CVSS: 6.8EPSS: 0%CPEs: 68EXPL: 0CVE-2012-4002
https://notcve.org/view.php?id=CVE-2012-4002
Cross-site request forgery (CSRF) vulnerability in GLPI-PROJECT GLPI before 0.83.3 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors. Una vulnerabilidad de falsificación de peticiones en sitios cruzados (CSRF). en GLPI-PROJECT GLPI antes de v0.83.3 permite a atacantes remotos secuestrar la autenticación de las víctimas a través de vectores desconocidos. • http://www.mandriva.com/security/advisories?name=MDVSA-2012:132 http://www.openwall.com/lists/oss-security/2012/07/13/1 https://forge.indepnet.net/issues/3704 https://forge.indepnet.net/issues/3707 https://forge.indepnet.net/projects/glpi/versions/771 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.5EPSS: 0%CPEs: 14EXPL: 0CVE-2012-1037 – GLPI 0.80.61 Local File Inclusion / Remote File Inclusion
https://notcve.org/view.php?id=CVE-2012-1037
PHP remote file inclusion vulnerability in front/popup.php in GLPI 0.78 through 0.80.61 allows remote authenticated users to execute arbitrary PHP code via a URL in the sub_type parameter. Una vulnerabilidad de inclusión remota de fichero PHP en front/popup.php en GLPI v0.78 a v0.80.61 permite ejecutar código PHP de su elección a usuarios remotos autenticados a través de una URL en el parámetro sub_type. GLPI versions 0.80.61 and below suffer from local file inclusion and remote file inclusion vulnerabilities. • http://seclists.org/fulldisclosure/2012/Feb/157 http://www.mandriva.com/security/advisories?name=MDVSA-2012:016 https://forge.indepnet.net/issues/3338 https://forge.indepnet.net/projects/glpi/repository/revisions/17457/diff/branches/0.80-bugfixes/front/popup.php https://forge.indepnet.net/projects/glpi/versions/685 • CWE-94: Improper Control of Generation of Code ('Code Injection') •