Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2022-3002: Improved display of data in the business hours · YetiForceCompany/YetiForceCRM@54728be

Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0.

CVE
#xss#js#git

@@ -19,7 +19,7 @@ <div class="card"> <div class="card-header"> {if !empty($RECORD_MODEL->getId())} <span class="yfi yfi-full-editing-view mr-2"></span>{\App\Language::translate('LBL_EDIT_BUSINESS_HOURS’,$QUALIFIED_MODULE)} - {$RECORD_MODEL->getName()} <span class="yfi yfi-full-editing-view mr-2"></span>{\App\Language::translate('LBL_EDIT_BUSINESS_HOURS’,$QUALIFIED_MODULE)} - {\App\Purifier::encodeHtml($RECORD_MODEL->getName())} {else} <span class="fas fa-plus mr-2"></span>{\App\Language::translate('LBL_ADD_BUSINESS_HOURS’,$QUALIFIED_MODULE)} {/if} @@ -29,8 +29,7 @@ <div class="col-12 form-group row"> <label class="col-5"><span class="redColor">*</span>{\App\Language::translate('LBL_NAME’, $QUALIFIED_MODULE)}</label> <div class="col-7"> <input type="text" name="name" class="form-control w-100" {if isset($RECORD_MODEL)} value="{$RECORD_MODEL->getName()}" {/if} data-validation-engine="validate[required,funcCall[Vtiger_Base_Validator_Js.invokeValidation]]“> <input type="text” name="name" class="form-control w-100" {if isset($RECORD_MODEL)}value="{\App\Purifier::encodeHtml($RECORD_MODEL->getName())}" {/if} data-validation-engine="validate[required,funcCall[Vtiger_Base_Validator_Js.invokeValidation]]"> </div> </div> <div class="col-12 form-group row">

Related news

GHSA-v9fj-h8g6-4w9q: YetiForce CRM vulnerable to stored Cross-site Scripting

YetiForce CRM version 6.4.0 and prior is vulnerable to stored cross-site scripting. A [patch](https://github.com/yetiforcecompany/yetiforcecrm/commit/54728becfdad9b6e686bbe336007cba2ce518248) is available on the `developer` branch.

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda
CVE-2023-6905
CVE-2023-6903
CVE-2023-6904
CVE-2023-3907