Romain Koszyk

**Name of the Vulnerable Software and Affected Versions** Dahua products (affected versions not specified) **Description** The issue is related to an access control vulnerability in the password reset process of some Dahua products. Attackers can exploit this vulnerability through specific deployments to reset device passwords. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dolibarr versions prior to 7.0.1 **Description** The issue concerns Stored XSS in the expense reports plugin. It occurs via the `comments` parameter, or a public or private note, in the expensereport/card.php file. **Recommendations** For versions prior to 7.0.1, update to version 7.0.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the expensereport/card.php file or disabling the expense reports plugin until a patch is available. Avoid using the `comments` parameter in the affected plugin until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Dolibarr versions prior to 7.0.1 **Description** An issue was discovered in the expense reports module, specifically in expensereport/card.php, which allows SQL injection via the integer parameters `qty` and `value unit`. **Recommendations** For versions prior to 7.0.1, update to version 7.0.1 or later to resolve the issue.