CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-43813 – glpi Authenticated SQL Injection
https://notcve.org/view.php?id=CVE-2023-43813
GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, the saved search feature can be used to perform a SQL injection. Version 10.0.11 contains a patch for the issue. GLPI es un paquete de software gratuito de gestión de activos y TI. A partir de la versión 10.0.0 y anteriores a la versión 10.0.11, la función de búsqueda guardada se puede utilizar para realizar una inyección SQL. • https://github.com/glpi-project/glpi/commit/4bd7f02d940953b9cbc9d285f7544bb0e490e75e https://github.com/glpi-project/glpi/releases/tag/10.0.11 https://github.com/glpi-project/glpi/security/advisories/GHSA-94c3-fw5r-3362 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-42802 – GLPI vulnerable to unallowed PHP script execution
https://notcve.org/view.php?id=CVE-2023-42802
GLPI is a free asset and IT management software package. Starting in version 10.0.7 and prior to version 10.0.10, an unverified object instantiation allows one to upload malicious PHP files to unwanted directories. Depending on web server configuration and available system libraries, malicious PHP files can then be executed through a web server request. Version 10.0.10 fixes this issue. As a workaround, remove write access on `/ajax` and `/front` files to the web server. • https://github.com/glpi-project/glpi/releases/tag/10.0.10 https://github.com/glpi-project/glpi/security/advisories/GHSA-rrh2-x4ch-pq3m • CWE-20: Improper Input Validation CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-42462 – File deletion through document upload process in GLPI
https://notcve.org/view.php?id=CVE-2023-42462
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. The document upload process can be diverted to delete some files. Users are advised to upgrade to version 10.0.10. There are no known workarounds for this vulnerability. Gestionnaire Libre de Parc Informatique (GLPI) es un paquete Gratuito de Software de Gestión de Activos IT, que proporciona funciones de ITIL Service Desk, seguimiento de licencias y auditoría de software. • https://github.com/glpi-project/glpi/security/advisories/GHSA-hm76-jh96-7j75 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-42461 – SQL injection in ITIL actors in GLPI
https://notcve.org/view.php?id=CVE-2023-42461
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. The ITIL actors input field from the Ticket form can be used to perform a SQL injection. Users are advised to upgrade to version 10.0.10. There are no known workarounds for this vulnerability. Gestionnaire Libre de Parc Informatique (GLPI) es un paquete Gratuito de Software de Gestión de Activos IT, que proporciona funciones de ITIL Service Desk, seguimiento de licencias y auditoría de software. • https://github.com/glpi-project/glpi/security/advisories/GHSA-x3jp-69f2-p84w • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-41888 – Phishing through a login page malicious URL in GLPI
https://notcve.org/view.php?id=CVE-2023-41888
GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. The lack of path filtering on the GLPI URL may allow an attacker to transmit a malicious URL of login page that can be used to attempt a phishing attack on user credentials. Users are advised to upgrade to version 10.0.10. There are no known workarounds for this vulnerability. Gestionnaire Libre de Parc Informatique (GLPI) es un paquete Gratuito de Software de Gestión de Activos IT, que proporciona funciones de ITIL Service Desk, seguimiento de licencias y auditoría de software. • https://github.com/glpi-project/glpi/security/advisories/GHSA-2hcg-75jj-hghp • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •