CVSS: 8.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-35939 – GLPI vulnerable to unauthorized access to Dashboard data
https://notcve.org/view.php?id=CVE-2023-35939
05 Jul 2023 — GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a on a file accessible by an authenticated user (or not for certain actions), allows a threat actor to interact, modify, or see Dashboard data. Version 10.0.8 contains a patch for this issue. • https://github.com/glpi-project/glpi/releases/tag/10.0.8 • CWE-284: Improper Access Control CWE-863: Incorrect Authorization •
CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 0CVE-2023-35924 – GLPI vulnerable to SQL injection via inventory agent request
https://notcve.org/view.php?id=CVE-2023-35924
05 Jul 2023 — GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.8, GLPI inventory endpoint can be used to drive a SQL injection attack. By default, GLPI inventory endpoint requires no authentication. Version 10.0.8 has a patch for this issue. As a workaround, one may disable native inventory. • https://github.com/glpi-project/glpi/releases/tag/10.0.8 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 2%CPEs: 1EXPL: 0CVE-2023-34244 – GLPI vulnerable to reflected XSS in search pages
https://notcve.org/view.php?id=CVE-2023-34244
05 Jul 2023 — GLPI is a free asset and IT management software package. Starting in version 9.4.0 and prior to version 10.0.8, a malicious link can be crafted by an unauthenticated user that can exploit a reflected XSS in case any authenticated user opens the crafted link. Users should upgrade to version 10.0.8 to receive a patch. • https://github.com/glpi-project/glpi/releases/tag/10.0.8 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-34107 – GLPI vulnerable to unauthorized access to KnowbaseItem data
https://notcve.org/view.php?id=CVE-2023-34107
05 Jul 2023 — GLPI is a free asset and IT management software package. Versions of the software starting with 9.2.0 and prior to 10.0.8 have an incorrect rights check on a on a file accessible by an authenticated user, allows access to the view all KnowbaseItems. Version 10.0.8 has a patch for this issue. • https://github.com/glpi-project/glpi/releases/tag/10.0.8 • CWE-284: Improper Access Control CWE-863: Incorrect Authorization •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-34106 – GLPI vulnerable to unauthorized access to User data
https://notcve.org/view.php?id=CVE-2023-34106
05 Jul 2023 — GLPI is a free asset and IT management software package. Versions of the software starting with 0.68 and prior to 10.0.8 have an incorrect rights check on a on a file accessible by an authenticated user. This allows access to the list of all users and their personal information. Users should upgrade to version 10.0.8 to receive a patch. • https://github.com/glpi-project/glpi/releases/tag/10.0.8 • CWE-284: Improper Access Control CWE-863: Incorrect Authorization •
CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-34254 – Remote inventory task command injection when using ssh command mode
https://notcve.org/view.php?id=CVE-2023-34254
23 Jun 2023 — The GLPI Agent is a generic management agent. Prior to version 1.5, if glpi-agent is running remoteinventory task against an Unix platform with ssh command, an administrator user on the remote can manage to inject a command in a specific workflow the agent would run with the privileges it uses. In the case, the agent is running with administration privileges, a malicious user could gain high privileges on the computer glpi-agent is running on. A malicious user could also disclose all remote accesses the age... • https://github.com/glpi-project/glpi-agent/blob/dd313ee0914becf74c0e48cb512765210043b478/Changes#L98 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-34126
https://notcve.org/view.php?id=CVE-2022-34126
16 Apr 2023 — The Activity plugin before 3.1.1 for GLPI allows reading local files via directory traversal in the front/cra.send.php file parameter. • https://github.com/InfotelGLPI/activity/releases/tag/3.1.1 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.0EPSS: 1%CPEs: 2EXPL: 0CVE-2023-29006 – Order GLPI plugin vulnerable to remote code execution from authenticated user
https://notcve.org/view.php?id=CVE-2023-29006
05 Apr 2023 — The Order GLPI plugin allows users to manage order management within GLPI. Starting with version 1.8.0 and prior to versions 2.7.7 and 2.10.1, an authenticated user that has access to standard interface can craft an URL that can be used to execute a system command. Versions 2.7.7 and 2.10.1 contain a patch for this issue. As a workaround, delete the `ajax/dropdownContact.php` file from the plugin. • https://github.com/pluginsGLPI/order/commit/c78e64b95e54d5e47d9835984c93049f245b579e • CWE-502: Deserialization of Untrusted Data •
CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-28852 – GLPI vulnerable to stored Cross-site Scripting through dashboard administration
https://notcve.org/view.php?id=CVE-2023-28852
05 Apr 2023 — GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to versions 9.5.13 and 10.0.7, a user with dashboard administration rights may hack the dashboard form to store malicious code that will be executed when other users will use the related dashboard. Versions 9.5.13 and 10.0.7 contain a patch for this issue. • https://github.com/glpi-project/glpi/releases/tag/10.0.7 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 1%CPEs: 1EXPL: 0CVE-2023-28849 – GLPI vulnerable to SQL injection and Stored XSS via inventory agent request
https://notcve.org/view.php?id=CVE-2023-28849
05 Apr 2023 — GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.7, GLPI inventory endpoint can be used to drive a SQL injection attack. It can also be used to store malicious code that could be used to perform XSS attack. By default, GLPI inventory endpoint requires no authentication. Version 10.0.7 contains a patch for this issue. • https://github.com/glpi-project/glpi/releases/tag/10.0.7 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •