851 matches found
CVE-2018-14885
Incorrect access control in the database manager component in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows a remote attacker to restore a database dump without knowing the super-admin password. An arbitrary password succeeds...
CVE-2018-14886
The module-description renderer in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier does not disable RST's local file inclusion, which allows privileged authenticated users to read local files via a crafted module description...
CVE-2018-14886
The module-description renderer in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier does not disable RST's local file inclusion, which allows privileged authenticated users to read local files via a crafted module description...
CVE-2018-14886
The CVE-2018-14886 entry concerns the module-description renderer in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier. The underlying issue is that the renderer does not disable local file inclusion in RST, enabling privileged authenticated users to read local files by craftin...
CVE-2018-14886
The module-description renderer in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier does not disable RST's local file inclusion, which allows privileged authenticated users to read local files via a crafted module description...
CVE-2018-14887
Improper Host header sanitization in the dbfilter routing component in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows a remote attacker to deny access to the service and to disclose database names via a crafted request...
CVE-2018-14887
Technical details about CVE-2018-14887 are not publicly provided in the connected documents. The materials include the description of improper Host header sanitization in Odoo 11.x but lack specifics on affected versions, vulnerable components, or available fixes.
CVE-2018-14887
Improper Host header sanitization in the dbfilter routing component in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows a remote attacker to deny access to the service and to disclose database names via a crafted request...
CVE-2018-14887
Improper Host header sanitization in the dbfilter routing component in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows a remote attacker to deny access to the service and to disclose database names via a crafted request...
CVE-2018-14886: Incorrect Permission Assignment for Critical Resource
The module-description renderer in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier does not disable RST's local file inclusion, which allows privileged authenticated users to read local files via a crafted module description...
CVE-2018-14868: Improper Authentication
Incorrect access control in the Password Encryption module in Odoo Community 9.0 and Odoo Enterprise 9.0 allows authenticated users to change the password of other users without knowing their current password via a crafted RPC call...
PT-2019-9065
Name of the Vulnerable Software and Affected Versions Odoo Community versions 9.0 through 10.0 Odoo Enterprise versions 9.0 through 10.0 Description The issue is related to incorrect access control in the portal messaging system, allowing remote attackers to post messages on behalf of customers a...
CVE-2018-14887: Improper Input Validation
Improper Host header sanitization in the dbfilter routing component in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows a remote attacker to deny access to the service and to disclose database names via a crafted request...
CVE-2018-14867: Improper Access Control
Incorrect access control in the portal messaging system in Odoo Community 9.0 and 10.0 and Odoo Enterprise 9.0 and 10.0 allows remote attackers to post messages on behalf of customers, and to guess document attribute values, via crafted parameters...
CVE-2018-14885: Improper Access Control
Incorrect access control in the database manager component in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows a remote attacker to restore a database dump without knowing the super-admin password. An arbitrary password succeeds...
PT-2019-9066
Name of the Vulnerable Software and Affected Versions Odoo Community version 9.0 Odoo Enterprise version 9.0 Description The issue is related to incorrect access control in the Password Encryption module, allowing authenticated users to change the password of other users without knowing their...
Odoo Input Validation Error Vulnerability
Odoo is an open source commercial system from the Belgian company Odoo. An input validation error vulnerability exists in Odoo 8.0-20160726 and prior versions and version 9. The vulnerability originates from a web system or product that does not properly validate input data. An attacker could...
Design/Logic Flaw
Odoo Version = 8.0-20160726 and Version 9 is affected by: CWE-601: Open redirection. The impact is: obtain sensitive information remote...
