Skip to content
OpenAdvisories

Package · Ubuntu

dolibarr

134 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

134 results · Feed

  • Critical 9.8
    CVE-2017-17897

    Dolibarr SQL injection vulnerability in comm/multiprix.php

    SQL injection vulnerability in comm/multiprix.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the id parameter.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Critical 9.8
    CVE-2017-17900

    Dolibarr SQL injection vulnerability in fourn/index.php

    SQL injection vulnerability in fourn/index.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the socid parameter.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Critical 9.8
    CVE-2017-17899

    Dolibarr SQL injection vulnerability in adherents/subscription/info.php

    SQL injection vulnerability in adherents/subscription/info.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the rowid parameter.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Medium 5.4
    CVE-2017-14239

    Dolibarr cross-site scripting (XSS) vulnerability

    Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr ERP/CRM 6.0.0 allow remote authenticated users to inject arbitrary web script or HTML via the (1) CompanyName, (2) CompanyAddress, (3) CompanyZip, (4) CompanyTown, (5) Fax, (6) EMail, (7) Web, (8…

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Medium 5.4
    CVE-2017-14241

    Dolibarr ERP and CRM contain XSS Vulnerability

    Cross-site scripting (XSS) vulnerability in Dolibarr ERP/CRM 6.0.0 allows remote authenticated users to inject arbitrary web script or HTML via the Title parameter to htdocs/admin/menus/edit.php.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Critical 9.8
    CVE-2017-14242

    Dolibarr SQL injection vulnerability in don/list.php

    SQL injection vulnerability in don/list.php in Dolibarr version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the statut parameter.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • High 7.5
    CVE-2017-14240

    Dolibarr ERP and CRM Sensitive Data Disclosure

    There is a sensitive information disclosure vulnerability in document.php in Dolibarr ERP/CRM version 6.0.0 via the file parameter.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Critical 9.8
    CVE-2017-14238

    Dolibarr SQL injection vulnerability in admin/menus/edit.php

    SQL injection vulnerability in admin/menus/edit.php in Dolibarr ERP/CRM version 6.0.0 allows remote attackers to execute arbitrary SQL commands via the menuId parameter.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • High 8.8
    CVE-2017-9840

    Dolibarr ERP and CRM Unsafe File Upload Vulnerability

    Dolibarr ERP/CRM 5.0.3 and prior allows low-privilege users to upload files of dangerous types, which can result in arbitrary code execution within the context of the vulnerable application.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Critical 9.8
    CVE-2017-9435

    Dolibarr ERP and CRM SQLi

    Dolibarr ERP/CRM before 5.0.3 is vulnerable to a SQL injection in user/index.php (search_supervisor and search_statut parameters).

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Critical 9.8
    CVE-2017-7886

    Dolibarr SQL Injection in doli/theme/eldy/style.css.php via the lang parameter

    Dolibarr ERP/CRM 4.0.4 has SQL Injection in doli/theme/eldy/style.css.php via the lang parameter.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Critical 9.8
    CVE-2017-7888

    Dolibarr ERP and CRM Insecure Encryption

    Dolibarr ERP/CRM 4.0.4 stores passwords with the MD5 algorithm, which makes brute-force attacks easier.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Medium 6.1
    CVE-2017-7887

    Dolibarr ERP and CRM contain XSS Vulnerability

    Dolibarr ERP/CRM 4.0.4 has XSS in doli/societe/list.php via the sall parameter.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Medium 6.8
    CVE-2017-8879

    Dolibarr allows password changes without supplying the current password

    Dolibarr ERP/CRM 4.0.4 allows password changes without supplying the current password, which makes it easier for physically proximate attackers to obtain access via an unattended workstation.

    dolibarr dolibarr/dolibarr Ubuntu Packagist