Search criteria
9 vulnerabilities found for f-revocrm by f-revocrm
FKIE_CVE-2023-41149
Vulnerability from fkie_nvd - Published: 2023-09-06 13:15 - Updated: 2024-11-21 08:20
Severity ?
Summary
F-RevoCRM version7.3.7 and version7.3.8 contains an OS command injection vulnerability. If this vulnerability is exploited, an attacker who can access the product may execute an arbitrary OS command on the server where the product is running.
References
| URL | Tags | ||
|---|---|---|---|
| vultures@jpcert.or.jp | http://jvn.jp/en/jp/JVN78113802/ | Third Party Advisory | |
| vultures@jpcert.or.jp | https://f-revocrm.jp/2023/08/9394/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://jvn.jp/en/jp/JVN78113802/ | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://f-revocrm.jp/2023/08/9394/ | Vendor Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:f-revocrm:f-revocrm:7.3.7:*:*:*:*:*:*:*",
"matchCriteriaId": "474DBB2C-1655-4EFE-AECD-A98C6A6E246B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f-revocrm:f-revocrm:7.3.8:*:*:*:*:*:*:*",
"matchCriteriaId": "8C1BF5CB-4DAB-4CB3-879E-05FF74092E4B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "F-RevoCRM version7.3.7 and version7.3.8 contains an OS command injection vulnerability. If this vulnerability is exploited, an attacker who can access the product may execute an arbitrary OS command on the server where the product is running."
},
{
"lang": "es",
"value": "F-RevoCRM versi\u00f3n 7.3.7 y versi\u00f3n 7.3.8 contiene una vulnerabilidad de inyecci\u00f3n de comandos del sistema operativo. Si se aprovecha esta vulnerabilidad, un atacante que pueda acceder al producto puede ejecutar un comando del sistema operativo arbitrario en el servidor donde se ejecuta el producto."
}
],
"id": "CVE-2023-41149",
"lastModified": "2024-11-21T08:20:40.150",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-09-06T13:15:09.117",
"references": [
{
"source": "vultures@jpcert.or.jp",
"tags": [
"Third Party Advisory"
],
"url": "http://jvn.jp/en/jp/JVN78113802/"
},
{
"source": "vultures@jpcert.or.jp",
"tags": [
"Vendor Advisory"
],
"url": "https://f-revocrm.jp/2023/08/9394/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://jvn.jp/en/jp/JVN78113802/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://f-revocrm.jp/2023/08/9394/"
}
],
"sourceIdentifier": "vultures@jpcert.or.jp",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2023-41150
Vulnerability from fkie_nvd - Published: 2023-09-06 13:15 - Updated: 2024-11-21 08:20
Severity ?
Summary
F-RevoCRM 7.3 series prior to version7.3.8 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is using the product.
References
| URL | Tags | ||
|---|---|---|---|
| vultures@jpcert.or.jp | http://jvn.jp/en/jp/JVN78113802/ | Third Party Advisory | |
| vultures@jpcert.or.jp | https://f-revocrm.jp/2023/08/9394/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://jvn.jp/en/jp/JVN78113802/ | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://f-revocrm.jp/2023/08/9394/ | Vendor Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:f-revocrm:f-revocrm:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C5A4D4BF-81CC-4A05-9BCB-B5365ECEA396",
"versionEndIncluding": "7.3.8",
"versionStartIncluding": "7.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "F-RevoCRM 7.3 series prior to version7.3.8 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is using the product."
},
{
"lang": "es",
"value": " F-RevoCRM 7.3 series anterior a la version 7.3.8 contiene una vulnerabilidad Cross-Site Scripting. Si se explota esta vulnerabilidad, se puede ejecutar un script arbitrario en el navegador web del usuario que utiliza el producto."
}
],
"id": "CVE-2023-41150",
"lastModified": "2024-11-21T08:20:40.273",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.3,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-09-06T13:15:09.247",
"references": [
{
"source": "vultures@jpcert.or.jp",
"tags": [
"Third Party Advisory"
],
"url": "http://jvn.jp/en/jp/JVN78113802/"
},
{
"source": "vultures@jpcert.or.jp",
"tags": [
"Vendor Advisory"
],
"url": "https://f-revocrm.jp/2023/08/9394/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://jvn.jp/en/jp/JVN78113802/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://f-revocrm.jp/2023/08/9394/"
}
],
"sourceIdentifier": "vultures@jpcert.or.jp",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2019-6036
Vulnerability from fkie_nvd - Published: 2020-01-27 10:15 - Updated: 2024-11-21 04:45
Severity ?
Summary
Cross-site scripting vulnerability in F-RevoCRM 6.0 to F-RevoCRM 6.5 patch6 (version 6 series) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References
| URL | Tags | ||
|---|---|---|---|
| vultures@jpcert.or.jp | http://jvn.jp/en/jp/JVN97325754/index.html | Third Party Advisory | |
| vultures@jpcert.or.jp | https://f-revocrm.jp/2019/12/9393 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://jvn.jp/en/jp/JVN97325754/index.html | Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://f-revocrm.jp/2019/12/9393 | Vendor Advisory |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:f-revocrm:f-revocrm:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0111C32E-A345-49D3-8C1C-434AB94F6BED",
"versionEndExcluding": "6.5",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f-revocrm:f-revocrm:6.5:-:*:*:*:*:*:*",
"matchCriteriaId": "1D2405EB-4341-4DF9-BBEC-D397BE93C738",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f-revocrm:f-revocrm:6.5:patch2:*:*:*:*:*:*",
"matchCriteriaId": "AF6E46B7-8400-4CF5-B29B-3D766DC9AC50",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f-revocrm:f-revocrm:6.5:patch4:*:*:*:*:*:*",
"matchCriteriaId": "1966A7D3-F9E2-4FDC-B80E-C68760CA3393",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f-revocrm:f-revocrm:6.5:patch5:*:*:*:*:*:*",
"matchCriteriaId": "212D83EF-5132-4B1E-9519-F9703DE3325B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:f-revocrm:f-revocrm:6.5:patch6:*:*:*:*:*:*",
"matchCriteriaId": "BCCD5711-7FEF-4DBA-AC72-941E3666E427",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting vulnerability in F-RevoCRM 6.0 to F-RevoCRM 6.5 patch6 (version 6 series) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
},
{
"lang": "es",
"value": "Una vulnerabilidad de tipo cross-site scripting en F-RevoCRM versi\u00f3n 6.0 hasta F-RevoCRM versi\u00f3n 6.5 patch6 (serie de la versi\u00f3n 6), permite a atacantes remotos inyectar script web o HTML arbitrario por medio de vectores no especificados."
}
],
"id": "CVE-2019-6036",
"lastModified": "2024-11-21T04:45:57.410",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-01-27T10:15:11.793",
"references": [
{
"source": "vultures@jpcert.or.jp",
"tags": [
"Third Party Advisory"
],
"url": "http://jvn.jp/en/jp/JVN97325754/index.html"
},
{
"source": "vultures@jpcert.or.jp",
"tags": [
"Vendor Advisory"
],
"url": "https://f-revocrm.jp/2019/12/9393"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://jvn.jp/en/jp/JVN97325754/index.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://f-revocrm.jp/2019/12/9393"
}
],
"sourceIdentifier": "vultures@jpcert.or.jp",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
CVE-2023-41150 (GCVE-0-2023-41150)
Vulnerability from cvelistv5 – Published: 2023-09-06 12:35 – Updated: 2024-09-26 19:46
VLAI?
Summary
F-RevoCRM 7.3 series prior to version7.3.8 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is using the product.
Severity ?
No CVSS data available.
CWE
- Cross-site scripting (XSS)
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Thinkingreed Inc. | F-RevoCRM |
Affected:
7.3 series prior to version7.3.8
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:54:03.482Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://f-revocrm.jp/2023/08/9394/"
},
{
"tags": [
"x_transferred"
],
"url": "http://jvn.jp/en/jp/JVN78113802/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-41150",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-26T19:46:21.442931Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-26T19:46:35.198Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "F-RevoCRM",
"vendor": "Thinkingreed Inc.",
"versions": [
{
"status": "affected",
"version": "7.3 series prior to version7.3.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "F-RevoCRM 7.3 series prior to version7.3.8 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is using the product."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-site scripting (XSS)",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-09-06T12:35:41.294Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://f-revocrm.jp/2023/08/9394/"
},
{
"url": "http://jvn.jp/en/jp/JVN78113802/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-41150",
"datePublished": "2023-09-06T12:35:41.294Z",
"dateReserved": "2023-08-24T00:34:39.254Z",
"dateUpdated": "2024-09-26T19:46:35.198Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-41149 (GCVE-0-2023-41149)
Vulnerability from cvelistv5 – Published: 2023-09-06 12:35 – Updated: 2024-09-26 20:40
VLAI?
Summary
F-RevoCRM version7.3.7 and version7.3.8 contains an OS command injection vulnerability. If this vulnerability is exploited, an attacker who can access the product may execute an arbitrary OS command on the server where the product is running.
Severity ?
No CVSS data available.
CWE
- OS command injection
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Thinkingreed Inc. | F-RevoCRM |
Affected:
version7.3.7 and version7.3.8
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:54:04.326Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://f-revocrm.jp/2023/08/9394/"
},
{
"tags": [
"x_transferred"
],
"url": "http://jvn.jp/en/jp/JVN78113802/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-41149",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-26T20:39:55.186689Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-26T20:40:04.712Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "F-RevoCRM ",
"vendor": "Thinkingreed Inc. ",
"versions": [
{
"status": "affected",
"version": "version7.3.7 and version7.3.8 "
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "F-RevoCRM version7.3.7 and version7.3.8 contains an OS command injection vulnerability. If this vulnerability is exploited, an attacker who can access the product may execute an arbitrary OS command on the server where the product is running."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "OS command injection",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-09-06T12:35:22.757Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://f-revocrm.jp/2023/08/9394/"
},
{
"url": "http://jvn.jp/en/jp/JVN78113802/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-41149",
"datePublished": "2023-09-06T12:35:22.757Z",
"dateReserved": "2023-08-24T00:34:39.254Z",
"dateUpdated": "2024-09-26T20:40:04.712Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-6036 (GCVE-0-2019-6036)
Vulnerability from cvelistv5 – Published: 2020-01-27 09:35 – Updated: 2024-08-04 20:16
VLAI?
Summary
Cross-site scripting vulnerability in F-RevoCRM 6.0 to F-RevoCRM 6.5 patch6 (version 6 series) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Severity ?
No CVSS data available.
CWE
- Cross-site scripting
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| ThinkingReed inc. | F-RevoCRM |
Affected:
6.0 to F-RevoCRM 6.5 patch6 (version 6 series)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T20:16:24.288Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://f-revocrm.jp/2019/12/9393"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://jvn.jp/en/jp/JVN97325754/index.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "F-RevoCRM",
"vendor": "ThinkingReed inc.",
"versions": [
{
"status": "affected",
"version": "6.0 to F-RevoCRM 6.5 patch6 (version 6 series)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting vulnerability in F-RevoCRM 6.0 to F-RevoCRM 6.5 patch6 (version 6 series) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-site scripting",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-01-27T09:35:26",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://f-revocrm.jp/2019/12/9393"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://jvn.jp/en/jp/JVN97325754/index.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vultures@jpcert.or.jp",
"ID": "CVE-2019-6036",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "F-RevoCRM",
"version": {
"version_data": [
{
"version_value": "6.0 to F-RevoCRM 6.5 patch6 (version 6 series)"
}
]
}
}
]
},
"vendor_name": "ThinkingReed inc."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting vulnerability in F-RevoCRM 6.0 to F-RevoCRM 6.5 patch6 (version 6 series) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-site scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://f-revocrm.jp/2019/12/9393",
"refsource": "MISC",
"url": "https://f-revocrm.jp/2019/12/9393"
},
{
"name": "http://jvn.jp/en/jp/JVN97325754/index.html",
"refsource": "MISC",
"url": "http://jvn.jp/en/jp/JVN97325754/index.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2019-6036",
"datePublished": "2020-01-27T09:35:26",
"dateReserved": "2019-01-10T00:00:00",
"dateUpdated": "2024-08-04T20:16:24.288Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-41150 (GCVE-0-2023-41150)
Vulnerability from nvd – Published: 2023-09-06 12:35 – Updated: 2024-09-26 19:46
VLAI?
Summary
F-RevoCRM 7.3 series prior to version7.3.8 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is using the product.
Severity ?
No CVSS data available.
CWE
- Cross-site scripting (XSS)
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Thinkingreed Inc. | F-RevoCRM |
Affected:
7.3 series prior to version7.3.8
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:54:03.482Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://f-revocrm.jp/2023/08/9394/"
},
{
"tags": [
"x_transferred"
],
"url": "http://jvn.jp/en/jp/JVN78113802/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-41150",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-26T19:46:21.442931Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-26T19:46:35.198Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "F-RevoCRM",
"vendor": "Thinkingreed Inc.",
"versions": [
{
"status": "affected",
"version": "7.3 series prior to version7.3.8"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "F-RevoCRM 7.3 series prior to version7.3.8 contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is using the product."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-site scripting (XSS)",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-09-06T12:35:41.294Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://f-revocrm.jp/2023/08/9394/"
},
{
"url": "http://jvn.jp/en/jp/JVN78113802/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-41150",
"datePublished": "2023-09-06T12:35:41.294Z",
"dateReserved": "2023-08-24T00:34:39.254Z",
"dateUpdated": "2024-09-26T19:46:35.198Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-41149 (GCVE-0-2023-41149)
Vulnerability from nvd – Published: 2023-09-06 12:35 – Updated: 2024-09-26 20:40
VLAI?
Summary
F-RevoCRM version7.3.7 and version7.3.8 contains an OS command injection vulnerability. If this vulnerability is exploited, an attacker who can access the product may execute an arbitrary OS command on the server where the product is running.
Severity ?
No CVSS data available.
CWE
- OS command injection
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Thinkingreed Inc. | F-RevoCRM |
Affected:
version7.3.7 and version7.3.8
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T18:54:04.326Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://f-revocrm.jp/2023/08/9394/"
},
{
"tags": [
"x_transferred"
],
"url": "http://jvn.jp/en/jp/JVN78113802/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-41149",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-26T20:39:55.186689Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-26T20:40:04.712Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "F-RevoCRM ",
"vendor": "Thinkingreed Inc. ",
"versions": [
{
"status": "affected",
"version": "version7.3.7 and version7.3.8 "
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "F-RevoCRM version7.3.7 and version7.3.8 contains an OS command injection vulnerability. If this vulnerability is exploited, an attacker who can access the product may execute an arbitrary OS command on the server where the product is running."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "OS command injection",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-09-06T12:35:22.757Z",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"url": "https://f-revocrm.jp/2023/08/9394/"
},
{
"url": "http://jvn.jp/en/jp/JVN78113802/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2023-41149",
"datePublished": "2023-09-06T12:35:22.757Z",
"dateReserved": "2023-08-24T00:34:39.254Z",
"dateUpdated": "2024-09-26T20:40:04.712Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-6036 (GCVE-0-2019-6036)
Vulnerability from nvd – Published: 2020-01-27 09:35 – Updated: 2024-08-04 20:16
VLAI?
Summary
Cross-site scripting vulnerability in F-RevoCRM 6.0 to F-RevoCRM 6.5 patch6 (version 6 series) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Severity ?
No CVSS data available.
CWE
- Cross-site scripting
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| ThinkingReed inc. | F-RevoCRM |
Affected:
6.0 to F-RevoCRM 6.5 patch6 (version 6 series)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T20:16:24.288Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://f-revocrm.jp/2019/12/9393"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://jvn.jp/en/jp/JVN97325754/index.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "F-RevoCRM",
"vendor": "ThinkingReed inc.",
"versions": [
{
"status": "affected",
"version": "6.0 to F-RevoCRM 6.5 patch6 (version 6 series)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting vulnerability in F-RevoCRM 6.0 to F-RevoCRM 6.5 patch6 (version 6 series) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-site scripting",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-01-27T09:35:26",
"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"shortName": "jpcert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://f-revocrm.jp/2019/12/9393"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://jvn.jp/en/jp/JVN97325754/index.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "vultures@jpcert.or.jp",
"ID": "CVE-2019-6036",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "F-RevoCRM",
"version": {
"version_data": [
{
"version_value": "6.0 to F-RevoCRM 6.5 patch6 (version 6 series)"
}
]
}
}
]
},
"vendor_name": "ThinkingReed inc."
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting vulnerability in F-RevoCRM 6.0 to F-RevoCRM 6.5 patch6 (version 6 series) allows remote attackers to inject arbitrary web script or HTML via unspecified vectors."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-site scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://f-revocrm.jp/2019/12/9393",
"refsource": "MISC",
"url": "https://f-revocrm.jp/2019/12/9393"
},
{
"name": "http://jvn.jp/en/jp/JVN97325754/index.html",
"refsource": "MISC",
"url": "http://jvn.jp/en/jp/JVN97325754/index.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
"assignerShortName": "jpcert",
"cveId": "CVE-2019-6036",
"datePublished": "2020-01-27T09:35:26",
"dateReserved": "2019-01-10T00:00:00",
"dateUpdated": "2024-08-04T20:16:24.288Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}