml in Fat Free CRM prior to 0.13.3 allow remote malicious users to inject arbitrary web script or HTML via the (1) username, (2) first name, or (3) last name in a (a) create or (b) edit us...

Fatfreecrm Fat Free Crm 0.11.1 Fatfreecrm Fat Free Crm 0.11.4 Fatfreecrm Fat Free Crm 0.12.0 Fatfreecrm Fat Free Crm 0.12.1 Fatfreecrm Fat Free Crm Fatfreecrm Fat Free Crm 0.11.2

6.8

CVSSv2

Fat Free CRM prior to 0.13.6 allows remote malicious users to conduct cross-site request forgery (CSRF) attacks via a request without the authenticity_token, as demonstrated by a crafted HTML page that creates a new administrator account.

Fatfreecrm Fat Free Crm

4.3

CVSSv2

Fat Free CRM prior to 0.18.1 has XSS in the tags_helper in app/helpers/tags_helper.rb.

Fatfreecrm Fat Free Crm

Get Started

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook