6.0.4

DATE	CVE	VULNERABILITY TITLE	RISK
2017-12-29	CVE-2017-17971	Cross-site Scripting vulnerability in Dolibarr Erp/Crm 6.0.4 The test_sql_and_script_inject function in htdocs/main.inc.php in Dolibarr ERP/CRM 6.0.4 blocks some event attributes but neither onclick nor onscroll, which allows XSS. network low complexity dolibarr CWE-79	6.1
2017-12-27	CVE-2017-17900	SQL Injection vulnerability in Dolibarr Erp/Crm 6.0.4 SQL injection vulnerability in fourn/index.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the socid parameter. network low complexity dolibarr CWE-89 critical	9.8
2017-12-27	CVE-2017-17899	SQL Injection vulnerability in Dolibarr Erp/Crm 6.0.4 SQL injection vulnerability in adherents/subscription/info.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the rowid parameter. network low complexity dolibarr CWE-89 critical	9.8
2017-12-27	CVE-2017-17898	Information Exposure vulnerability in Dolibarr Erp/Crm 6.0.4 Dolibarr ERP/CRM version 6.0.4 does not block direct requests to *.tpl.php files, which allows remote attackers to obtain sensitive information. network low complexity dolibarr CWE-200	7.5
2017-12-27	CVE-2017-17897	SQL Injection vulnerability in Dolibarr Erp/Crm 6.0.4 SQL injection vulnerability in comm/multiprix.php in Dolibarr ERP/CRM version 6.0.4 allows remote attackers to execute arbitrary SQL commands via the id parameter. network low complexity dolibarr CWE-89 critical	9.8