PT-2017-17975 · Dolibarr · Dolibarr Erp/Crm

Name of the Vulnerable Software and Affected Versions: Dolibarr ERP/CRM version 4.0.4 Description: The issue concerns the use of the MD5 algorithm for password storage, which can facilitate brute-force attacks. Recommendations: For version 4.0.4, consider updating the password storage mechanism t...

PT-2017-18601 · Dolibarr · Dolibarr Erp/Crm

Name of the Vulnerable Software and Affected Versions: Dolibarr ERP/CRM version 4.0.4 Description: The issue allows password changes without requiring the current password, making it easier for attackers with physical access to obtain access via an unattended workstation. Recommendations: For...

Dolibarr CRM Command Injection

Exploit Title: Dolibarr CRM 3.9.1 - Command Injection Vulnerability Exploit Author: David Silveiro Exploit Author Github: github.com/davidsilveiro Exploit Author Twitter: twitter.com/davidsilveiro Vendor Homepage: https://www.dolibarr.org Software Link:...

Dolibarr CRM Cross Site Scripting

Exploit Title: Dolibarr CRM alert Search criteria ' alert ' into fields Third party name, Alias name, Custom…...

Multiple RCEs via CSRF in Dolibarr

High-Tech Bridge Security Research Lab discovered multiple CSRF vulnerabilities in a popular ERP and CRM software Dolibarr. Discovered vulnerabilities may allow remote attacker to run arbitrary commands on vulnerable system via CSRF vector. Successful exploitation of the vulnerabilities can lead ...

Multiple Cross-Site Scripting Vulnerabilities in Dolibarr ERP/CRM

Dolibarr ERP/CRM is the software that manages your company's business information. Multiple cross-site scripting vulnerabilities in Dolibarr ERP/CRM 3.8.3 and prior versions allow remote attackers to inject arbitrary web script or HTML via the url of an external calendar or the "Import External...

Multiple cross-site scripting vulnerabilities in Dolibarr ERP/CRM (CNVD-2016-00438)

Dolibarr ERP/CRM is a Web-based enterprise resource planning ERP and customer relationship management CRM system. The Dolibarr ERP/CRM htdocs/user/card.php script fails to adequately filter 'lastname', 'firstname', ' email', 'job', and 'signature' parameters, allowing remote attackers to exploit...

CVE-2016-1912

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.8.3 allow remote authenticated users to inject arbitrary web script or HTML via the 1 lastname, 2 firstname, 3 email, 4 job, or 5 signature parameter to htdocs/user/card.php...

CVE-2016-1912

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.8.3 allow remote authenticated users to inject arbitrary web script or HTML via the 1 lastname, 2 firstname, 3 email, 4 job, or 5 signature parameter to htdocs/user/card.php...

CVE-2016-1912

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.8.3 allow remote authenticated users to inject arbitrary web script or HTML via the 1 lastname, 2 firstname, 3 email, 4 job, or 5 signature parameter to htdocs/user/card.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.8.3 allow remote authenticated users to inject arbitrary web script or HTML via the 1 lastname, 2 firstname, 3 email, 4 job, or 5 signature parameter to htdocs/user/card.php...

UBUNTU-CVE-2016-1912

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.8.3 allow remote authenticated users to inject arbitrary web script or HTML via the 1 lastname, 2 firstname, 3 email, 4 job, or 5 signature parameter to htdocs/user/card.php...

CVE-2016-1912

CVE-2016-1912 describes multiple XSS vulnerabilities in Dolibarr ERP/CRM 3.8.3, where remote authenticated users can inject arbitrary script/HTML via htdocs/user/card.php parameters: lastname, firstname, email, job, or signature. The root cause is inadequate input filtering on these fields, as no...

CVE-2016-1912

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.8.3 allow remote authenticated users to inject arbitrary web script or HTML via the 1 lastname, 2 firstname, 3 email, 4 job, or 5 signature parameter to htdocs/user/card.php...

CVE-2015-8685

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.8.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 external calendar url or 2 the bank name field in the "import external calendar" page...

CVE-2015-8685

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.8.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 external calendar url or 2 the bank name field in the "import external calendar" page...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.8.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 external calendar url or 2 the bank name field in the "import external calendar" page...

UBUNTU-CVE-2015-8685

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.8.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 external calendar url or 2 the bank name field in the "import external calendar" page...

CVE-2015-8685

CVE-2015-8685 affects Dolibarr ERP/CRM (3.8.3 and earlier). The issue is multiple cross-site scripting (XSS) vulnerabilities where untrusted data is not properly escaped in two fields on the import external calendar page: (1) the external calendar URL and (2) the Bank Name field. This allows remo...

CVE-2015-8685

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.8.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 external calendar url or 2 the bank name field in the "import external calendar" page...