3351 matches found
CVE-2017-7888
Dolibarr ERP/CRM 4.0.4 stores passwords with the MD5 algorithm, which makes brute-force attacks easier...
CVE-2017-7886
CVE-2017-7886 affects Dolibarr ERP/CRM 4.0.4, where an SQL injection is possible in doli/theme/eldy/style.css.php via the lang parameter. The available documents confirm the vulnerability class and the affected component but do not provide remediation details or patch/version fixes. The CVSS attr...
CVE-2017-7887
CVE-2017-7887 concerns Dolibarr ERP/CRM 4.0.4 with a reported Cross‑Site Scripting (XSS) in the file doli/societe/list.php via the sall parameter. Multiple connected sources corroborate this vulnerability, including NVD and OSV entries citing the same flaw. The vulnerability is described as XSS w...
CVE-2017-7887
Dolibarr ERP/CRM 4.0.4 has XSS in doli/societe/list.php via the sall parameter...
CVE-2017-7888
Dolibarr ERP/CRM 4.0.4 stores passwords with the MD5 algorithm, which makes brute-force attacks easier...
CVE-2017-7886
Dolibarr ERP/CRM 4.0.4 has SQL Injection in doli/theme/eldy/style.css.php via the lang parameter...
CVE-2017-7886
Dolibarr ERP/CRM 4.0.4 has SQL Injection in doli/theme/eldy/style.css.php via the lang parameter...
CVE-2017-8879
Dolibarr ERP/CRM 4.0.4 allows password changes without supplying the current password, which makes it easier for physically proximate attackers to obtain access via an unattended workstation...
CVE-2017-7888
Summary of CVE-2017-7888 (Dolibarr ERP/CRM 4.0.4): The issue is that passwords are stored using the MD5 hashing algorithm, which weakens password security and facilitates brute-force attacks. The available documents consistently identify this as the underlying weakness and attribute the vulnerabi...
CVE-2017-8879
CVE-2017-8879 affects Dolibarr ERP/CRM 4.0.4, where password changes can be performed without providing the current password. The root cause is insufficient authentication for password updates, enabling physically proximate attackers with access to unattended workstations to change a user’s passw...
PT-2017-17973 · Dolibarr · Dolibarr Erp/Crm
Name of the Vulnerable Software and Affected Versions: Dolibarr ERP/CRM version 4.0.4 Description: The issue is related to SQL Injection in the doli/theme/eldy/style.css.php file via the lang parameter. Recommendations: For version 4.0.4, avoid using the lang parameter in the affected file until...
Dolibarr 4.0.4 SQL Injection / XSS / Weaknesses
=== FOXMOLE - Security Advisory 2017-02-23 === Dolibarr ERP & CRM - Multiple Issues Affected Versions ================= Dolibarr 4.0.4 Issue Overview ============== Vulnerability Type: SQL Injection, Cross Site Scripting, Weak Hash Algorithm without Salt, Weak Password Change Method Technical Ris...
CVE-2017-7888: Inadequate Encryption Strength
Dolibarr ERP/CRM 4.0.4 stores passwords with the MD5 algorithm, which makes brute-force attacks easier...
CVE-2017-7886: Improper Neutralization of Special Elements used in an SQL Command
Dolibarr ERP/CRM 4.0.4 has SQL Injection in doli/theme/eldy/style.css.php via the lang parameter...
CVE-2017-8879: Improper Authentication
Dolibarr ERP/CRM 4.0.4 allows password changes without supplying the current password, which makes it easier for physically proximate attackers to obtain access via an unattended workstation...
CVE-2017-7887: Improper Neutralization of Input During Web Page Generation
Dolibarr ERP/CRM 4.0.4 has XSS in doli/societe/list.php via the sall parameter...
Path traversal
Splunk Hadoop Connect App has a path traversal vulnerability that allows remote authenticated users to execute arbitrary code, aka ERP-2041...
CVE-2017-7565
Splunk Hadoop Connect App has a path traversal vulnerability that allows remote authenticated users to execute arbitrary code, aka ERP-2041...
CVE-2017-7565
CVE-2017-7565 affects the Splunk Hadoop Connect App and is a path traversal vulnerability. The underlying issue allows remote authenticated users to execute arbitrary code via the vulnerable component/file, as described in multiple sources (ERP-2041). The available data identifies the affected pr...
CVE-2017-7565: Improper Limitation of a Pathname to a Restricted Directory
Splunk Hadoop Connect App has a path traversal vulnerability that allows remote authenticated users to execute arbitrary code, aka ERP-2041...