Dolibarr ERP CRM 3.7.0

CPE Details

Dolibarr ERP CRM 3.7.0
dolibarr
dolibarr_erp\/crm
3.7.0
2019-06-15
18h48 +00:00
2022-11-17
16h21 +00:00
CPE NVD
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
Gestion des notifications

CPE Name: cpe:2.3:a:dolibarr:dolibarr_erp\/crm:3.7.0:-:*:*:*:*:*:*

Informations

Vendor

dolibarr

Product

dolibarr_erp\/crm

Version

3.7.0

Update

-

Related CVE

Open and find in CVE List

CVE ID Publié Description Score Gravité
CVE-2021-3991 2024-11-15 10h52 +00:00 An Improper Authorization vulnerability exists in Dolibarr versions prior to the 'develop' branch. A user with restricted permissions in the 'Reception' section is able to access specific reception details via direct URL access, bypassing the intended permission restrictions.
4.3
Moyen
CVE-2023-4198 2023-11-01 08h01 +00:00 Improper Access Control in Dolibarr ERP CRM <= v17.0.3 allows an unauthorized authenticated user to read a database table containing customer data
6.5
Moyen
CVE-2023-4197 2023-11-01 07h58 +00:00 Improper input validation in Dolibarr ERP CRM <= v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker to inject and evaluate arbitrary PHP code.
8.8
Haute
CVE-2023-5842 2023-10-30 00h00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository dolibarr/dolibarr prior to 16.0.5.
4.8
Moyen
CVE-2023-5323 2023-10-01 00h00 +00:00 Cross-site Scripting (XSS) - Generic in GitHub repository dolibarr/dolibarr prior to 18.0.
6.1
Moyen
CVE-2023-38886 2023-09-19 22h00 +00:00 An issue in Dolibarr ERP CRM v.17.0.1 and before allows a remote privileged attacker to execute arbitrary code via a crafted command/script.
7.2
Haute
CVE-2023-38887 2023-09-19 22h00 +00:00 File Upload vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to execute arbitrary code and obtain sensitive information via the extension filtering and renaming functions.
8.8
Haute
CVE-2023-38888 2023-09-19 22h00 +00:00 Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the REST API module, related to analyseVarsForSqlAndScriptsInjection and testSqlAndScriptInject.
9.6
Critique
CVE-2023-30253 2023-05-28 22h00 +00:00 Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation:
8.8
Haute
CVE-2022-43138 2022-11-16 23h00 +00:00 Dolibarr Open Source ERP & CRM for Business before v14.0.1 allows attackers to escalate privileges via a crafted API.
9.8
Critique
CVE-2022-40871 2022-10-11 22h00 +00:00 Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection. By default, any administrator can be added to the installation page of dolibarr, and if successfully added, malicious code can be inserted into the database and then execute it by eval.
9.8
Critique
CVE-2022-2060 2022-06-13 06h50 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository dolibarr/dolibarr prior to 16.0.
5.4
Moyen
CVE-2022-0819 2022-03-02 14h40 +00:00 Code Injection in GitHub repository dolibarr/dolibarr prior to 15.0.1.
8.8
Haute
CVE-2022-0746 2022-02-25 08h05 +00:00 Business Logic Errors in GitHub repository dolibarr/dolibarr prior to 16.0.
4.3
Moyen
CVE-2022-0731 2022-02-23 17h35 +00:00 Improper Access Control (IDOR) in GitHub repository dolibarr/dolibarr prior to 16.0.
6.5
Moyen
CVE-2022-0414 2022-01-30 23h00 +00:00 Improper Validation of Specified Quantity in Input in Packagist dolibarr/dolibarr prior to 16.0.
4.3
Moyen
CVE-2022-0224 2022-01-14 16h35 +00:00 dolibarr is vulnerable to Improper Neutralization of Special Elements used in an SQL Command
9.8
Critique
CVE-2022-0174 2022-01-10 16h30 +00:00 Improper Validation of Specified Quantity in Input vulnerability in dolibarr dolibarr/dolibarr.
4.3
Moyen
CVE-2017-18259 2018-04-11 01h00 +00:00 Dolibarr ERP/CRM is affected by stored Cross-Site Scripting (XSS) in versions through 7.0.0.
5.4
Moyen
CVE-2017-18260 2018-04-11 01h00 +00:00 Dolibarr ERP/CRM is affected by multiple SQL injection vulnerabilities in versions through 7.0.0 via comm/propal/list.php (viewstatut parameter) or comm/propal/list.php (propal_statut parameter, aka search_statut parameter).
8.8
Haute
CVE-2017-9838 2018-04-11 01h00 +00:00 Dolibarr ERP/CRM is affected by multiple reflected Cross-Site Scripting (XSS) vulnerabilities in versions before 5.0.4: index.php (leftmenu parameter), core/ajax/box.php (PATH_INFO), product/stats/card.php (type parameter), holiday/list.php (month_create, month_start, and month_end parameters), and don/card.php (societe, lastname, firstname, address, zipcode, town, and email parameters).
5.4
Moyen
CVE-2017-9839 2018-04-11 01h00 +00:00 Dolibarr ERP/CRM is affected by SQL injection in versions before 5.0.4 via product/stats/card.php (type parameter).
8.8
Haute