CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2023-51446 – GLPI LDAP Injection during authentication
https://notcve.org/view.php?id=CVE-2023-51446
01 Feb 2024 — GLPI is a Free Asset and IT Management Software package. When authentication is made against a LDAP, the authentication form can be used to perform LDAP injection. Upgrade to 10.0.12. GLPI es un paquete gratuito de software de gestión de TI y activos. Cuando la autenticación se realiza contra un LDAP, el formulario de autenticación se puede utilizar para realizar la inyección de LDAP. • https://github.com/glpi-project/glpi/commit/58c67d78f2e3ad08264213e9aaf56eab3c9ded35 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-23645 – GLPI reflected XSS in reports pages
https://notcve.org/view.php?id=CVE-2024-23645
01 Feb 2024 — GLPI is a Free Asset and IT Management Software package. A malicious URL can be used to execute XSS on reports pages. Upgrade to 10.0.12. GLPI es un paquete gratuito de software de gestión de TI y activos. Se puede utilizar una URL maliciosa para ejecutar XSS en páginas de informes. • https://github.com/glpi-project/glpi/commit/6cf265936c4f6edf7dea7c78b12e46d75b94d9b0 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 23%CPEs: 1EXPL: 0CVE-2023-46727 – GLPI SQL injection through inventory agent request
https://notcve.org/view.php?id=CVE-2023-46727
13 Dec 2023 — GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, GLPI inventory endpoint can be used to drive a SQL injection attack. Version 10.0.11 contains a patch for the issue. As a workaround, disable native inventory. GLPI es un paquete de software gratuito de gestión de activos y TI. • https://github.com/glpi-project/glpi/commit/ee2d674481ebef177037e8e14d35c9455b5cfd46 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-46726 – GLPI Remote code execution from LDAP server configuration form on PHP 7.4
https://notcve.org/view.php?id=CVE-2023-46726
13 Dec 2023 — GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, on PHP 7.4 only, the LDAP server configuration form can be used to execute arbitrary code previously uploaded as a GLPI document. Version 10.0.11 contains a patch for the issue. GLPI es un paquete de software gratuito de gestión de activos y TI. A partir de la versión 10.0.0 y anteriores a la versión 10.0.11, solo en PHP 7.4, el formulario de configuración del servidor LDAP se puede utilizar par... • https://github.com/glpi-project/glpi/commit/42ba2b031bec0b3889317db25f3adf9080fc11b2 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 9.0EPSS: 11%CPEs: 1EXPL: 0CVE-2023-43813 – glpi Authenticated SQL Injection
https://notcve.org/view.php?id=CVE-2023-43813
13 Dec 2023 — GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, the saved search feature can be used to perform a SQL injection. Version 10.0.11 contains a patch for the issue. GLPI es un paquete de software gratuito de gestión de activos y TI. A partir de la versión 10.0.0 y anteriores a la versión 10.0.11, la función de búsqueda guardada se puede utilizar para realizar una inyección SQL. • https://github.com/glpi-project/glpi/commit/4bd7f02d940953b9cbc9d285f7544bb0e490e75e • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 5%CPEs: 1EXPL: 0CVE-2023-42802 – GLPI vulnerable to unallowed PHP script execution
https://notcve.org/view.php?id=CVE-2023-42802
02 Nov 2023 — GLPI is a free asset and IT management software package. Starting in version 10.0.7 and prior to version 10.0.10, an unverified object instantiation allows one to upload malicious PHP files to unwanted directories. Depending on web server configuration and available system libraries, malicious PHP files can then be executed through a web server request. Version 10.0.10 fixes this issue. As a workaround, remove write access on `/ajax` and `/front` files to the web server. • https://github.com/glpi-project/glpi/releases/tag/10.0.10 • CWE-20: Improper Input Validation CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-42462 – File deletion through document upload process in GLPI
https://notcve.org/view.php?id=CVE-2023-42462
26 Sep 2023 — GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. The document upload process can be diverted to delete some files. Users are advised to upgrade to version 10.0.10. There are no known workarounds for this vulnerability. Gestionnaire Libre de Parc Informatique (GLPI) es un paquete Gratuito de Software de Gestión de Activos IT, que proporciona funciones de ITIL Service D... • https://github.com/glpi-project/glpi/security/advisories/GHSA-hm76-jh96-7j75 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-42461 – SQL injection in ITIL actors in GLPI
https://notcve.org/view.php?id=CVE-2023-42461
26 Sep 2023 — GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. The ITIL actors input field from the Ticket form can be used to perform a SQL injection. Users are advised to upgrade to version 10.0.10. There are no known workarounds for this vulnerability. Gestionnaire Libre de Parc Informatique (GLPI) es un paquete Gratuito de Software de Gestión de Activos IT, que proporciona func... • https://github.com/glpi-project/glpi/security/advisories/GHSA-x3jp-69f2-p84w • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2023-41888 – Phishing through a login page malicious URL in GLPI
https://notcve.org/view.php?id=CVE-2023-41888
26 Sep 2023 — GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. The lack of path filtering on the GLPI URL may allow an attacker to transmit a malicious URL of login page that can be used to attempt a phishing attack on user credentials. Users are advised to upgrade to version 10.0.10. There are no known workarounds for this vulnerability. Gestionnaire Libre de Parc Informatique (GL... • https://github.com/glpi-project/glpi/security/advisories/GHSA-2hcg-75jj-hghp • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.0EPSS: 5%CPEs: 1EXPL: 0CVE-2023-41326 – Account takeover via Kanban feature in GLPI
https://notcve.org/view.php?id=CVE-2023-41326
26 Sep 2023 — GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. A logged user from any profile can hijack the Kanban feature to alter any user field, and end-up with stealing its account. Users are advised to upgrade to version 10.0.10. There are no known workarounds for this vulnerability. Gestionnaire Libre de Parc Informatique (GLPI) es un paquete Gratuito de Software de Gestión ... • https://github.com/glpi-project/glpi/security/advisories/GHSA-5wj6-hp4c-j5q9 • CWE-269: Improper Privilege Management •