Dolibarr ERP CRM 9.0.1

CPE Details

Dolibarr ERP CRM 9.0.1
dolibarr
dolibarr_erp\/crm
9.0.1
2019-06-15
18h48 +00:00
2022-11-17
16h21 +00:00
CPE NVD
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
Gestion des notifications

CPE Name: cpe:2.3:a:dolibarr:dolibarr_erp\/crm:9.0.1:*:*:*:*:*:*:*

Informations

Vendor

dolibarr

Product

dolibarr_erp\/crm

Version

9.0.1

Related CVE

Open and find in CVE List

CVE ID Publié Description Score Gravité
CVE-2021-3991 2024-11-15 10h52 +00:00 An Improper Authorization vulnerability exists in Dolibarr versions prior to the 'develop' branch. A user with restricted permissions in the 'Reception' section is able to access specific reception details via direct URL access, bypassing the intended permission restrictions.
4.3
Moyen
CVE-2024-5315 2024-05-24 10h06 +00:00 Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters viewstatut in /dolibarr/commande/list.php.
9.1
Critique
CVE-2024-5314 2024-05-24 10h00 +00:00 Vulnerabilities in Dolibarr ERP - CRM that affect version 9.0.1 and allow SQL injection. These vulnerabilities could allow a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters sortorder y sortfield in /dolibarr/admin/dict.php.
9.1
Critique
CVE-2023-4198 2023-11-01 08h01 +00:00 Improper Access Control in Dolibarr ERP CRM <= v17.0.3 allows an unauthorized authenticated user to read a database table containing customer data
6.5
Moyen
CVE-2023-4197 2023-11-01 07h58 +00:00 Improper input validation in Dolibarr ERP CRM <= v18.0.1 fails to strip certain PHP code from user-supplied input when creating a Website, allowing an attacker to inject and evaluate arbitrary PHP code.
8.8
Haute
CVE-2023-5842 2023-10-30 00h00 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository dolibarr/dolibarr prior to 16.0.5.
4.8
Moyen
CVE-2023-5323 2023-10-01 00h00 +00:00 Cross-site Scripting (XSS) - Generic in GitHub repository dolibarr/dolibarr prior to 18.0.
6.1
Moyen
CVE-2023-38886 2023-09-19 22h00 +00:00 An issue in Dolibarr ERP CRM v.17.0.1 and before allows a remote privileged attacker to execute arbitrary code via a crafted command/script.
7.2
Haute
CVE-2023-38887 2023-09-19 22h00 +00:00 File Upload vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to execute arbitrary code and obtain sensitive information via the extension filtering and renaming functions.
8.8
Haute
CVE-2023-38888 2023-09-19 22h00 +00:00 Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the REST API module, related to analyseVarsForSqlAndScriptsInjection and testSqlAndScriptInject.
9.6
Critique
CVE-2023-30253 2023-05-28 22h00 +00:00 Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation:
8.8
Haute
CVE-2022-43138 2022-11-16 23h00 +00:00 Dolibarr Open Source ERP & CRM for Business before v14.0.1 allows attackers to escalate privileges via a crafted API.
9.8
Critique
CVE-2022-40871 2022-10-11 22h00 +00:00 Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection. By default, any administrator can be added to the installation page of dolibarr, and if successfully added, malicious code can be inserted into the database and then execute it by eval.
9.8
Critique
CVE-2022-2060 2022-06-13 06h50 +00:00 Cross-site Scripting (XSS) - Stored in GitHub repository dolibarr/dolibarr prior to 16.0.
5.4
Moyen
CVE-2022-0819 2022-03-02 14h40 +00:00 Code Injection in GitHub repository dolibarr/dolibarr prior to 15.0.1.
8.8
Haute
CVE-2022-0746 2022-02-25 08h05 +00:00 Business Logic Errors in GitHub repository dolibarr/dolibarr prior to 16.0.
4.3
Moyen
CVE-2022-0731 2022-02-23 17h35 +00:00 Improper Access Control (IDOR) in GitHub repository dolibarr/dolibarr prior to 16.0.
6.5
Moyen
CVE-2022-0414 2022-01-30 23h00 +00:00 Improper Validation of Specified Quantity in Input in Packagist dolibarr/dolibarr prior to 16.0.
4.3
Moyen
CVE-2022-0224 2022-01-14 16h35 +00:00 dolibarr is vulnerable to Improper Neutralization of Special Elements used in an SQL Command
9.8
Critique
CVE-2022-0174 2022-01-10 16h30 +00:00 Improper Validation of Specified Quantity in Input vulnerability in dolibarr dolibarr/dolibarr.
4.3
Moyen
CVE-2019-11201 2019-07-29 13h40 +00:00 Dolibarr ERP/CRM 9.0.1 provides a module named website that provides for creation of public websites with a WYSIWYG editor. It was identified that the editor also allowed inclusion of dynamic code, which can lead to code execution on the host machine. An attacker has to check a setting on the same page, which specifies the inclusion of dynamic content. Thus, a lower privileged user of the application can execute code under the context and permissions of the underlying web server.
8
Haute
CVE-2019-11200 2019-07-29 13h39 +00:00 Dolibarr ERP/CRM 9.0.1 provides a web-based functionality that backs up the database content to a dump file. However, the application performs insufficient checks on the export parameters to mysqldump, which can lead to execution of arbitrary binaries on the server. (Malicious binaries can be uploaded by abusing other functionalities of the application.)
8.8
Haute
CVE-2019-11199 2019-07-29 13h36 +00:00 Dolibarr ERP/CRM 9.0.1 was affected by stored XSS within uploaded files. These vulnerabilities allowed the execution of a JavaScript payload each time any regular user or administrative user clicked on the malicious link hosted on the same domain. The vulnerabilities could be exploited by low privileged users to target administrators. The viewimage.php page did not perform any contextual output encoding and would display the content within the uploaded file with a user-requested MIME type.
5.4
Moyen