Vulnerabilities

TI-2022-06458 CVE-2022-22111 · GHSA-w6rp-4vj7-v2m8

DayByDay CRM - Missing Authorization when Changing Password

MEDIUM 40

In DayByDay CRM, version 2.2.0 is vulnerable to missing authorization.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01029 Published 2022-01-05 Fixed in 2.2.1 CWE-862

TI-2022-06457 CVE-2022-22110 · GHSA-96v6-hrwg-p378

DayByDay CRM - Weak Password Requirements in Update User

LOW 35

In Daybyday CRM, versions 1.1 through 2.2.0 enforce weak password requirements in the user update functionality.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01159 Published 2022-01-05 Fixed in 2.2.1 CWE-521

TI-2022-06456 CVE-2022-22109 · GHSA-jr37-66pj-36v7

DayByDay CRM - Stored Cross-Site Scripting (XSS) in Task Title

LOW 25

In Daybyday CRM, version 2.2.0 is vulnerable to Stored Cross-Site Scripting (XSS) vulnerability that allows low privileged application users to store malicious scripts in the title field of new tasks.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00549 Published 2022-01-05 Fixed in 2.2.1 CWE-79

TI-2022-06455 CVE-2022-22108 · GHSA-frxp-xxx8-hrg6

DayByDay CRM - Missing Authorization when Viewing Absences

LOW 21

In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00702 Published 2022-01-05 Fixed in 2.2.1 CWE-862

TI-2022-06454 CVE-2022-22107 · GHSA-44gv-fgcj-w546

DayByDay CRM - Missing Authorization when Viewing Appointments