Kr0No

The issue arises from missing file type validation in the `r3dfb save thumbnail callback` function, allowing authenticated attackers with Author-level access and above to upload arbitrary files on the affected site's server. This may make remote code execution possible.

The issue arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts in pages via the `RednaoSerializedFields` parameter during the creation of a signature file. This enables the execution of injected scripts whenever a user accesses an injected page.

Name of the Vulnerable Software and Affected Versions: Odoo Community versions 11.0 through 14.0 Odoo Enterprise versions 11.0 through 14.0 Description: The issue is a cross-site scripting (XSS) problem in the web module, allowing remote authenticated internal users to inject arbitrary web script in the browser of a victim via crafted calendar event attributes. Recommendations: For Odoo Community versions 11.0 through 14.0, consider disabling the web module until a patch is available. For Odoo Enterprise versions 11.0 through 14.0, consider disabling the web module until a patch is available. As a temporary workaround, restrict access to crafted calendar event attributes to minimize the risk of exploitation.