CVE-2017-10805

The CVE describes an OAuth token access-control flaw in Odoo: in Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, an incorrect access-control on OAuth tokens in the OAuth module allows remote authenticated users to hijack OAuth sessions of other users. Affe...

CVE-2017-10804

CVE-2017-10804 affects Odoo 8.0, Odoo Community Edition 9.0/10.0, and Odoo Enterprise Edition 9.0/10.0. The root cause is that parameters containing 0x00 characters are truncated before reaching the database layer due to using Psycopg 2.x before 2.6.3. This enables remote attackers to bypass auth...

CVE-2017-10805

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, incorrect access control on OAuth tokens in the OAuth module allows remote authenticated users to hijack OAuth sessions of other users...

CVE-2017-10805

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, incorrect access control on OAuth tokens in the OAuth module allows remote authenticated users to hijack OAuth sessions of other users...

CVE-2017-10804

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, remote attackers can bypass authentication under certain circumstances because parameters containing 0x00 characters are truncated before reaching the database layer. This occurs because Psycopg 2.x before...

CVE-2017-10803

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, insecure handling of anonymization data in the Database Anonymization module allows remote authenticated privileged users to execute arbitrary Python code, because unpickle is used...

CVE-2017-10803

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, insecure handling of anonymization data in the Database Anonymization module allows remote authenticated privileged users to execute arbitrary Python code, because unpickle is used...

CVE-2017-10803

Vulnerability summary: CVE-2017-10803 affects Odoo 8.0, Odoo Community Edition 9.0/10.0, and Odoo Enterprise Edition 9.0/10.0. The issue resides in the Database Anonymization module, where insecure handling of anonymization data uses Python’s pickle/unpickle, enabling arbitrary Python code execut...

CVE-2017-10804

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, remote attackers can bypass authentication under certain circumstances because parameters containing 0x00 characters are truncated before reaching the database layer. This occurs because Psycopg 2.x before...

CVE-2017-10805: Incorrect Authorization

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, incorrect access control on OAuth tokens in the OAuth module allows remote authenticated users to hijack OAuth sessions of other users...

CVE-2017-10804: Missing Authentication for Critical Function

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, remote attackers can bypass authentication under certain circumstances because parameters containing 0x00 characters are truncated before reaching the database layer. This occurs because Psycopg 2.x before...

CVE-2017-10803: Deserialization of Untrusted Data

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, insecure handling of anonymization data in the Database Anonymization module allows remote authenticated privileged users to execute arbitrary Python code, because unpickle is used...

Odoo CRM 10.0 - Code Execution

Odoo CRM 10.0 - Code Execution Vulnerability Summary The following advisory describe arbitrary Python code execution found in Odoo CRM version 10.0 Odoo is a suite of open source business apps that cover all your company needs: CRM, eCommerce, accounting, inventory, point of sale, project...

Odoo CRM 10.0 - Code Execution

Vulnerability Summary The following advisory describe arbitrary Python code execution found in Odoo CRM version 10.0 Odoo is a suite of open source business apps that cover all your company needs: CRM, eCommerce, accounting, inventory, point of sale, project management, etc. Odoo’s unique value...

Odoo Directory Traversal Vulnerability

Odoo formerly known as OpenERP is an enterprise resource planning ERP and customer relationship management CRM system. The system is developed using Python language , PostgreSQL as the database , and includes modules such as sales management , inventory management , financial management , and...

CVE-2017-9416

Directory traversal vulnerability in tools.fileopen in Odoo 8.0, 9.0, and 10.0 allows remote authenticated users to read arbitrary local files readable by the Odoo service...

CVE-2017-9416

Directory traversal vulnerability in tools.fileopen in Odoo 8.0, 9.0, and 10.0 allows remote authenticated users to read arbitrary local files readable by the Odoo service...

Directory traversal

Directory traversal vulnerability in tools.fileopen in Odoo 8.0, 9.0, and 10.0 allows remote authenticated users to read arbitrary local files readable by the Odoo service...

CVE-2017-9416: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in tools.fileopen in Odoo 8.0, 9.0, and 10.0 allows remote authenticated users to read arbitrary local files readable by the Odoo service...

CVE-2017-9416

Odoo 8.0/9.0/10.0 are vulnerable to Local File Inclusion via tools.file_open. The root cause is a directory traversal flaw that allows a remote authenticated user to read arbitrary files readable by the Odoo service. The nuclei template confirms the affected versions and impact (read arbitrary se...