CVE-2020-12669

CVE-2020-12669 affects Dolibarr core/get_menudiv.php in Dolibarr versions before 11.0.4. The issue allows remote authenticated attackers to bypass access restrictions via a non-alphanumeric menu parameter, enabling elevation of access. Red Hat and other sources confirm the same flaw and point to ...

Cross-site Scripting (XSS)

dolibarr is vulnerable to cross-site scripting XSS. With the USERLOGINFAILED setting,an attacker can inject arbitrary script in admin tools -- audit page, possibly stealing admin account...

Dolibarr ERP/CRM Cross-Site Request Forgery Vulnerability (CNVD-2021-28748)

Dolibarr ERP/CRM is a Web-based enterprise resource planning ERP and customer relationship management CRM system from the Dolibarr Foundation in France. The system can be used to manage products, inventory, invoices, orders, and more. A cross-site request forgery vulnerability exists in Dolibarr...

Dolibarr ERP/CRM Admin Tools Cross-Site Scripting Vulnerability

Dolibarr ERP/CRM is a Web-based enterprise resource planning ERP and customer relationship management CRM system from the Dolibarr Foundation in France. The system can be used to manage products, inventory, invoices, orders, etc. Admin Tools is one of the management tools. A cross-site scripting...

CVE-2020-11825

In Dolibarr 10.0.6, forms are protected with a CSRF token against CSRF attacks. The problem is any CSRF token in any user's session can be used in another user's session. CSRF tokens should not be valid in this situation...

CVE-2020-11823

In Dolibarr 10.0.6, if USERLOGINFAILED is active, there is a stored XSS vulnerability on the admin tools -- audit page. This may lead to stealing of the admin account...

CVE-2020-11825

In Dolibarr 10.0.6, forms are protected with a CSRF token against CSRF attacks. The problem is any CSRF token in any user's session can be used in another user's session. CSRF tokens should not be valid in this situation...

CVE-2020-11823

In Dolibarr 10.0.6, if USERLOGINFAILED is active, there is a stored XSS vulnerability on the admin tools -- audit page. This may lead to stealing of the admin account...

CVE-2020-11825

In Dolibarr 10.0.6, forms are protected with a CSRF token against CSRF attacks. The problem is any CSRF token in any user's session can be used in another user's session. CSRF tokens should not be valid in this situation...

Cross site request forgery (csrf)

In Dolibarr 10.0.6, forms are protected with a CSRF token against CSRF attacks. The problem is any CSRF token in any user's session can be used in another user's session. CSRF tokens should not be valid in this situation...

Cross site scripting

In Dolibarr 10.0.6, if USERLOGINFAILED is active, there is a stored XSS vulnerability on the admin tools -- audit page. This may lead to stealing of the admin account...

UBUNTU-CVE-2020-11825

In Dolibarr 10.0.6, forms are protected with a CSRF token against CSRF attacks. The problem is any CSRF token in any user's session can be used in another user's session. CSRF tokens should not be valid in this situation...

CVE-2020-11823

In Dolibarr 10.0.6, if USERLOGINFAILED is active, there is a stored XSS vulnerability on the admin tools -- audit page. This may lead to stealing of the admin account...

UBUNTU-CVE-2020-11823

In Dolibarr 10.0.6, if USERLOGINFAILED is active, there is a stored XSS vulnerability on the admin tools -- audit page. This may lead to stealing of the admin account...

CVE-2020-11825

In Dolibarr 10.0.6, forms are protected with a CSRF token against CSRF attacks. The problem is any CSRF token in any user's session can be used in another user's session. CSRF tokens should not be valid in this situation...

CVE-2020-11825

In Dolibarr 10.0.6, forms are protected by CSRF tokens, but the CSRF token in any user’s session can be used in another user’s session. The vulnerability description states that tokens should not be valid across sessions, enabling cross-session CSRF risk. No concrete exploitation details, affecte...

CVE-2020-11823

In Dolibarr 10.0.6, if USERLOGINFAILED is active, there is a stored XSS vulnerability on the admin tools -- audit page. This may lead to stealing of the admin account...

CVE-2020-11823

Dolibarr 10.0.6 is affected by a stored XSS vulnerability on the Admin Tools audit page when USER_LOGIN_FAILED is active. The issue could allow an attacker to steal the admin account; the specific root cause and vulnerable component are described at a high level in multiple sources, but no vendor...

PT-2020-12873 · Dolibarr · Dolibarr

Name of the Vulnerable Software and Affected Versions: Dolibarr version 10.0.6 Description: The issue arises from the fact that any Cross-Site Request Forgery CSRF token in any user's session can be used in another user's session. Normally, CSRF tokens should be unique to each user's session and...

PT-2020-12872 · Dolibarr · Dolibarr

Name of the Vulnerable Software and Affected Versions: Dolibarr version 10.0.6 Description: A stored XSS issue exists in the admin tools -- audit page when the USER LOGIN FAILED feature is active. This could potentially allow for the theft of an admin account. Recommendations: For Dolibarr versio...