Yetiforce Customer Relationship Management vulnerabilities

18 known vulnerabilities affecting yetiforce/yetiforce_customer_relationship_management.

Total CVEs

CISA KEV

Public exploits

Exploited in wild

Severity breakdown

HIGH1MEDIUM17

Vulnerabilities

Page 1 of 1

CVE-2023-49508MEDIUMCVSS 6.5fixed in 6.5.02024-02-16

CVE-2023-49508 [MEDIUM] CWE-22 CVE-2023-49508: Directory Traversal vulnerability in YetiForceCompany YetiForceCRM versions 6.4.0 and before allows Directory Traversal vulnerability in YetiForceCompany YetiForceCRM versions 6.4.0 and before allows a remote authenticated attacker to obtain sensitive information via the license parameter in the LibraryLicense.php component.

nvd

CVE-2022-3002MEDIUMCVSS 5.4fixed in 6.4.02022-10-06

CVE-2022-3002 [MEDIUM] CWE-79 CVE-2022-3002: Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4. Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.

nvd

CVE-2022-3000MEDIUMCVSS 5.4fixed in 6.4.02022-09-20

CVE-2022-3000 [MEDIUM] CWE-79 CVE-2022-3000: Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4. Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.

nvd

CVE-2022-2924MEDIUMCVSS 5.4fixed in 6.3.02022-09-20

CVE-2022-2924 [MEDIUM] CWE-79 CVE-2022-2924: Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.3. Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.3.

nvd

CVE-2022-3004MEDIUMCVSS 5.4fixed in 6.4.02022-09-20

CVE-2022-3004 [MEDIUM] CWE-79 CVE-2022-3004: Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4. Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.

nvd

CVE-2022-3005MEDIUMCVSS 5.4fixed in 6.4.02022-09-20

CVE-2022-3005 [MEDIUM] CWE-79 CVE-2022-3005: Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4. Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.

nvd

CVE-2022-2829MEDIUMCVSS 5.4fixed in 6.4.02022-08-23

CVE-2022-2829 [MEDIUM] CWE-79 CVE-2022-2829: Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4. Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.

nvd

CVE-2022-1340MEDIUMCVSS 5.4fixed in 6.4.02022-08-22

CVE-2022-1340 [MEDIUM] CWE-79 CVE-2022-1340: Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4. Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.

nvd

CVE-2022-2890MEDIUMCVSS 5.4fixed in 6.4.02022-08-22

CVE-2022-2890 [MEDIUM] CWE-79 CVE-2022-2890: Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4. Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.

nvd

CVE-2022-2885MEDIUMCVSS 4.8fixed in 6.4.02022-08-21

CVE-2022-2885 [MEDIUM] CWE-79 CVE-2022-2885: Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4. Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.

nvd

CVE-2022-1411MEDIUMCVSS 6.1fixed in 6.4.02022-05-05

CVE-2022-1411 [MEDIUM] CWE-434 CVE-2022-1411: Unrestructed file upload in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Attacker Unrestructed file upload in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Attacker can send malicious files to the victims is able to retrieve the stored data from the web application without that data being made safe to render in the browser and steals victim's cookie leads to account takeover.

nvd

CVE-2022-0269HIGHCVSS 8.0fixed in 6.3.02022-01-24

CVE-2022-0269 [HIGH] CWE-352 CVE-2022-0269: Cross-Site Request Forgery (CSRF) in Packagist yetiforce/yetiforce-crm prior to 6.3.0. Cross-Site Request Forgery (CSRF) in Packagist yetiforce/yetiforce-crm prior to 6.3.0.

nvd

CVE-2021-4121MEDIUMCVSS 6.1≤ 6.3.02021-12-16

CVE-2021-4121 [MEDIUM] CWE-79 CVE-2021-4121: yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-si yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

nvd

CVE-2021-4117MEDIUMCVSS 4.3≤ 6.3.02021-12-15

CVE-2021-4117 [MEDIUM] CWE-840 CVE-2021-4117: yetiforcecrm is vulnerable to Business Logic Errors yetiforcecrm is vulnerable to Business Logic Errors

nvd

CVE-2021-4111MEDIUMCVSS 4.3≤ 6.3.02021-12-15

CVE-2021-4111 [MEDIUM] CWE-840 CVE-2021-4111: yetiforcecrm is vulnerable to Business Logic Errors yetiforcecrm is vulnerable to Business Logic Errors

nvd

CVE-2021-4116MEDIUMCVSS 5.4≤ 6.3.02021-12-15

CVE-2021-4116 [MEDIUM] CWE-79 CVE-2021-4116: yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-si yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

nvd

CVE-2021-4107MEDIUMCVSS 6.1≤ 6.3.02021-12-14

CVE-2021-4107 [MEDIUM] CWE-79 CVE-2021-4107: yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-si yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

nvd

CVE-2021-4092MEDIUMCVSS 4.3fixed in 6.3.02021-12-11

CVE-2021-4092 [MEDIUM] CWE-352 CVE-2021-4092: yetiforcecrm is vulnerable to Cross-Site Request Forgery (CSRF) yetiforcecrm is vulnerable to Cross-Site Request Forgery (CSRF)

nvd