CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-37278 – GLPI vulnerable to SQL injection via dashboard administration
https://notcve.org/view.php?id=CVE-2023-37278
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An administrator can trigger SQL injection via dashboards administration. This vulnerability has been patched in version 10.0.9. • https://github.com/glpi-project/glpi/releases/tag/10.0.9 https://github.com/glpi-project/glpi/security/advisories/GHSA-46gp-f96h-53w4 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-36808 – GLPI vulnerable to SQL injection through Computer Virtual Machine information
https://notcve.org/view.php?id=CVE-2023-36808
GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.8, Computer Virtual Machine form and GLPI inventory request can be used to perform a SQL injection attack. Version 10.0.8 has a patch for this issue. As a workaround, one may disable native inventory. • https://github.com/glpi-project/glpi/releases/tag/10.0.8 https://github.com/glpi-project/glpi/security/advisories/GHSA-vf5h-jh9q-2gjm • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-34107 – GLPI vulnerable to unauthorized access to KnowbaseItem data
https://notcve.org/view.php?id=CVE-2023-34107
GLPI is a free asset and IT management software package. Versions of the software starting with 9.2.0 and prior to 10.0.8 have an incorrect rights check on a on a file accessible by an authenticated user, allows access to the view all KnowbaseItems. Version 10.0.8 has a patch for this issue. • https://github.com/glpi-project/glpi/releases/tag/10.0.8 https://github.com/glpi-project/glpi/security/advisories/GHSA-966h-xrf5-pmj4 • CWE-284: Improper Access Control CWE-863: Incorrect Authorization •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-34106 – GLPI vulnerable to unauthorized access to User data
https://notcve.org/view.php?id=CVE-2023-34106
GLPI is a free asset and IT management software package. Versions of the software starting with 0.68 and prior to 10.0.8 have an incorrect rights check on a on a file accessible by an authenticated user. This allows access to the list of all users and their personal information. Users should upgrade to version 10.0.8 to receive a patch. • https://github.com/glpi-project/glpi/releases/tag/10.0.8 https://github.com/glpi-project/glpi/security/advisories/GHSA-923r-hqh4-wj7c • CWE-284: Improper Access Control CWE-863: Incorrect Authorization •
CVSS: 9.6EPSS: 0%CPEs: 2EXPL: 0CVE-2023-28838 – GLPI vulnerable to SQL injection through dynamic reports
https://notcve.org/view.php?id=CVE-2023-28838
GLPI is a free asset and IT management software package. Starting in version 0.50 and prior to versions 9.5.13 and 10.0.7, a SQL Injection vulnerability allow users with access rights to statistics or reports to extract all data from database and, in some cases, write a webshell on the server. Versions 9.5.13 and 10.0.7 contain a patch for this issue. As a workaround, remove `Assistance > Statistics` and `Tools > Reports` read rights from every user. • https://github.com/glpi-project/glpi/releases/tag/10.0.7 https://github.com/glpi-project/glpi/releases/tag/9.5.13 https://github.com/glpi-project/glpi/security/advisories/GHSA-2c7r-gf38-358f • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •