CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-35947 – SQL injection in GLPI
https://notcve.org/view.php?id=CVE-2022-35947
14 Sep 2022 — GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Affected versions have been found to be vulnerable to a SQL injection attack which an attacker could leverage to simulate an arbitrary user login. Users are advised to upgrade to version 10.0.3. Users unable to upgrade should disable the `Enable login with external token` API configuration. GLPI es el acrónimo de Ge... • https://github.com/glpi-project/glpi/commit/564309d2c1180d5ba1615f4bbaf6623df81b4962 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-36112 – Blind Server-Side Request Forgery (SSRF) in GLPI
https://notcve.org/view.php?id=CVE-2022-36112
14 Sep 2022 — GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Usage of RSS feeds or extenal calendar in planning is subject to SSRF exploit. Server-side requests can be used to scan server port or services opened on GLPI server or its private network. Queries responses are not exposed to end-user (blind SSRF). Users are advised to upgrade to version 10.0.3 to resolve this issu... • https://github.com/glpi-project/glpi/commit/ad66d69049ae02bead8ed0f4ee654a458643244e • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-35945 – Cross site scripting (XSS) via registration API in GLPI
https://notcve.org/view.php?id=CVE-2022-35945
14 Sep 2022 — GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Information associated to registration key are not properly escaped in registration key configuration page. They can be used to steal a GLPI administrator cookie. Users are advised to upgrade to 10.0.3. There are no known workarounds for this issue. ### Workarounds Do not use a registration key created by an untrust... • https://github.com/glpi-project/glpi/commit/2b8f9aa54ae4a4ec07bde0c8db739a292b8ec09a • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2022-31143 – Leak of sensitive information through login page error in GLPI
https://notcve.org/view.php?id=CVE-2022-31143
14 Sep 2022 — GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. It was found that in affected versions there is an exposure of private information defined in setup of GLPI (like smtp or cas hosts). Note that passwords are not exposed. Users are advised to upgrade to version 10.0.3. There are no known workarounds for this issue. • https://github.com/glpi-project/glpi/commit/e66a0dfe697cbd4b3ec22736a8f8fd025a28f978 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 65%CPEs: 2EXPL: 1CVE-2022-31061 – SQL injection on login page in GLPI
https://notcve.org/view.php?id=CVE-2022-31061
28 Jun 2022 — GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions there is a SQL injection vulnerability which is possible on login page. No user credentials are required to exploit this vulnerability. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue. • https://github.com/Wangyanan131/CVE-2022-31061 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2022-31068 – Sensitive Data Exposure on Refused Inventory Files in GLPI
https://notcve.org/view.php?id=CVE-2022-31068
28 Jun 2022 — GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions all GLPI instances with the native inventory used may leak sensitive information. The feature to get refused file is not authenticated. This issue has been addressed in version 10.0.2 and all affected users are advised to upgrade. GLPI es un paquete de software gratuito de administración de activos y TI, administración de centros de datos, ITIL Ser... • https://github.com/glpi-project/glpi/commit/9953a644777e4167b06db9e14fc93b945a557be5 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 2CVE-2022-31056 – SQL injection with _actor parameter in GLPI
https://notcve.org/view.php?id=CVE-2022-31056
28 Jun 2022 — GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions all assistance forms (Ticket/Change/Problem) permit sql injection on the actor fields. This issue has been resolved in version 10.0.2 and all affected users are advised to upgrade. GLPI es un paquete gratuito de software de administración de activos y TI, administración de centros de datos, ITIL Service Desk, seguimiento de licencias y auditoría de... • https://packetstorm.news/files/id/171656 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-31082 – SQL Injection via package deployment tasks in glpi-inventory-plugin
https://notcve.org/view.php?id=CVE-2022-31082
27 Jun 2022 — GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. glpi-inventory-plugin is a plugin for GLPI to handle inventory management. In affected versions a SQL injection can be made using package deployment tasks. This issue has been resolved in version 1.0.2. Users are advised to upgrade. Users unable to upgrade should delete the `front/deploypackage.public.php` file if they are not using the `deploy tasks` feature. • https://github.com/glpi-project/glpi-inventory-plugin/commit/0b805ca6fb2a0f9bde4af29fca4f703fdfbd8f66 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.3EPSS: 4%CPEs: 1EXPL: 2CVE-2022-31062 – Unauthenticated Local File Inclusion
https://notcve.org/view.php?id=CVE-2022-31062
20 Jun 2022 — ### Impact A plugin public script can be used to read content of system files. ### Patches Upgrade to version 1.0.2. ### Workarounds `b/deploy/index.php` file can be deleted if deploy feature is not used. ### Impacto Un script público del plugin puede ser usado para leer el contenido de los archivos del sistema. ### Parches Actualizar a versión 1.0.2. ### Mitigaciones el archivo "b/deploy/index.php" puede ser eliminado si no es usada la función deploy GLPI Glpiinventory versions 1.0.1 and below suffer from ... • https://packetstorm.news/files/id/171654 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.1EPSS: 0%CPEs: 5EXPL: 0CVE-2022-29250 – SQL injection in GLPI
https://notcve.org/view.php?id=CVE-2022-29250
09 Jun 2022 — GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to version 10.0.1 it is possible to add extra information by SQL injection on search pages. In order to exploit this vulnerability a user must be logged in. GLPI es un paquete de software gratuito de administración de activos y TI que ofrece funciones de Service Desk de ITIL, seguimiento de licencias y auditoría de software. En versiones anteriores a 1... • https://github.com/glpi-project/glpi/security/advisories/GHSA-5w33-4wrx-8hvw • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •