CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2019-19211
https://notcve.org/view.php?id=CVE-2019-19211
16 Mar 2020 — Dolibarr ERP/CRM before 10.0.3 has an Insufficient Filtering issue that can lead to user/card.php XSS. Dolibarr ERP/CRM versiones anteriores a 10.0.3, presenta un problema de Filtrado Insuficiente que puede conllevar a un ataque de tipo XSS del archivo user/card.php • https://herolab.usd.de/en/security-advisories • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2019-19210
https://notcve.org/view.php?id=CVE-2019-19210
16 Mar 2020 — Dolibarr ERP/CRM before 10.0.3 allows XSS because uploaded HTML documents are served as text/html despite being renamed to .noexe files. Dolibarr ERP/CRM versiones anteriores a 10.0.3, permite un ataque de tipo XSS porque los documentos HTML cargados son servidos como text/html a pesar de ser renombrados como archivos .noexe. • https://herolab.usd.de/en/security-advisories • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 1CVE-2019-19209
https://notcve.org/view.php?id=CVE-2019-19209
16 Mar 2020 — Dolibarr ERP/CRM before 10.0.3 allows SQL Injection. Dolibarr ERP/CRM versiones anteriores a 10.0.3, permite una Inyección SQL. • https://herolab.usd.de/en/security-advisories • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2020-9016
https://notcve.org/view.php?id=CVE-2020-9016
16 Feb 2020 — Dolibarr 11.0 allows XSS via the joinfiles, topic, or code parameter, or the HTTP Referer header. Dolibarr versión 11.0, permite un ataque de tipo XSS por medio de los parámetros joinfiles, topic, o code, o el encabezado Referer HTTP. • https://code610.blogspot.com/2020/02/this-time-i-tried-to-check-one-of.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2020-7994
https://notcve.org/view.php?id=CVE-2020-7994
26 Jan 2020 — Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 10.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) label[libelle] parameter to the /htdocs/admin/dict.php?id=3 page; the (2) name[constname] parameter to the /htdocs/admin/const.php?mainmenu=home page; the (3) note[note] parameter to the /htdocs/admin/dict.php?id=10 page; the (4) zip[MAIN_INFO_SOCIETE_ZIP] or email[mail] parameter to the /htdocs/admin/company.php page; the (5) url[defaulturl], field[defaultkey], or... • https://github.com/tufangungor/tufangungor.github.io/blob/master/0days.md • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 2CVE-2020-7995 – Dolibarr ERP/CRM 10.0.6 Login Brute Forcer
https://notcve.org/view.php?id=CVE-2020-7995
26 Jan 2020 — The htdocs/index.php?mainmenu=home login page in Dolibarr 10.0.6 allows an unlimited rate of failed authentication attempts. La página de inicio de sesión htdocs/index.php?mainmenu=home en Dolibarr versión 10.0.6, permite una tasa ilimitada de intentos de autenticación fallidos. • https://packetstorm.news/files/id/163541 • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2020-7996
https://notcve.org/view.php?id=CVE-2020-7996
26 Jan 2020 — htdocs/user/passwordforgotten.php in Dolibarr 10.0.6 allows XSS via the Referer HTTP header. El archivo htdocs/user/passwordforgotten.php en Dolibarr versión 10.0.6, permite un ataque de tipo XSS por medio del encabezado HTTP Referer. • https://github.com/tufangungor/tufangungor.github.io/blob/master/_posts/2020-01-19-dolibarr-10.0.6-xss-in-http-header.md • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2019-19206
https://notcve.org/view.php?id=CVE-2019-19206
26 Nov 2019 — Dolibarr CRM/ERP 10.0.3 allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile picture. Dolibarr CRM/ERP versión 10.0.3, permite un ataque de tipo XSS almacenado de viewimage.php?File= debido a la ejecución de JavaScript en una imagen SVG para una imagen de perfil. • https://medium.com/%40k43p/cve-2019-19206-stored-xss-due-to-javascript-execution-in-an-svg-file-ee1d038fba76 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 3%CPEs: 1EXPL: 0CVE-2013-2093
https://notcve.org/view.php?id=CVE-2013-2093
20 Nov 2019 — Dolibarr ERP/CRM 3.3.1 does not properly validate user input in viewimage.php and barcode.lib.php which allows remote attackers to execute arbitrary commands. Dolibarr ERP/CRM versión 3.3.1 no valida apropiadamente la entrada del usuario en los archivos viewimage.php y barcode.lib.php, lo que permite a atacantes remotos ejecutar comandos arbitrarios. • http://www.openwall.com/lists/oss-security/2013/05/14/3 • CWE-20: Improper Input Validation •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2013-2092
https://notcve.org/view.php?id=CVE-2013-2092
20 Nov 2019 — Cross-site Scripting (XSS) in Dolibarr ERP/CRM 3.3.1 allows remote attackers to inject arbitrary web script or HTML in functions.lib.php. Una vulnerabilidad de tipo Cross-site Scripting (XSS) en Dolibarr ERP/CRM versión 3.3.1, permite a atacantes remotos inyectar script web o HTML arbitrario en el archivo functions.lib.php. • http://www.openwall.com/lists/oss-security/2013/05/14/3 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •