CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-29889 – GLPI contains an SQL injection through the saved searches
https://notcve.org/view.php?id=CVE-2024-29889
GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability in the saved searches feature to alter another user account data take control of it. This vulnerability is fixed in 10.0.15. GLPI es un paquete gratuito de software de gestión de TI y activos. Antes de 10.0.15, un usuario autenticado podía explotar una vulnerabilidad de inyección SQL en la función de búsquedas guardadas para alterar los datos de la cuenta de otro usuario y tomar el control de ella. • https://github.com/glpi-project/glpi/commit/0a6b28be4c0f848106c60b554c703ec2e178d6c7 https://github.com/glpi-project/glpi/security/advisories/GHSA-8xvf-v6vv-r75g • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.7EPSS: 0%CPEs: 1EXPL: 0CVE-2024-27096 – SQL Injection in through the search engine
https://notcve.org/view.php?id=CVE-2024-27096
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in the search engine to extract data from the database. This issue has been patched in version 10.0.13. GLPI es un paquete gratuito de software de gestión de TI y activos, gestión de centros de datos, ITIL Service Desk, seguimiento de licencias y auditoría de software. Un usuario autenticado puede aprovechar una vulnerabilidad de inyección SQL en el motor de búsqueda para extraer datos de la base de datos. • https://github.com/glpi-project/glpi/commit/61a0c2302b4f633f5065358adc36058e1abc37f9 https://github.com/glpi-project/glpi/releases/tag/10.0.13 https://github.com/glpi-project/glpi/security/advisories/GHSA-2x8m-vrcm-2jqv • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-27930 – Sensitive fields access through dropdowns in GLPI
https://notcve.org/view.php?id=CVE-2024-27930
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can access sensitive fields data from items on which he has read access. This issue has been patched in version 10.0.13. GLPI es un paquete gratuito de software de gestión de TI y activos, gestión de centros de datos, ITIL Service Desk, seguimiento de licencias y auditoría de software. Un usuario autenticado puede acceder a datos de campos confidenciales de elementos sobre los que tiene acceso de lectura. • https://borelenzo.github.io/stuff/2024/02/29/glpi-pwned.html https://github.com/glpi-project/glpi/commit/1942b70b2422fff51822f6eb3af500c94760871e https://github.com/glpi-project/glpi/releases/tag/10.0.13 https://github.com/glpi-project/glpi/security/advisories/GHSA-82vv-j9pr-qmwq • CWE-285: Improper Authorization •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-51446 – GLPI LDAP Injection during authentication
https://notcve.org/view.php?id=CVE-2023-51446
GLPI is a Free Asset and IT Management Software package. When authentication is made against a LDAP, the authentication form can be used to perform LDAP injection. Upgrade to 10.0.12. GLPI es un paquete gratuito de software de gestión de TI y activos. Cuando la autenticación se realiza contra un LDAP, el formulario de autenticación se puede utilizar para realizar la inyección de LDAP. • https://github.com/glpi-project/glpi/commit/58c67d78f2e3ad08264213e9aaf56eab3c9ded35 https://github.com/glpi-project/glpi/releases/tag/10.0.12 https://github.com/glpi-project/glpi/security/advisories/GHSA-p995-jmfv-c7r8 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-23645 – GLPI reflected XSS in reports pages
https://notcve.org/view.php?id=CVE-2024-23645
GLPI is a Free Asset and IT Management Software package. A malicious URL can be used to execute XSS on reports pages. Upgrade to 10.0.12. GLPI es un paquete gratuito de software de gestión de TI y activos. Se puede utilizar una URL maliciosa para ejecutar XSS en páginas de informes. • https://github.com/glpi-project/glpi/commit/6cf265936c4f6edf7dea7c78b12e46d75b94d9b0 https://github.com/glpi-project/glpi/commit/fc1f6da9d158933b870ff374ed3a50ae98dcef4a https://github.com/glpi-project/glpi/releases/tag/10.0.12 https://github.com/glpi-project/glpi/security/advisories/GHSA-2gj5-qpff-ff3x • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •