Skip to main content
cve.nowby Sazabi
← RubyGems
RubyGemsPackage

fat_free_crm

10 known vulnerabilities (1 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
10 · 1 medium
Registry
RubyGems

Advisories 10

  • CVE-2022-39281Medium 6.5

    Remote Denial of Service via Tasks endpoint in fat_free_crm

    Affected: fixed in 0.20.1.

  • Fat Free CRM before 0.18.1 has XSS in the tags_helper in app/helpers/tags_helper.rb.

    Affected: fixed in 0.18.1.

  • FatFreeCRM version <=0.14.1, >=0.15.0 <=0.15.1, >=0.16.0 <=0.16.3, >=0.17.0 <=0.17.2, ==0.18.0 contains a Cross Site Scripting (XSS)…

    Affected: fixed in 0.14.2; from 0.15.0, fixed in 0.15.2; from 0.16.0, fixed in 0.16.4; from 0.17.0, fixed in 0.17.3; from 0.18.0, fixed in 0.18.1.

  • Fat Free CRM before 0.13.6 allows remote attackers to conduct cross-site request forgery (CSRF) attacks via a request without the…

    Affected: fixed in 0.13.6.

  • Multiple cross-site scripting (XSS) vulnerabilities in app/views/layouts/application.html.haml in Fat Free CRM before 0.13.3 allow remote…

    Affected: from 0.11.1, fixed in 0.13.3.

  • Fat Free CRM before 0.12.1 does not restrict XML serialization, which allows remote attackers to obtain sensitive information via a direct…

    Affected: fixed in 0.12.1.

  • Multiple SQL injection vulnerabilities in app/controllers/home_controller.rb in Fat Free CRM before 0.12.1 allow remote authenticated…

    Affected: fixed in 0.12.1.

  • Fat Free CRM before 0.12.1 does not restrict JSON serialization, which allows remote attackers to obtain sensitive information via a…

    Affected: fixed in 0.12.1.

  • Multiple cross-site request forgery (CSRF) vulnerabilities in Fat Free CRM before 0.12.1 allow remote attackers to hijack the…

    Affected: fixed in 0.12.1.

  • config/initializers/secret_token.rb in Fat Free CRM before 0.12.1 has a fixed FatFreeCRM::Application.config.secret_token value, which…

    Affected: fixed in 0.12.1.