PatchTheCVEdaybyday vulnerabilities and fixes
Recent CVEs affecting daybyday, with upgrade or downgrade steps. 6 tracked.
daybyday has 6 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2022-01-13. Highest priority: CVE-2022-22113 (score 52/100).
- CVE-2022-22113 HIGH 8.8 UPGRADE In DayByDay CRM, versions 2.2.0 through 2.2.1 (latest) are vulnerable to Insufficient Session Expiration
- CVE-2022-22112 MEDIUM 5.4 UPGRADE In DayByDay CRM, versions 1.1 through 2.2.1 (latest) suffer from an application-wide Client-Side Template Inje
- CVE-2020-35707 MEDIUM 5.4 DOWNGRADE Daybyday 2.1.0 allows stored XSS via the Company Name parameter to the New Client screen.
- CVE-2020-35706 MEDIUM 5.4 DOWNGRADE Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Project screen.
- CVE-2020-35705 MEDIUM 5.4 DOWNGRADE Daybyday 2.1.0 allows stored XSS via the Name parameter to the New User screen.
- CVE-2020-35704 MEDIUM 5.4 DOWNGRADE Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Lead screen.
FAQ
How do I fix daybyday vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is daybyday being exploited right now?
None of the tracked daybyday CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which daybyday CVE should I patch first?
CVE-2022-22113 currently ranks highest (52/100): In DayByDay CRM, versions 2.2.0 through 2.2.1 (latest) are vulnerable to Insufficient Session Expiration.