Malicious code in @subscription-info/bff (npm)

The package @subscription-info/bff was found to contain malicious code...

CVE-2021-0641

In getAvailableSubscriptionInfoList of SubscriptionController.java, there is a possible disclosure of unique identifiers due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...

CVE-2021-0641

In getAvailableSubscriptionInfoList of SubscriptionController.java, there is a possible disclosure of unique identifiers due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...

Semrush: Broken validation of user Id for JWT Token

Traffic Analytics Tool TA uses JWT tokens to store user subscription information without any kind of personal information. JWT tokens are created by passing a user ID. There was an error with validation of user Id for JWT token...

UBUNTU-CVE-2017-17899

SQL injection vulnerability in adherents/subscription/info.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the rowid parameter...

Dolibarr ERP/CRM SQL Injection Vulnerability (CNVD-2018-01643)

Dolibarr ERP/CRM is a Web-based enterprise resource planning ERP and customer relationship management CRM system from the Dolibarr Foundation in France. The system can be used to manage products, inventory, invoices, orders, and more. An SQL injection vulnerability exists in the...

PT-2017-15084 · Dolibarr · Dolibarr Erp/Crm

Name of the Vulnerable Software and Affected Versions: Dolibarr ERP/CRM version 6.0.4 Description: The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the rowid parameter in the adherents/subscription/info.php file. Recommendations: For version 6.0.4, conside...