CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-34106 – GLPI vulnerable to unauthorized access to User data
https://notcve.org/view.php?id=CVE-2023-34106
05 Jul 2023 — GLPI is a free asset and IT management software package. Versions of the software starting with 0.68 and prior to 10.0.8 have an incorrect rights check on a on a file accessible by an authenticated user. This allows access to the list of all users and their personal information. Users should upgrade to version 10.0.8 to receive a patch. • https://github.com/glpi-project/glpi/releases/tag/10.0.8 • CWE-284: Improper Access Control CWE-863: Incorrect Authorization •
CVSS: 9.6EPSS: 0%CPEs: 2EXPL: 0CVE-2023-28838 – GLPI vulnerable to SQL injection through dynamic reports
https://notcve.org/view.php?id=CVE-2023-28838
05 Apr 2023 — GLPI is a free asset and IT management software package. Starting in version 0.50 and prior to versions 9.5.13 and 10.0.7, a SQL Injection vulnerability allow users with access rights to statistics or reports to extract all data from database and, in some cases, write a webshell on the server. Versions 9.5.13 and 10.0.7 contain a patch for this issue. As a workaround, remove `Assistance > Statistics` and `Tools > Reports` read rights from every user. • https://github.com/glpi-project/glpi/releases/tag/10.0.7 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-28636 – GLPI vulnerable to stored Cross-site Scripting in external links
https://notcve.org/view.php?id=CVE-2023-28636
05 Apr 2023 — GLPI is a free asset and IT management software package. Starting in version 0.60 and prior to versions 9.5.13 and 10.0.7, a vulnerability allows an administrator to create a malicious external link. This issue is fixed in versions 9.5.13 and 10.0.7. • https://github.com/glpi-project/glpi/releases/tag/10.0.7 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.2EPSS: 0%CPEs: 2EXPL: 0CVE-2023-22725 – glpi vulnerable to XSS on external links
https://notcve.org/view.php?id=CVE-2023-22725
25 Jan 2023 — GLPI is a Free Asset and IT Management Software package. Versions 0.6.0 and above, prior to 10.0.6 are vulnerable to Cross-site Scripting. This vulnerability allow for an administrator to create a malicious external link. This issue is patched in 10.0.6. GLPI es un paquete gratuito de software de gestión de TI y activos. • https://github.com/glpi-project/glpi/security/advisories/GHSA-f5g6-fxrw-pfj7 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-23610 – glpi vulnerable to Unauthorized access to data export
https://notcve.org/view.php?id=CVE-2023-23610
25 Jan 2023 — GLPI is a Free Asset and IT Management Software package. Versions prior to 9.5.12 and 10.0.6 are vulnerable to Improper Privilege Management. Any user having access to the standard interface can export data of almost any GLPI item type, even those on which user is not allowed to access (including assets, tickets, users, ...). This issue is patched in 10.0.6. GLPI es un paquete gratuito de software de gestión de TI y activos. • https://github.com/glpi-project/glpi/security/advisories/GHSA-6565-hm87-24hf • CWE-269: Improper Privilege Management CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 5.2EPSS: 0%CPEs: 1EXPL: 1CVE-2022-39262 – Stored Cross-Site Scripting (XSS) on login page in GLPI
https://notcve.org/view.php?id=CVE-2022-39262
03 Nov 2022 — GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package, GLPI administrator can define rich-text content to be displayed on login page. The displayed content is can contains malicious code that can be used to steal credentials. This issue has been patched, please upgrade to version 10.0.4. GLPI significa Gestionnaire Libre de Parc Informatique. • https://github.com/glpi-project/glpi/security/advisories/GHSA-4x48-q2wr-cpg4 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-83: Improper Neutralization of Script in Attributes in a Web Page •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2022-39276 – Blind Server-Side Request Forgery (SSRF) in RSS feeds and planning
https://notcve.org/view.php?id=CVE-2022-39276
03 Nov 2022 — GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Usage of RSS feeds or an external calendar in planning is subject to SSRF exploit. In case a remote script returns a redirect response, the redirect target URL is not checked against the URL allow list defined by administrator. This issue has been patched, please upgrade to 10.0.4. • https://github.com/glpi-project/glpi/security/advisories/GHSA-8vwg-7x42-7v6p • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-39277 – Cross-Site Scripting (XSS) in external links in GLPI
https://notcve.org/view.php?id=CVE-2022-39277
03 Nov 2022 — GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. External links are not properly sanitized and can therefore be used for a Cross-Site Scripting (XSS) attack. This issue has been patched, please upgrade to GLPI 10.0.4. There are currently no known workarounds. • https://github.com/glpi-project/glpi/security/advisories/GHSA-rhcw-8r7g-8pwc • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-39376 – Improper input validation on emails links in GLPI
https://notcve.org/view.php?id=CVE-2022-39376
03 Nov 2022 — GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Users may be able to inject custom fields values in `mailto` links. This issue has been patched, please upgrade to version 10.0.4. There are currently no known workarounds. • https://github.com/glpi-project/glpi/security/advisories/GHSA-6rh5-m5g7-327w • CWE-20: Improper Input Validation •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-39234 – user session persists even after permanently deleting account in GLPI
https://notcve.org/view.php?id=CVE-2022-39234
03 Nov 2022 — GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Deleted/deactivated user could continue to use their account as long as its cookie is valid. This issue has been patched, please upgrade to version 10.0.4. There are currently no known workarounds. • https://github.com/glpi-project/glpi/security/advisories/GHSA-pgcx-mc58-3gmg • CWE-613: Insufficient Session Expiration •