netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-4hf3-229w-6h8r
GHSA-4qq9-qg7j-fcm9
GHSA-726g-cgcq-4xw8
GHSA-84gh-4m36-cgqx
GHSA-9h46-g4c9-7976
GHSA-fvxr-767j-f28v
GHSA-m44p-cfwj-wwr6
GHSA-m5c3-3gvf-q8j5
GHSA-m9q9-4m25-23gc
GHSA-p2fm-8rhj-58fr
GHSA-pm57-926c-28mr
GHSA-r4gf-ggp5-25g5
GHSA-rr5g-rc28-wxwj
GHSA-4qq9-qg7j-fcm9
This commit is contained in:
advisory-database[bot]
2024-04-24 20:40:55 +00:00
parent c7600fb7a0
commit ebee53a429
14 changed files with 327 additions and 97 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2022/05/GHSA-4hf3-229w-6h8r/GHSA-4hf3-229w-6h8r.json → advisories/github-reviewed/2022/05/GHSA-4hf3-229w-6h8r/GHSA-4hf3-229w-6h8r.json
+17 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4hf3-229w-6h8r",
"modified": "2022-11-17T18:30:30Z",
"modified": "2024-04-24T20:39:13Z",
"published": "2022-05-24T17:07:29Z",
"aliases": [
"CVE-2020-7994"
],
"summary": "Dolibarr cross-site scripting (XSS) vulnerability",
"details": "Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 10.0.6 allow remote attackers to inject arbitrary web script or HTML via the (1) label[libelle] parameter to the /htdocs/admin/dict.php?id=3 page; the (2) name[constname] parameter to the /htdocs/admin/const.php?mainmenu=home page; the (3) note[note] parameter to the /htdocs/admin/dict.php?id=10 page; the (4) zip[MAIN_INFO_SOCIETE_ZIP] or email[mail] parameter to the /htdocs/admin/company.php page; the (5) url[defaulturl], field[defaultkey], or value[defaultvalue] parameter to the /htdocs/admin/defaultvalues.php page; the (6) key[transkey] or key[transvalue] parameter to the /htdocs/admin/translation.php page; or the (7) [main_motd] or [main_home] parameter to the /htdocs/admin/ihm.php page.",
"severity": [
{
@@ -14,13 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "dolibarr/dolibarr"
},
"versions": [
"10.0.6"
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7994"
},
{
"type": "PACKAGE",
"url": "https://github.com/Dolibarr/dolibarr"
},
{
"type": "WEB",
"url": "https://github.com/tufangungor/tufangungor.github.io/blob/master/0days.md"
@@ -35,8 +48,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T20:39:13Z",
"nvd_published_at": "2020-01-26T23:15:00Z"
}
}
advisories/github-reviewed/2022/05/GHSA-4qq9-qg7j-fcm9/GHSA-4qq9-qg7j-fcm9.json
+73
View File
@@ -0,0 +1,73 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4qq9-qg7j-fcm9",
"modified": "2024-04-24T20:40:10Z",
"published": "2022-05-24T16:53:44Z",
"aliases": [
"CVE-2019-15062"
],
"summary": "Dolibarr Cross-Site Request Forgery (CSRF) ",
"details": "An issue was discovered in Dolibarr. A user can store an IFRAME element (containing a user/card.php CSRF request) in his Linked Files settings page. When visited by the admin, this could completely take over the admin account. (The protection mechanism for CSRF is to check the Referer header; however, because the attack is from one of the application's own settings pages, this mechanism is bypassed.)",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "dolibarr/dolibarr"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "10.0"
},
{
"fixed": "10.0.2"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15062"
},
{
"type": "WEB",
"url": "https://github.com/Dolibarr/dolibarr/issues/11671"
},
{
"type": "WEB",
"url": "https://github.com/Dolibarr/dolibarr/commit/18eb2a83fe7c2d01bdb34cceec389a6f9541e1f6"
},
{
"type": "WEB",
"url": "https://github.com/Dolibarr/dolibarr/commit/d21e5571007d2052a6b5f80a67b6f4cac693584a"
},
{
"type": "WEB",
"url": "https://gauravnarwani.com/publications/CVE-2019-15062"
},
{
"type": "PACKAGE",
"url": "https://github.com/Dolibarr/dolibarr"
}
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T20:40:10Z",
"nvd_published_at": "2019-08-14T23:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-726g-cgcq-4xw8/GHSA-726g-cgcq-4xw8.json → advisories/github-reviewed/2022/05/GHSA-726g-cgcq-4xw8/GHSA-726g-cgcq-4xw8.json
+27 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-726g-cgcq-4xw8",
"modified": "2022-05-14T03:23:30Z",
"modified": "2024-04-24T20:40:25Z",
"published": "2022-05-14T03:23:30Z",
"aliases": [
"CVE-2017-9838"
],
"summary": "Dolibarr Cross-Site Scripting (XSS) vulnerability",
"details": "Dolibarr ERP/CRM is affected by multiple reflected Cross-Site Scripting (XSS) vulnerabilities in versions before 5.0.4: index.php (leftmenu parameter), core/ajax/box.php (PATH_INFO), product/stats/card.php (type parameter), holiday/list.php (month_create, month_start, and month_end parameters), and don/card.php (societe, lastname, firstname, address, zipcode, town, and email parameters).",
"severity": [
{
@@ -14,13 +15,35 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "dolibarr/dolibarr"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.0.4"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9838"
},
{
"type": "PACKAGE",
"url": "https://github.com/Dolibarr/dolibarr"
},
{
"type": "WEB",
"url": "https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-008"
@@ -31,8 +54,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T20:40:25Z",
"nvd_published_at": "2018-04-11T03:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-84gh-4m36-cgqx/GHSA-84gh-4m36-cgqx.json → advisories/github-reviewed/2022/05/GHSA-84gh-4m36-cgqx/GHSA-84gh-4m36-cgqx.json
+27 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-84gh-4m36-cgqx",
"modified": "2022-05-14T03:23:30Z",
"modified": "2024-04-24T20:40:30Z",
"published": "2022-05-14T03:23:30Z",
"aliases": [
"CVE-2017-9839"
],
"summary": "Dolibarr SQL injection via type parameter in product/stats/card.php",
"details": "Dolibarr ERP/CRM is affected by SQL injection in versions before 5.0.4 via product/stats/card.php (type parameter).",
"severity": [
{
@@ -14,13 +15,35 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "dolibarr/dolibarr"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.0.4"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-9839"
},
{
"type": "PACKAGE",
"url": "https://github.com/Dolibarr/dolibarr"
},
{
"type": "WEB",
"url": "https://www.wizlynxgroup.com/security-research-advisories/vuln/WLX-2017-010"
@@ -31,8 +54,8 @@
"CWE-89"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T20:40:30Z",
"nvd_published_at": "2018-04-11T03:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-9h46-g4c9-7976/GHSA-9h46-g4c9-7976.json → advisories/github-reviewed/2022/05/GHSA-9h46-g4c9-7976/GHSA-9h46-g4c9-7976.json
+18 -5
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-9h46-g4c9-7976",
"modified": "2022-11-17T18:30:29Z",
"modified": "2024-04-24T20:39:27Z",
"published": "2022-05-24T16:57:07Z",
"aliases": [
"CVE-2019-16688"
],
"summary": "Dolibarr stored Cross-site Scripting in an Email Template section",
"details": "Dolibarr 9.0.5 has stored XSS in an Email Template section to mails_templates.php. A user with no privileges can inject script to attack the admin. (This stored XSS can affect all types of user privilege from Admin to users with no permissions.)",
"severity": [
{
@@ -14,13 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "dolibarr/dolibarr"
},
"versions": [
"9.0.5"
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16688"
},
{
"type": "PACKAGE",
"url": "https://github.com/Dolibarr/dolibarr"
},
{
"type": "WEB",
"url": "http://verneet.com/cve-2019-16688"
@@ -30,9 +43,9 @@
"cwe_ids": [
"CWE-79"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T20:39:27Z",
"nvd_published_at": "2019-09-27T20:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-fvxr-767j-f28v/GHSA-fvxr-767j-f28v.json → advisories/github-reviewed/2022/05/GHSA-fvxr-767j-f28v/GHSA-fvxr-767j-f28v.json
+17 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fvxr-767j-f28v",
"modified": "2022-11-17T18:30:29Z",
"modified": "2024-04-24T20:39:37Z",
"published": "2022-05-24T16:57:07Z",
"aliases": [
"CVE-2019-16685"
],
"summary": "Dolibarr stored Cross-site Scripting vulnerability",
"details": "Dolibarr 9.0.5 has stored XSS vulnerability via a User Group Description section to card.php. A user with the \"Create/modify other users, groups and permissions\" privilege can inject script and can also achieve privilege escalation.",
"severity": [
{
@@ -14,13 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "dolibarr/dolibarr"
},
"versions": [
"9.0.5"
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16685"
},
{
"type": "PACKAGE",
"url": "https://github.com/Dolibarr/dolibarr"
},
{
"type": "WEB",
"url": "http://verneet.com/cve-2019-16685"
@@ -31,8 +44,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T20:39:37Z",
"nvd_published_at": "2019-09-27T20:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-m44p-cfwj-wwr6/GHSA-m44p-cfwj-wwr6.json → advisories/github-reviewed/2022/05/GHSA-m44p-cfwj-wwr6/GHSA-m44p-cfwj-wwr6.json
+18 -5
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m44p-cfwj-wwr6",
"modified": "2022-11-17T18:30:29Z",
"modified": "2024-04-24T20:39:34Z",
"published": "2022-05-24T16:57:07Z",
"aliases": [
"CVE-2019-16686"
],
"summary": "Dolibarr Cross-site Scripting in a User Note section",
"details": "Dolibarr 9.0.5 has stored XSS in a User Note section to note.php. A user with no privileges can inject script to attack the admin.",
"severity": [
{
@@ -14,13 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "dolibarr/dolibarr"
},
"versions": [
"9.0.5"
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16686"
},
{
"type": "PACKAGE",
"url": "https://github.com/Dolibarr/dolibarr"
},
{
"type": "WEB",
"url": "http://verneet.com/cve-2019-16686"
@@ -30,9 +43,9 @@
"cwe_ids": [
"CWE-79"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T20:39:33Z",
"nvd_published_at": "2019-09-27T20:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-m5c3-3gvf-q8j5/GHSA-m5c3-3gvf-q8j5.json → advisories/github-reviewed/2022/05/GHSA-m5c3-3gvf-q8j5/GHSA-m5c3-3gvf-q8j5.json
+18 -5
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m5c3-3gvf-q8j5",
"modified": "2022-05-24T17:07:30Z",
"modified": "2024-04-24T20:40:17Z",
"published": "2022-05-24T17:07:30Z",
"aliases": [
"CVE-2020-7995"
],
"summary": "Dolibarr Improper Restriction of Excessive Authentication Attempts",
"details": "The htdocs/index.php?mainmenu=home login page in Dolibarr 10.0.6 allows an unlimited rate of failed authentication attempts.",
"severity": [
{
@@ -14,13 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "dolibarr/dolibarr"
},
"versions": [
"10.0.6"
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7995"
},
{
"type": "PACKAGE",
"url": "https://github.com/Dolibarr/dolibarr"
},
{
"type": "WEB",
"url": "https://github.com/tufangungor/tufangungor.github.io/blob/master/_posts/2020-01-19-dolibarr-10.0.6-brute-force.md"
@@ -39,9 +52,9 @@
"CWE-287",
"CWE-307"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T20:40:17Z",
"nvd_published_at": "2020-01-26T23:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-m9q9-4m25-23gc/GHSA-m9q9-4m25-23gc.json → advisories/github-reviewed/2022/05/GHSA-m9q9-4m25-23gc/GHSA-m9q9-4m25-23gc.json
+18 -5
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-m9q9-4m25-23gc",
"modified": "2022-11-17T18:30:29Z",
"modified": "2024-04-24T20:39:30Z",
"published": "2022-05-24T16:57:07Z",
"aliases": [
"CVE-2019-16687"
],
"summary": "Dolibarr Cross-site Scripting in a User Profile in a Signature section",
"details": "Dolibarr 9.0.5 has stored XSS in a User Profile in a Signature section to card.php. A user with the \"Create/modify other users, groups and permissions\" privilege can inject script and can also achieve privilege escalation.",
"severity": [
{
@@ -14,13 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "dolibarr/dolibarr"
},
"versions": [
"9.0.5"
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16687"
},
{
"type": "PACKAGE",
"url": "https://github.com/Dolibarr/dolibarr"
},
{
"type": "WEB",
"url": "http://verneet.com/cve-2019-16687"
@@ -30,9 +43,9 @@
"cwe_ids": [
"CWE-79"
],
"severity": "LOW",
"github_reviewed": false,
"github_reviewed_at": null,
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T20:39:30Z",
"nvd_published_at": "2019-09-27T20:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-p2fm-8rhj-58fr/GHSA-p2fm-8rhj-58fr.json → advisories/github-reviewed/2022/05/GHSA-p2fm-8rhj-58fr/GHSA-p2fm-8rhj-58fr.json
+27 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-p2fm-8rhj-58fr",
"modified": "2022-05-14T03:20:23Z",
"modified": "2024-04-24T20:40:21Z",
"published": "2022-05-14T03:20:23Z",
"aliases": [
"CVE-2018-10095"
],
"summary": "Dolibarr Cross-site scripting (XSS) vulnerability",
"details": "Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "dolibarr/dolibarr"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "7.0.2"
}
]
}
]
}
],
"references": [
{
@@ -25,6 +44,10 @@
"type": "WEB",
"url": "https://github.com/Dolibarr/dolibarr/commit/1dc466e1fb687cfe647de4af891720419823ed56"
},
{
"type": "PACKAGE",
"url": "https://github.com/Dolibarr/dolibarr"
},
{
"type": "WEB",
"url": "https://github.com/Dolibarr/dolibarr/blob/7.0.2/ChangeLog"
@@ -43,8 +66,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T20:40:21Z",
"nvd_published_at": "2018-05-22T20:29:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-pm57-926c-28mr/GHSA-pm57-926c-28mr.json → advisories/github-reviewed/2022/05/GHSA-pm57-926c-28mr/GHSA-pm57-926c-28mr.json
+33 -7
View File
@@ -1,23 +1,49 @@
{
"schema_version": "1.4.0",
"id": "GHSA-pm57-926c-28mr",
"modified": "2022-05-24T17:11:33Z",
"modified": "2024-04-24T20:38:55Z",
"published": "2022-05-24T17:11:33Z",
"aliases": [
"CVE-2019-19212"
],
"summary": "Dolibarr Cross-site Scripting via the qty parameter in product/fournisseurs.php",
"details": "Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php (product price screen).",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "dolibarr/dolibarr"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "3.0"
},
{
"last_affected": "10.0.3"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19212"
},
{
"type": "PACKAGE",
"url": "https://github.com/Dolibarr/dolibarr"
},
{
"type": "WEB",
"url": "https://herolab.usd.de/en/security-advisories"
@@ -33,11 +59,11 @@
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T20:38:55Z",
"nvd_published_at": "2020-03-16T20:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-r4gf-ggp5-25g5/GHSA-r4gf-ggp5-25g5.json → advisories/github-reviewed/2022/05/GHSA-r4gf-ggp5-25g5/GHSA-r4gf-ggp5-25g5.json
+17 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-r4gf-ggp5-25g5",
"modified": "2022-11-17T18:30:29Z",
"modified": "2024-04-24T20:39:23Z",
"published": "2022-05-24T16:58:57Z",
"aliases": [
"CVE-2019-17577"
],
"summary": "Dolibarr Cross-site Scripting via outgoing email setup feature",
"details": "An issue was discovered in Dolibarr 10.0.2. It has XSS via the \"outgoing email setup\" feature in the admin/mails.php?action=edit URI via the \"Email used for error returns emails (fields 'Errors-To' in emails sent)\" field.",
"severity": [
{
@@ -14,13 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "dolibarr/dolibarr"
},
"versions": [
"10.0.2"
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17577"
},
{
"type": "PACKAGE",
"url": "https://github.com/Dolibarr/dolibarr"
},
{
"type": "WEB",
"url": "https://mycvee.blogspot.com/p/cve-2019-17576.html"
@@ -31,8 +44,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T20:39:23Z",
"nvd_published_at": "2019-10-16T18:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-rr5g-rc28-wxwj/GHSA-rr5g-rc28-wxwj.json → advisories/github-reviewed/2022/05/GHSA-rr5g-rc28-wxwj/GHSA-rr5g-rc28-wxwj.json
+17 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-rr5g-rc28-wxwj",
"modified": "2022-11-17T18:30:29Z",
"modified": "2024-04-24T20:39:20Z",
"published": "2022-05-24T16:58:57Z",
"aliases": [
"CVE-2019-17576"
],
"summary": "Dolibarr Cross-site Scripting via outgoing email setup feature",
"details": "An issue was discovered in Dolibarr 10.0.2. It has XSS via the \"outgoing email setup\" feature in the /admin/mails.php?action=edit URI via the \"Send all emails to (instead of real recipients, for test purposes)\" field.",
"severity": [
{
@@ -14,13 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "dolibarr/dolibarr"
},
"versions": [
"10.0.2"
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17576"
},
{
"type": "PACKAGE",
"url": "https://github.com/Dolibarr/dolibarr"
},
{
"type": "WEB",
"url": "https://mycvee.blogspot.com/p/blog-page.html"
@@ -31,8 +44,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-04-24T20:39:20Z",
"nvd_published_at": "2019-10-16T18:15:00Z"
}
}
advisories/unreviewed/2022/05/GHSA-4qq9-qg7j-fcm9/GHSA-4qq9-qg7j-fcm9.json
-42
View File
@@ -1,42 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-4qq9-qg7j-fcm9",
"modified": "2022-11-17T18:30:28Z",
"published": "2022-05-24T16:53:44Z",
"aliases": [
"CVE-2019-15062"
],
"details": "An issue was discovered in Dolibarr 11.0.0-alpha. A user can store an IFRAME element (containing a user/card.php CSRF request) in his Linked Files settings page. When visited by the admin, this could completely take over the admin account. (The protection mechanism for CSRF is to check the Referer header; however, because the attack is from one of the application's own settings pages, this mechanism is bypassed.)",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15062"
},
{
"type": "WEB",
"url": "https://github.com/Dolibarr/dolibarr/issues/11671"
},
{
"type": "WEB",
"url": "https://gauravnarwani.com/publications/CVE-2019-15062"
}
],
"database_specific": {
"cwe_ids": [
"CWE-352"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-08-14T23:15:00Z"
}
}