Priority LOW 31
Directory Traversal vulnerability in YetiForceCompany YetiForceCRM versions 6.4.0 and before allows a remote authenticated attacker to obtain sensitive information via the license parameter in the LibraryLicense.php comp…
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.0104 · Published 2024-02-16 · Fixed in 6.5.0 CWE-22
Priority LOW 26
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00698 · Published 2022-10-06 · Fixed in 6.4.0 CWE-79
Priority MEDIUM 58
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.0065 · Published 2022-09-20 · Fixed in 6.4.0 CWE-79
Priority MEDIUM 58
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.0065 · Published 2022-09-20 · Fixed in 6.4.0 CWE-79
Priority MEDIUM 58
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.0065 · Published 2022-09-20 · Fixed in 6.4.0 CWE-79
Priority MEDIUM 58
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.3.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00776 · Published 2022-09-20 · Fixed in 6.3 CWE-79
Priority LOW 26
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00847 · Published 2022-08-23 · Fixed in 6.4.0 CWE-79
Priority LOW 26
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00919 · Published 2022-08-22 · Fixed in 6.4.0 CWE-79
Priority LOW 25
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00515 · Published 2022-08-22 · Fixed in 6.4.0 CWE-79
Priority LOW 23
Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.0049 · Published 2022-08-21 · Fixed in 6.4.0 CWE-79
Priority LOW 29
Unrestructed file upload in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00761 · Published 2022-05-05 · Fixed in 6.4.0 CWE-434
Priority LOW 35
Cross-Site Request Forgery (CSRF) in Packagist yetiforce/yetiforce-crm prior to 6.3.0.
CVSS 3.1HIGH 8.0· Network · Low privileges · User interaction · EPSS 0.00531 · Published 2022-01-24 · Fixed in 6.3.0 CWE-352
Priority LOW 29
yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.0079 · Published 2021-12-16 · Fixed in 6.4.0 CWE-79
Priority LOW 21
yetiforcecrm is vulnerable to Business Logic Errors
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00731 · Published 2021-12-15 · Fixed in 6.4.0 CWE-840
Priority LOW 25
yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00471 · Published 2021-12-15 · Fixed in 6.4.0 CWE-79
Priority LOW 21
yetiforcecrm is vulnerable to Business Logic Errors
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00641 · Published 2021-12-15 · Fixed in 6.4.0 CWE-840
Priority LOW 29
yetiforcecrm is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00808 · Published 2021-12-14 · Fixed in 6.4.0 CWE-79
Priority LOW 20
yetiforcecrm is vulnerable to Cross-Site Request Forgery (CSRF)
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00395 · Published 2021-12-11 · Fixed in 6.3.0 CWE-352
THREATIST.IORead the docs