UBUNTU-CVE-2021-23203

Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to download PDF reports for arbitrary documents, via crafted requests...

CVE-2021-23203

CVE-2021-23203 is an improper access control vulnerability in the reporting engine of Odoo Community (14.0–15.0) and Odoo Enterprise (14.0–15.0). Exploitation allows remote attackers to download PDF reports for arbitrary documents via crafted requests. The issue is confirmed in OSV/Debian/Nessus ...

CVE-2021-23203

Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to download PDF reports for arbitrary documents, via crafted requests...

CVE-2021-23203

Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackers to download PDF reports for arbitrary documents, via crafted requests...

CVE-2021-23176

Improper access control in reporting engine of l10nfrfec module in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote authenticated users to extract accounting information via crafted RPC packets...

CVE-2021-23176

Improper access control in reporting engine of l10nfrfec module in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote authenticated users to extract accounting information via crafted RPC packets...

CVE-2021-23176

Improper access control in reporting engine of l10nfrfec module in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote authenticated users to extract accounting information via crafted RPC packets...

CVE-2021-23176

CVE-2021-23176 affects Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier. The vulnerability is due to improper access control in the l10n_fr_fec reporting engine, allowing remote authenticated users to extract accounting information via crafted RPC packets. Affected products an...

PT-2023-12049 · Odoo · Odoo Community +1

Name of the Vulnerable Software and Affected Versions: Odoo Community versions 14.0 through 15.0 Odoo Enterprise versions 14.0 through 15.0 Description: The issue is related to improper access control in the reporting engine, allowing remote attackers to download PDF reports for arbitrary documen...

PT-2023-12044 · Odoo · Odoo Community +1

Name of the Vulnerable Software and Affected Versions: Odoo Community versions 15.0 and earlier Odoo Enterprise versions 15.0 and earlier Description: The issue is related to improper access control in the reporting engine of the l10n fr fec module. This allows remote authenticated users to extra...

CVE-2023-25759

OS Command Injection in TripleData Reporting Engine in Tripleplay Platform releases prior to Caveman 3.4.0 allows authenticated users to run unprivileged OS level commands via a crafted request payload...

Command injection

OS Command Injection in TripleData Reporting Engine in Tripleplay Platform releases prior to Caveman 3.4.0 allows authenticated users to run unprivileged OS level commands via a crafted request payload...

CVE-2023-25759

The CVE-2023-25759 issue affects the Tripleplay Platform’s TripleData Reporting Engine prior to Caveman 3.4.0, where OS command injection is possible via a crafted request payload. The vulnerability allows authenticated users to execute unprivileged OS commands, with the impact described as limit...

CVE-2023-25759

OS Command Injection in TripleData Reporting Engine in Tripleplay Platform releases prior to Caveman 3.4.0 allows authenticated users to run unprivileged OS level commands via a crafted request payload...

PT-2023-20282 · Unknown · Tripledata Reporting Engine +1

Name of the Vulnerable Software and Affected Versions: Tripleplay Platform versions prior to 3.4.0 Description: The issue allows authenticated users to run unprivileged OS level commands via a crafted request payload. This is due to an OS Command Injection in the TripleData Reporting Engine...

CVE-2023-25759

OS Command Injection in TripleData Reporting Engine in Tripleplay Platform releases prior to Caveman 3.4.0 allows authenticated users to run unprivileged OS level commands via a crafted request payload...

CVE-2020-9050

Path Traversal vulnerability exists in Metasys Reporting Engine MRE Web Services which could allow a remote unauthenticated attacker to access and download arbitrary files from the system...

CVE-2020-9050

Path Traversal vulnerability exists in Metasys Reporting Engine MRE Web Services which could allow a remote unauthenticated attacker to access and download arbitrary files from the system...

Path traversal

Path Traversal vulnerability exists in Metasys Reporting Engine MRE Web Services which could allow a remote unauthenticated attacker to access and download arbitrary files from the system...

CVE-2020-9050 Metasys Reporting Engine (MRE) Web Services - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Path Traversal vulnerability exists in Metasys Reporting Engine MRE Web Services which could allow a remote unauthenticated attacker to access and download arbitrary files from the system...