Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium5.4Cross-site scripting (XSS) issue in web module in Odoo Community 11.0 through 14.0 and Odoo Enterprise 11.0 through 14.0, allows remote authenticated internal users to…EPSS 0.7%Dec 22, 2020
- Medium5.4Cross-site scripting (XSS) issue in mail module in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier, allows remote attackers to inject arbitrary we…EPSS 0.7%Dec 22, 2020
- Medium6.1Cross-site scripting (XSS) issue in attachment management in Odoo Community 14.0 and earlier and Odoo Enterprise 14.0 and earlier, allows remote attackers to inject ar…EPSS 0.9%Dec 22, 2020
- Medium6.1Cross-site scripting (XSS) issue in "document" module in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier, allows remote attackers to inject arbitr…EPSS 0.9%Dec 22, 2020
- Critical9.1Improper input validation in database creation logic in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier, allows remote attackers to initialize an…EPSS 1.2%Dec 22, 2020
- High8.1Improper access control in the computed fields system of the framework of Odoo Community 13.0 and Odoo Enterprise 13.0 allows remote authenticated attackers to access…EPSS 2.1%Dec 19, 2019
- High7.5The Odoo Community Association (OCA) dbfilter_from_header module makes Odoo 8.x, 9.x, 10.x, and 11.x vulnerable to ReDoS (regular expression denial of service) under c…EPSS 2.2%Jul 5, 2019
- Critical9.1Improper sanitization of dynamic user expressions in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated privileged users to esca…EPSS 2.2%Jul 3, 2019
- High8.1Incorrect access control in the password reset component in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated users to reset th…EPSS 1.0%Jul 3, 2019
- Medium6.5Report engine in Odoo Community 9.0 through 11.0 and earlier and Odoo Enterprise 9.0 through 11.0 and earlier does not use secure options when passing documents to wkh…EPSS 1.5%Jul 3, 2019
- Medium6.5Incorrect access control in asset bundles in Odoo Community 9.0 through 11.0 and earlier and Odoo Enterprise 9.0 through 11.0 and earlier allows remote authenticated u…EPSS 1.2%Jul 3, 2019
- High8.1Incorrect access control in the RPC framework in Odoo Community 8.0 through 11.0 and Odoo Enterprise 9.0 through 11.0 allows authenticated users to call private functions via RPC.EPSS 1.0%Jul 3, 2019
- Medium6.5Incorrect access control in the mail templating system in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated internal users to d…EPSS 0.8%Jul 3, 2019
- Medium6.5Improper data access control in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows authenticated users to perform a CSV export of the secure hashed…EPSS 1.0%Jul 3, 2019
- Medium4.3Incorrect access control in the TransientModel framework in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows authenticated attackers to acce…EPSS 0.8%Jul 3, 2019
- Medium6.5Improper Host header sanitization in the dbfilter routing component in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier allows a remote attacker to…EPSS 1.8%Jun 28, 2019
- Medium4.9The module-description renderer in Odoo Community 11.0 and earlier and Odoo Enterprise 11.0 and earlier does not disable RST's local file inclusion, which allows privi…EPSS 1.3%Jun 28, 2019
- Critical9.8Incorrect access control in the database manager component in Odoo Community 10.0 and 11.0 and Odoo Enterprise 10.0 and 11.0 allows a remote attacker to restore a data…EPSS 2.2%Jun 28, 2019
- Medium6.5Incorrect access control in the Password Encryption module in Odoo Community 9.0 and Odoo Enterprise 9.0 allows authenticated users to change the password of other use…EPSS 0.6%Jun 28, 2019
- Medium5.3Incorrect access control in the portal messaging system in Odoo Community 9.0 and 10.0 and Odoo Enterprise 9.0 and 10.0 allows remote attackers to post messages on beh…EPSS 1.4%Jun 28, 2019
- Medium5.4Odoo Version <= 8.0-20160726 and Version 9 is affected by: CWE-601: Open redirection.EPSS 2.7%May 22, 2019
- High8.8Improper access control in the Helpdesk App of Odoo Enterprise 10.0 through 12.0 allows remote authenticated attackers to obtain elevated privileges via a crafted request.EPSS 7.8%Apr 9, 2019
- Medium6.1Cross-site scripting vulnerability in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remote attackers to inject arbitr…EPSS 1.0%Apr 9, 2019
- Medium6.5Improper access control in the Discuss App of Odoo Community 12.0 and earlier, and Odoo Enterprise 12.0 and earlier allows remote authenticated attackers to e-mail the…EPSS 1.4%Apr 9, 2019
- High8.8In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, incorrect access control on OAuth tokens in the OAuth module allows remote…EPSS 1.0%Jul 4, 2017