CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-45609 – GLPI has a Reflected XSS in /front/stat.graph.php
https://notcve.org/view.php?id=CVE-2024-45609
15 Nov 2024 — GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability located in the reports pages. Upgrade to 10.0.17. • https://github.com/glpi-project/glpi/security/advisories/GHSA-3j2f-3j4v-hppr • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-43418 – GLPI has multiple reflected XSS
https://notcve.org/view.php?id=CVE-2024-43418
15 Nov 2024 — GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability. Upgrade to 10.0.17. • https://github.com/glpi-project/glpi/security/advisories/GHSA-x8jv-fcwx-3x6m • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-41678 – GLPI has multiple reflected XSS
https://notcve.org/view.php?id=CVE-2024-41678
15 Nov 2024 — GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability. Upgrade to 10.0.17. • https://github.com/glpi-project/glpi/security/advisories/GHSA-xwmx-mmrf-hqf9 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-40638 – GLPI allows account takeover via SQL Injection in AJAX scripts
https://notcve.org/view.php?id=CVE-2024-40638
15 Nov 2024 — GLPI is a free asset and IT management software package. An authenticated user can exploit multiple SQL injection vulnerabilities. One of them can be used to alter another user account data and take control of it. Upgrade to 10.0.17. • https://github.com/glpi-project/glpi/security/advisories/GHSA-8843-r3m7-gfqx • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37149 – GLPI allows remote code execution through the plugin loader
https://notcve.org/view.php?id=CVE-2024-37149
10 Jul 2024 — GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated technician user can upload a malicious PHP script and hijack the plugin loader to execute this malicious script. Upgrade to 10.0.16. GLPI es un paquete de software de gestión de TI y activos de código abierto que proporciona funciones de ITIL Service Desk, seguimiento de licencias y auditoría de software. Un usuario técnico autenticado puede carg... • https://github.com/glpi-project/glpi/security/advisories/GHSA-cwvp-j887-m4xh • CWE-73: External Control of File Name or Path •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-37148 – GLPI allows account takeover via SQL Injection in AJAX scripts
https://notcve.org/view.php?id=CVE-2024-37148
10 Jul 2024 — GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in some AJAX scripts to alter another user account data and take control of it. Upgrade to 10.0.16. GLPI es un paquete de software de gestión de TI y activos de código abierto que proporciona funciones de ITIL Service Desk, seguimiento de licencias y auditoría de software. Un usuario autenticado pued... • https://github.com/glpi-project/glpi/security/advisories/GHSA-p626-hph9-p6fj • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 3%CPEs: 1EXPL: 1CVE-2024-37147 – GLPI allows Authenticated File Upload to Restricted Tickets
https://notcve.org/view.php?id=CVE-2024-37147
10 Jul 2024 — GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can attach a document to any item, even if the user has no write access on it. Upgrade to 10.0.16. GLPI es un paquete de software de gestión de TI y activos de código abierto que proporciona funciones de ITIL Service Desk, seguimiento de licencias y auditoría de software. Un usuario autenticado puede adjuntar un documento a cualquier element... • https://github.com/0xmupa/CVE-2024-37147-PoC • CWE-284: Improper Access Control •
CVSS: 7.7EPSS: 0%CPEs: 1EXPL: 0CVE-2024-31456 – GLPI contains an authenticated SQL injection
https://notcve.org/view.php?id=CVE-2024-31456
07 May 2024 — GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability from map search. This vulnerability is fixed in 10.0.15. GLPI es un paquete gratuito de software de gestión de TI y activos. Antes de 10.0.15, un usuario autenticado podía aprovechar una vulnerabilidad de inyección SQL desde la búsqueda de mapas. • https://github.com/glpi-project/glpi/commit/730c3db29a1edc32f9b9d1e2a940e90a0211ab26 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.5EPSS: 23%CPEs: 1EXPL: 0CVE-2024-29889 – GLPI contains an SQL injection through the saved searches
https://notcve.org/view.php?id=CVE-2024-29889
07 May 2024 — GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability in the saved searches feature to alter another user account data take control of it. This vulnerability is fixed in 10.0.15. GLPI es un paquete gratuito de software de gestión de TI y activos. Antes de 10.0.15, un usuario autenticado podía explotar una vulnerabilidad de inyección SQL en la función de búsquedas guardadas para alterar los datos de la cuenta de otro usuario... • https://github.com/glpi-project/glpi/commit/0a6b28be4c0f848106c60b554c703ec2e178d6c7 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.7EPSS: 0%CPEs: 1EXPL: 0CVE-2024-27096 – SQL Injection in through the search engine
https://notcve.org/view.php?id=CVE-2024-27096
18 Mar 2024 — GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in the search engine to extract data from the database. This issue has been patched in version 10.0.13. GLPI es un paquete gratuito de software de gestión de TI y activos, gestión de centros de datos, ITIL Service Desk, seguimiento de licencias y auditoría de software. Un usuario autenticado puede aprovech... • https://github.com/glpi-project/glpi/commit/61a0c2302b4f633f5065358adc36058e1abc37f9 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •