CVE-2016-1912

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.8.3 allow remote authenticated users to inject arbitrary web script or HTML via the 1 lastname, 2 firstname, 3 email, 4 job, or 5 signature parameter to htdocs/user/card.php...

CVE-2016-1912

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.8.3 allow remote authenticated users to inject arbitrary web script or HTML via the 1 lastname, 2 firstname, 3 email, 4 job, or 5 signature parameter to htdocs/user/card.php...

CVE-2016-1912

CVE-2016-1912 describes multiple XSS vulnerabilities in Dolibarr ERP/CRM 3.8.3, where remote authenticated users can inject arbitrary script/HTML via htdocs/user/card.php parameters: lastname, firstname, email, job, or signature. The root cause is inadequate input filtering on these fields, as no...

CVE-2015-8685

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.8.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 external calendar url or 2 the bank name field in the "import external calendar" page...

CVE-2015-8685

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.8.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 external calendar url or 2 the bank name field in the "import external calendar" page...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.8.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 external calendar url or 2 the bank name field in the "import external calendar" page...

CVE-2015-8685

CVE-2015-8685 affects Dolibarr ERP/CRM (3.8.3 and earlier). The issue is multiple cross-site scripting (XSS) vulnerabilities where untrusted data is not properly escaped in two fields on the import external calendar page: (1) the external calendar URL and (2) the Bank Name field. This allows remo...

CVE-2015-8685

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.8.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 external calendar url or 2 the bank name field in the "import external calendar" page...

CVE-2016-1912: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.8.3 allow remote authenticated users to inject arbitrary web script or HTML via the 1 lastname, 2 firstname, 3 email, 4 job, or 5 signature parameter to htdocs/user/card.php...

PT-2016-4918

Name of the Vulnerable Software and Affected Versions Dolibarr ERP/CRM version 3.8.3 Description The issue allows remote authenticated users to inject arbitrary web script or HTML via specific parameters to the "htdocs/user/card.php" endpoint, including the lastname, firstname, email, job, or...

CVE-2015-8685: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.8.3 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 external calendar url or 2 the bank name field in the "import external calendar" page...

PT-2016-3952

Name of the Vulnerable Software and Affected Versions Dolibarr ERP/CRM versions 3.8.3 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via the external calendar URL or the bank name field in the import external calendar page. This can lead to...

OpenBravo Hibernate HQL Injection

Title: OpenBravo Hibernate HQL Injection Vulnerability Author: Sam Ng, HPE Software Security Research Team Vendor Patch: 3.0PR15Q3.4 and 3.0PR15Q4.1 Vendor Reference: https://issues.openbravo.com/view.php?id=31577, http://wiki.openbravo.com/wiki/ReleaseNotes/3.0PR15Q3.4,...

票友 ERP 管理系统 <=10.5.6 Ajax/users.ashx 未授权访问

No description provided by source...

票友 ERP 管理系统 <=10.5.6 未授权访问漏洞

No description provided by source...

Hackers Can Abuse SAP Apps Connected to SCADA

Much in the same way the Target hackers used a HVAC management system to catapult onto the corporate network, attackers focused on oil and gas and other critical industries may be finding similar openings via enterprise applications such as SAP. Researchers from ERPScan, during last week’s Black...

SAP HANA Security Patches

Critical business applications such as SAP and Oracle ERP products process and store the Fortune 2000’s most critical data, yet spur relatively little concern when it comes to security vulnerabilities. That trend seems to be reversing itself, given the spate of disclosures and high-profile...

erp-sjisystem.com XSS vulnerability

Vulnerable URL: https://www.erp-sjisystem.com/login.php?msg=%22%3E%3Csvg/onload=prompt%28/XSSPOSED/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 25.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated...

用友多个系统通用漏洞设计缺陷(自带已保存的口令)

简要描述： 详细说明： 默认密码 其实是根本不用输入密码，账号密码自动保存，点确认就登入了、 导致 源码泄露 可调试 源码 这套 系统很多套用友系统都带着，具体请看 WooYun: 用友多个系统通用漏洞导致接口信息泄露引发多数据库信息泄露（涉及多个大型厂商） 然后从这个得来的灵感 http://gpms.foton.com.cn/uapws/ http://erp.suning.com.cn/uapws/ http://fm2.cscec.com/uapws/ http://bap.ufida.com/uapws/ http://61.178.99.236:9002/uapws/...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 3.5 and 3.6 allow remote attackers to inject arbitrary web script or HTML via the Business Search searchnom field to 1 htdocs/societe/societe.php or 2 htdocs/societe/admin/societe.php...