Skip to content
OpenAdvisories

Package · Debian

tryton-server

12 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 6.5
    CVE-2025-66424

    trytond does not enforce access rights for data export

    Tryton trytond 6.0 before 7.6.11 does not enforce access rights for data export. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.

    Tryton trytond trytond tryton-server Debian Ubuntu PyPI
  • Medium 4.3
    CVE-2025-66422

    trytond allows remote attackers to obtain sensitive trace-back (server setup) information

    Tryton trytond before 7.6.11 allows remote attackers to obtain sensitive trace-back (server setup) information. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.70.

    Tryton trytond trytond tryton-server Debian Ubuntu PyPI
  • Medium 6.5
    CVE-2022-26661

    Improper Restriction of XML External Entity Reference in trytond and proteus

    An XXE issue was discovered in Tryton Application Platform (Server) 5.x through 5.0.45, 6.x through 6.0.15, and 6.1.x and 6.2.x through 6.2.5, and Tryton Application Platform (Command Line Client (proteus)) 5.x through 5.0.11, 6.x through 6.0.4, and 6.1.x and…

    trytond tryton-server tryton-server tryton Debian Ubuntu PyPI
  • Medium 4.3
    CVE-2019-10868

    Tryton Improper Access Control

    In trytond/model/modelstorage.py in Tryton 4.2 before 4.2.21, 4.4 before 4.4.19, 4.6 before 4.6.14, 4.8 before 4.8.10, and 5.0 before 5.0.6, an authenticated user can order records based on a field for which he has no access right. This may allow the user to …

    trytond tryton-server tryton-server Debian Ubuntu PyPI
  • Medium 5.3
    CVE-2017-0360

    Tryton Information Disclosure Vulnerability

    file_open in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated users with certain permissions to read arbitrary files via a "same root name but with a suffix" attack. NOTE: This vulnerability exists because of an incomplete fix for CVE-2016-1242.

    trytond tryton-server tryton-server Debian Ubuntu PyPI
  • Medium 4.4
    CVE-2016-1242

    Tryton allow authenticated users with certain permissions to read arbitrary files via the name parameter

    file_open in Tryton before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allows remote authenticated users with certain permissions to read arbitrary files via the name parameter or unspecified other vectors.

    trytond tryton-server tryton-server tryton Debian Ubuntu PyPI
  • Medium 5.3
    CVE-2016-1241

    Tryton allows users to read the hashed password

    Tryton 3.x before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allow remote authenticated users to discover user password hashes via unspecified vectors.

    trytond tryton-server tryton-server tryton Debian Ubuntu PyPI
  • Medium 4.3
    CVE-2015-0861

    trytond arbitrary fields write via a sequence of records

    model/modelstorage.py in trytond 3.2.x before 3.2.10, 3.4.x before 3.4.8, 3.6.x before 3.6.5, and 3.8.x before 3.8.1 allows remote authenticated users to bypass intended access restrictions and write to arbitrary fields via a sequence of records.

    trytond tryton-server Debian PyPI
  • Medium 6.5
    CVE-2012-0215

    Trytond allows modification of privileges of arbitrary users

    model/modelstorage.py in the Tryton application framework (trytond) before 2.4.0 for Python does not properly restrict access to the Many2Many field in the relation model, which allows remote authenticated users to modify the privileges of arbitrary users via…

    trytond tryton-server Debian PyPI