CVE-2017-9435

Dolibarr ERP/CRM before 5.0.3 is vulnerable to a SQL injection in user/index.php searchsupervisor and searchstatut parameters...

Unauthorized Password Change

dolibarr/dolibarr is vulnerable to unauthorized password changes. The library does not require the current password for validation before changing to a new password, allowing a malicious user to obtain access to an unattended workstation...

Cross-Site Scripting (XSS)

dolibarr/dolibarr is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary script via the url bar of the doli/societe/list.php page...

Weak Hash Algorithm Without Salt

dolibarr/dolibarr is vulnerable to using a weak hash algorithm without salt. The library does not encrypt its passwords with a salt, meaning that the password hash stored on the system can be easily brute forced...

Dolibarr ERP/CRM Brute Force Exploitation Vulnerability

Dolibarr ERP/CRM is a Web-based enterprise resource planning ERP and customer relationship management CRM system from the Dolibarr Foundation in France. The system can be used to manage products, inventory, invoices, orders, and more. A security vulnerability exists in Dolibarr ERP/CRM version...

Dolibarr <= 4.0.4 Multiple Vulnerabilities - Active Check

Dolibarr is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:dolibarr:dolibarr"; ifdescription...

Dolibarr Cross-Site Scripting Vulnerability

Dolibarr ERP/CRM is the software that manages your company's business information. A cross-site scripting vulnerability exists in Dolibarr that could be exploited by remote attackers to inject arbitrary web script or HTML...

Dolibarr ERP/CRM Arbitrary Password Change Vulnerability

Dolibarr ERP/CRM is a Web-based enterprise resource planning ERP and customer relationship management CRM system from the Dolibarr Foundation in France. The system can be used to manage products, inventory, invoices, orders, and more. A security vulnerability exists in Dolibarr ERP/CRM version...

Dolibarr SQL Injection Vulnerability (CNVD-2017-07570)

Dolibarr is a simple web-based enterprise ERP and CRM system. Dolibarr suffers from an SQL injection vulnerability. Because the program fails to properly filter user-supplied input before being used for dynamically generated content, an attacker could use the vulnerability to compromise the...

Dolibarr 4.0.4 SQL Injection / XSS / Weaknesses Vulnerabilities

Dolibarr version 4.0.4 suffers from cross site scripting, weak hashing, weak password change, and remote SQL injection vulnerabilities. Dolibarr ERP & CRM - Multiple Issues Affected Versions ================= Dolibarr 4.0.4 Issue Overview ============== Vulnerability Type: SQL Injection, Cross Si...

CVE-2017-7887

Dolibarr ERP/CRM 4.0.4 has XSS in doli/societe/list.php via the sall parameter...

Cross site scripting

Dolibarr ERP/CRM 4.0.4 has XSS in doli/societe/list.php via the sall parameter...

CVE-2017-7886

Dolibarr ERP/CRM 4.0.4 has SQL Injection in doli/theme/eldy/style.css.php via the lang parameter...

UBUNTU-CVE-2017-7887

Dolibarr ERP/CRM 4.0.4 has XSS in doli/societe/list.php via the sall parameter...

UBUNTU-CVE-2017-7886

Dolibarr ERP/CRM 4.0.4 has SQL Injection in doli/theme/eldy/style.css.php via the lang parameter...

CVE-2017-8879

Dolibarr ERP/CRM 4.0.4 allows password changes without supplying the current password, which makes it easier for physically proximate attackers to obtain access via an unattended workstation...

CVE-2017-7887

Dolibarr ERP/CRM 4.0.4 has XSS in doli/societe/list.php via the sall parameter...

CVE-2017-7888

Dolibarr ERP/CRM 4.0.4 stores passwords with the MD5 algorithm, which makes brute-force attacks easier...

Design/Logic Flaw

Dolibarr ERP/CRM 4.0.4 stores passwords with the MD5 algorithm, which makes brute-force attacks easier...

Design/Logic Flaw

Dolibarr ERP/CRM 4.0.4 allows password changes without supplying the current password, which makes it easier for physically proximate attackers to obtain access via an unattended workstation...