Show filters
124 Total Results
Displaying 41-50 of 124
Sort by:
Attacker Value
Unknown
CVE-2020-14201
Disclosure Date: August 21, 2020 (last updated November 28, 2024)
Dolibarr CRM before 11.0.5 allows privilege escalation. This could allow remote authenticated attackers to upload arbitrary files via societe/document.php in which "disabled" is changed to "enabled" in the HTML source code.
0
Attacker Value
Unknown
CVE-2020-14475
Disclosure Date: June 19, 2020 (last updated February 21, 2025)
A reflected cross-site scripting (XSS) vulnerability in Dolibarr 11.0.3 allows remote attackers to inject arbitrary web script or HTML into public/notice.php (related to transphrase and transkey).
0
Attacker Value
Unknown
CVE-2020-14443
Disclosure Date: June 18, 2020 (last updated February 21, 2025)
A SQL injection vulnerability in accountancy/customer/card.php in Dolibarr 11.0.3 allows remote authenticated users to execute arbitrary SQL commands via the id parameter.
0
Attacker Value
Unknown
CVE-2020-13240
Disclosure Date: May 20, 2020 (last updated February 21, 2025)
The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. This bypasses the .noexe protection mechanism against XSS.
0
Attacker Value
Unknown
CVE-2020-13239
Disclosure Date: May 20, 2020 (last updated February 21, 2025)
The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link. This causes XSS.
0
Attacker Value
Unknown
CVE-2020-13094
Disclosure Date: May 18, 2020 (last updated February 21, 2025)
Dolibarr before 11.0.4 allows XSS.
0
Attacker Value
Unknown
CVE-2020-12669
Disclosure Date: May 06, 2020 (last updated February 21, 2025)
core/get_menudiv.php in Dolibarr before 11.0.4 allows remote authenticated attackers to bypass intended access restrictions via a non-alphanumeric menu parameter.
0
Attacker Value
Unknown
CVE-2020-11825
Disclosure Date: April 16, 2020 (last updated February 21, 2025)
In Dolibarr 10.0.6, forms are protected with a CSRF token against CSRF attacks. The problem is any CSRF token in any user's session can be used in another user's session. CSRF tokens should not be valid in this situation.
0
Attacker Value
Unknown
CVE-2020-11823
Disclosure Date: April 16, 2020 (last updated February 21, 2025)
In Dolibarr 10.0.6, if USER_LOGIN_FAILED is active, there is a stored XSS vulnerability on the admin tools --> audit page. This may lead to stealing of the admin account.
0
Attacker Value
Unknown
CVE-2019-19212
Disclosure Date: March 16, 2020 (last updated February 21, 2025)
Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php (product price screen).
0
