# fat\_free\_crm (RubyGems) vulnerabilities

10 known vulnerabilities (1 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://rubygems.org/gems/fat_free_crm

## Advisories (10)

### [CVE-2022-39281](https://cve.now/CVE-2022-39281): Remote Denial of Service via Tasks endpoint in fat\_free\_crm

- Severity: Medium 6.5
- Published: Oct 8, 2022
- Affected: fixed in 0.20.1.

### [CVE-2018-20975](https://cve.now/CVE-2018-20975): Fat Free CRM before 0.18.1 has XSS in the tags\_helper in app/helpers/tags\_helper.rb.

- Severity: Unrated
- Published: Aug 20, 2019
- Affected: fixed in 0.18.1.

### [CVE-2018-1000842](https://cve.now/CVE-2018-1000842): FatFreeCRM version \<=0.14.1, \>=0.15.0 \<=0.15.1, \>=0.16.0 \<=0.16.3, \>=0.17.0 \<=0.17.2, ==0.18.0 contains a Cross Site Scripting (XSS)…

- Severity: Unrated
- Published: Dec 20, 2018
- Affected: fixed in 0.14.2; from 0.15.0, fixed in 0.15.2; from 0.16.0, fixed in 0.16.4; from 0.17.0, fixed in 0.17.3; from 0.18.0, fixed in 0.18.1.

### [CVE-2015-1585](https://cve.now/CVE-2015-1585): Fat Free CRM before 0.13.6 allows remote attackers to conduct cross-site request forgery (CSRF) attacks via a request without the…

- Severity: Unrated
- Published: Feb 19, 2015
- Affected: fixed in 0.13.6.

### [CVE-2014-5441](https://cve.now/CVE-2014-5441): Multiple cross-site scripting (XSS) vulnerabilities in app/views/layouts/application.html.haml in Fat Free CRM before 0.13.3 allow remote…

- Severity: Unrated
- Published: Sep 12, 2014
- Affected: from 0.11.1, fixed in 0.13.3.

### [CVE-2013-7249](https://cve.now/CVE-2013-7249): Fat Free CRM before 0.12.1 does not restrict XML serialization, which allows remote attackers to obtain sensitive information via a direct…

- Severity: Unrated
- Published: Jan 2, 2014
- Affected: fixed in 0.12.1.

### [CVE-2013-7225](https://cve.now/CVE-2013-7225): Multiple SQL injection vulnerabilities in app/controllers/home\_controller.rb in Fat Free CRM before 0.12.1 allow remote authenticated…

- Severity: Unrated
- Published: Jan 2, 2014
- Affected: fixed in 0.12.1.

### [CVE-2013-7224](https://cve.now/CVE-2013-7224): Fat Free CRM before 0.12.1 does not restrict JSON serialization, which allows remote attackers to obtain sensitive information via a…

- Severity: Unrated
- Published: Jan 2, 2014
- Affected: fixed in 0.12.1.

### [CVE-2013-7223](https://cve.now/CVE-2013-7223): Multiple cross-site request forgery (CSRF) vulnerabilities in Fat Free CRM before 0.12.1 allow remote attackers to hijack the…

- Severity: Unrated
- Published: Jan 2, 2014
- Affected: fixed in 0.12.1.

### [CVE-2013-7222](https://cve.now/CVE-2013-7222): config/initializers/secret\_token.rb in Fat Free CRM before 0.12.1 has a fixed FatFreeCRM::Application.config.secret\_token value, which…

- Severity: Unrated
- Published: Jan 2, 2014
- Affected: fixed in 0.12.1.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/rubygems/fat_free_crm
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.