CVSS: 4.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-27104 – Stored XSS in dashboards in GLPI
https://notcve.org/view.php?id=CVE-2024-27104
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. A user with rights to create and share dashboards can build a dashboard containing javascript code. Any user that will open this dashboard will be subject to an XSS attack. This issue has been patched in version 10.0.13. GLPI es un paquete gratuito de software de gestión de TI y activos, gestión de centros de datos, ITIL Service Desk, seguimiento de licencias y auditoría de software. • https://github.com/glpi-project/glpi/commit/b409ca437864607b03c2014b9e3293b7f141af65 https://github.com/glpi-project/glpi/releases/tag/10.0.13 https://github.com/glpi-project/glpi/security/advisories/GHSA-prc3-cx5m-h5mj • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-27098 – Blind Server-Side Request Forgery (SSRF) using Arbitrary Object Instantiation in GLPI
https://notcve.org/view.php?id=CVE-2024-27098
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can execute a SSRF based attack using Arbitrary Object Instantiation. This issue has been patched in version 10.0.13. GLPI es un paquete gratuito de software de gestión de TI y activos, gestión de centros de datos, ITIL Service Desk, seguimiento de licencias y auditoría de software. Un usuario autenticado puede ejecutar un ataque basado en SSRF utilizando la creación de instancias de objetos arbitrarios. • https://github.com/glpi-project/glpi/commit/3b6bc1b4aa1f3693b20ada3425d2de5108522484 https://github.com/glpi-project/glpi/releases/tag/10.0.13 https://github.com/glpi-project/glpi/security/advisories/GHSA-92x4-q9w5-837w • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 7.7EPSS: 0%CPEs: 1EXPL: 0CVE-2024-27096 – SQL Injection in through the search engine
https://notcve.org/view.php?id=CVE-2024-27096
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in the search engine to extract data from the database. This issue has been patched in version 10.0.13. GLPI es un paquete gratuito de software de gestión de TI y activos, gestión de centros de datos, ITIL Service Desk, seguimiento de licencias y auditoría de software. Un usuario autenticado puede aprovechar una vulnerabilidad de inyección SQL en el motor de búsqueda para extraer datos de la base de datos. • https://github.com/glpi-project/glpi/commit/61a0c2302b4f633f5065358adc36058e1abc37f9 https://github.com/glpi-project/glpi/releases/tag/10.0.13 https://github.com/glpi-project/glpi/security/advisories/GHSA-2x8m-vrcm-2jqv • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-27930 – Sensitive fields access through dropdowns in GLPI
https://notcve.org/view.php?id=CVE-2024-27930
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can access sensitive fields data from items on which he has read access. This issue has been patched in version 10.0.13. GLPI es un paquete gratuito de software de gestión de TI y activos, gestión de centros de datos, ITIL Service Desk, seguimiento de licencias y auditoría de software. Un usuario autenticado puede acceder a datos de campos confidenciales de elementos sobre los que tiene acceso de lectura. • https://borelenzo.github.io/stuff/2024/02/29/glpi-pwned.html https://github.com/glpi-project/glpi/commit/1942b70b2422fff51822f6eb3af500c94760871e https://github.com/glpi-project/glpi/releases/tag/10.0.13 https://github.com/glpi-project/glpi/security/advisories/GHSA-82vv-j9pr-qmwq • CWE-285: Improper Authorization •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-27937 – glpi Users emails enumeration
https://notcve.org/view.php?id=CVE-2024-27937
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can obtain the email address of all GLPI users. This issue has been patched in version 10.0.13. GLPI es un paquete gratuito de software de gestión de TI y activos, gestión de centros de datos, ITIL Service Desk, seguimiento de licencias y auditoría de software. Un usuario autenticado puede obtener la dirección de correo electrónico de todos los usuarios de GLPI. • https://borelenzo.github.io/stuff/2024/02/29/glpi-pwned.html https://github.com/glpi-project/glpi/commit/d02c537d23cbb729fe18b87f71b3c6e84e9892da https://github.com/glpi-project/glpi/releases/tag/10.0.13 https://github.com/glpi-project/glpi/security/advisories/GHSA-98qw-hpg3-2hpj • CWE-285: Improper Authorization •