CVE-2017-9435

CVE-2017-9435 affects Dolibarr ERP/CRM prior to 5.0.3. It is a SQL injection vulnerability in user/index.php (parameters search_supervisor and search_statut). The issue allows attackers to manipulate SQL queries (as described across connected documents). No explicit exploit details or patch info ...

Design/Logic Flaw

Dolibarr ERP/CRM 4.0.4 allows password changes without supplying the current password, which makes it easier for physically proximate attackers to obtain access via an unattended workstation...

UBUNTU-CVE-2017-7888

Dolibarr ERP/CRM 4.0.4 stores passwords with the MD5 algorithm, which makes brute-force attacks easier...

Sql injection

Dolibarr ERP/CRM 4.0.4 has SQL Injection in doli/theme/eldy/style.css.php via the lang parameter...

UBUNTU-CVE-2017-7887

Dolibarr ERP/CRM 4.0.4 has XSS in doli/societe/list.php via the sall parameter...

CVE-2017-7887

Dolibarr ERP/CRM 4.0.4 has XSS in doli/societe/list.php via the sall parameter...

CVE-2017-8879

Dolibarr ERP/CRM 4.0.4 allows password changes without supplying the current password, which makes it easier for physically proximate attackers to obtain access via an unattended workstation...

CVE-2017-7886

Dolibarr ERP/CRM 4.0.4 has SQL Injection in doli/theme/eldy/style.css.php via the lang parameter...

CVE-2017-8879

Dolibarr ERP/CRM 4.0.4 allows password changes without supplying the current password, which makes it easier for physically proximate attackers to obtain access via an unattended workstation...

Design/Logic Flaw

Dolibarr ERP/CRM 4.0.4 stores passwords with the MD5 algorithm, which makes brute-force attacks easier...

CVE-2017-7887

Dolibarr ERP/CRM 4.0.4 has XSS in doli/societe/list.php via the sall parameter...

CVE-2017-7888

Dolibarr ERP/CRM 4.0.4 stores passwords with the MD5 algorithm, which makes brute-force attacks easier...

Cross site scripting

Dolibarr ERP/CRM 4.0.4 has XSS in doli/societe/list.php via the sall parameter...

CVE-2017-7886

Dolibarr ERP/CRM 4.0.4 has SQL Injection in doli/theme/eldy/style.css.php via the lang parameter...

CVE-2017-7888

Dolibarr ERP/CRM 4.0.4 stores passwords with the MD5 algorithm, which makes brute-force attacks easier...

CVE-2017-8879

Dolibarr ERP/CRM 4.0.4 allows password changes without supplying the current password, which makes it easier for physically proximate attackers to obtain access via an unattended workstation...

CVE-2017-7886

Dolibarr ERP/CRM 4.0.4 has SQL Injection in doli/theme/eldy/style.css.php via the lang parameter...

CVE-2017-7888

Dolibarr ERP/CRM 4.0.4 stores passwords with the MD5 algorithm, which makes brute-force attacks easier...

CVE-2017-7887

Dolibarr ERP/CRM 4.0.4 has XSS in doli/societe/list.php via the sall parameter...

CVE-2017-7888

Dolibarr ERP/CRM 4.0.4 stores passwords with the MD5 algorithm, which makes brute-force attacks easier...