CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-51446 – GLPI LDAP Injection during authentication
https://notcve.org/view.php?id=CVE-2023-51446
GLPI is a Free Asset and IT Management Software package. When authentication is made against a LDAP, the authentication form can be used to perform LDAP injection. Upgrade to 10.0.12. GLPI es un paquete gratuito de software de gestión de TI y activos. Cuando la autenticación se realiza contra un LDAP, el formulario de autenticación se puede utilizar para realizar la inyección de LDAP. • https://github.com/glpi-project/glpi/commit/58c67d78f2e3ad08264213e9aaf56eab3c9ded35 https://github.com/glpi-project/glpi/releases/tag/10.0.12 https://github.com/glpi-project/glpi/security/advisories/GHSA-p995-jmfv-c7r8 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-23645 – GLPI reflected XSS in reports pages
https://notcve.org/view.php?id=CVE-2024-23645
GLPI is a Free Asset and IT Management Software package. A malicious URL can be used to execute XSS on reports pages. Upgrade to 10.0.12. GLPI es un paquete gratuito de software de gestión de TI y activos. Se puede utilizar una URL maliciosa para ejecutar XSS en páginas de informes. • https://github.com/glpi-project/glpi/commit/6cf265936c4f6edf7dea7c78b12e46d75b94d9b0 https://github.com/glpi-project/glpi/commit/fc1f6da9d158933b870ff374ed3a50ae98dcef4a https://github.com/glpi-project/glpi/releases/tag/10.0.12 https://github.com/glpi-project/glpi/security/advisories/GHSA-2gj5-qpff-ff3x • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-46727 – GLPI SQL injection through inventory agent request
https://notcve.org/view.php?id=CVE-2023-46727
GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, GLPI inventory endpoint can be used to drive a SQL injection attack. Version 10.0.11 contains a patch for the issue. As a workaround, disable native inventory. GLPI es un paquete de software gratuito de gestión de activos y TI. • https://github.com/glpi-project/glpi/commit/ee2d674481ebef177037e8e14d35c9455b5cfd46 https://github.com/glpi-project/glpi/releases/tag/10.0.11 https://github.com/glpi-project/glpi/security/advisories/GHSA-v799-2mp3-wgfr • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-46726 – GLPI Remote code execution from LDAP server configuration form on PHP 7.4
https://notcve.org/view.php?id=CVE-2023-46726
GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, on PHP 7.4 only, the LDAP server configuration form can be used to execute arbitrary code previously uploaded as a GLPI document. Version 10.0.11 contains a patch for the issue. GLPI es un paquete de software gratuito de gestión de activos y TI. A partir de la versión 10.0.0 y anteriores a la versión 10.0.11, solo en PHP 7.4, el formulario de configuración del servidor LDAP se puede utilizar para ejecutar código arbitrario cargado previamente como un documento GLPI. • https://github.com/glpi-project/glpi/commit/42ba2b031bec0b3889317db25f3adf9080fc11b2 https://github.com/glpi-project/glpi/releases/tag/10.0.11 https://github.com/glpi-project/glpi/security/advisories/GHSA-qc92-gxc6-5f95 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-43813 – glpi Authenticated SQL Injection
https://notcve.org/view.php?id=CVE-2023-43813
GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, the saved search feature can be used to perform a SQL injection. Version 10.0.11 contains a patch for the issue. GLPI es un paquete de software gratuito de gestión de activos y TI. A partir de la versión 10.0.0 y anteriores a la versión 10.0.11, la función de búsqueda guardada se puede utilizar para realizar una inyección SQL. • https://github.com/glpi-project/glpi/commit/4bd7f02d940953b9cbc9d285f7544bb0e490e75e https://github.com/glpi-project/glpi/releases/tag/10.0.11 https://github.com/glpi-project/glpi/security/advisories/GHSA-94c3-fw5r-3362 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •