70 matches found
Cross-site Scripting (XSS)
yetiforce/yetiforce-crm is vulnerable to cross-site scripting. The vulnerability exists because the library type recordModel Text parameter does not properly validate or encode in slaPolicy module settings, allowing an attacker to inject and execute malicious javascript...
Stored Cross-site Scripting (XSS)
yetiforce/yetiforce-crm is vulnerable to stored cross-site scriptingXSS attacks. The library does not properly escape fieldModel-label parameter in LayoutEditor and it is used directly without any encoding or validation on LayoutEditor/EditField.tpl, allowing an attacker to inject and execute...
GHSA-2QF8-H7PR-X2R8 YetiForce CRM vulnerable to stored Cross-site Scripting via WidgetsManagement module
YetiForce CRM versions 6.4.0 and prior are vulnerable to cross-site scripting via the WidgetsManagement module. A patch is available at commit b716ecea340783b842498425faa029800bd30420...
YetiForce CRM vulnerable to stored Cross-site Scripting via LayoutEditor module
YetiForce CRM versions 6.4.0 and prior are vulnerable to cross-site scripting via the LayoutEditor module. A patch is available at commit eebc12601495ada38495076bec12841b2477516b...
YetiForce CRM vulnerable to stored Cross-site Scripting via WidgetsManagement module
YetiForce CRM versions 6.4.0 and prior are vulnerable to cross-site scripting via the WidgetsManagement module. A patch is available at commit b716ecea340783b842498425faa029800bd30420...
YetiForce CRM vulnerable to stored Cross-site Scripting via SlaPolicy module
YetiForce CRM versions 6.4.0 and prior are vulnerable to cross-site scripting via the SlaPolicy module. A patch is available at commit e55886781509fe39951fc7528347696474a17884...
YetiForce CRM vulnerable to stored Cross-site Scripting via WorkFlow module
YetiForce CRM versions 6.4.0 and prior are vulnerable to cross-site scripting via the WorkFlow module. A patch is available at commit cd82ecce44d83f1f6c10c7766bf36f3026de024a...
GHSA-MQH9-5JP9-6799 YetiForce CRM vulnerable to stored Cross-site Scripting via LayoutEditor module
YetiForce CRM versions 6.4.0 and prior are vulnerable to cross-site scripting via the LayoutEditor module. A patch is available at commit eebc12601495ada38495076bec12841b2477516b...
GHSA-VX3X-HWPH-GRVW YetiForce CRM vulnerable to stored Cross-site Scripting via SlaPolicy module
YetiForce CRM versions 6.4.0 and prior are vulnerable to cross-site scripting via the SlaPolicy module. A patch is available at commit e55886781509fe39951fc7528347696474a17884...
GHSA-QWC8-VJH3-GM2J YetiForce CRM vulnerable to stored Cross-site Scripting via WorkFlow module
YetiForce CRM versions 6.4.0 and prior are vulnerable to cross-site scripting via the WorkFlow module. A patch is available at commit cd82ecce44d83f1f6c10c7766bf36f3026de024a...
Cross site scripting
Cross-site Scripting XSS - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0...
CVE-2022-3004 Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm
Cross-site Scripting XSS - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0...
CVE-2022-3000
Cross-site Scripting XSS - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0...
CVE-2022-3000
YetiForce CRM (prior to 6.4.0) is affected by a stored XSS in the LayoutEditor module. The vulnerability stems from an unvalidated title parameter passed to LayoutEditor/EditField.tpl, allowing arbitrary JavaScript execution. A patch is available at commit eebc12601495ada38495076bec12841b2477516b...
Cross site scripting
Cross-site Scripting XSS - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.3...
PT-2022-19489 · Yetiforce · Yetiforcecrm
Name of the Vulnerable Software and Affected Versions: YetiForce CRM versions prior to 6.3 YetiForce CRM versions 6.4.0 and prior Description: The issue is related to Cross-site Scripting XSS - Stored, which affects the GitHub repository yetiforcecompany/yetiforcecrm. The WidgetsManagement module...
PT-2022-19986 · Unknown · Yetiforcecrm
Name of the Vulnerable Software and Affected Versions: YetiForce CRM versions prior to 6.4.0 Description: The issue is related to Cross-site Scripting XSS - Stored, which affects the YetiForce CRM GitHub repository. The SlaPolicy module is vulnerable to cross-site scripting. Recommendations: For...
PT-2022-19959 · Yetiforce · Yetiforcecrm
Name of the Vulnerable Software and Affected Versions: YetiForce CRM versions prior to 6.4.0 Description: The issue is related to Cross-site Scripting XSS - Stored, which affects the GitHub repository yetiforcecompany/yetiforcecrm. The LayoutEditor module is specifically vulnerable to cross-site...
