CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 0CVE-2022-39373 – Stored Cross-Site Scripting (XSS) in entity name in GLPI
https://notcve.org/view.php?id=CVE-2022-39373
03 Nov 2022 — GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Administrator may store malicious code in entity name. This issue has been patched, please upgrade to version 10.0.4. GLPI significa Gestionnaire Libre de Parc Informatique. • https://github.com/glpi-project/glpi/security/advisories/GHSA-cw37-q82c-w546 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-39375 – Cross-Site Scripting (XSS) through public RSS feed in GLPI
https://notcve.org/view.php?id=CVE-2022-39375
03 Nov 2022 — GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Users may be able to create a public RSS feed to inject malicious code in dashboards of other users. This issue has been patched, please upgrade to version 10.0.4. There are currently no known workarounds. • https://github.com/glpi-project/glpi/security/advisories/GHSA-fxcx-93fq-8r9g • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-39376 – Improper input validation on emails links in GLPI
https://notcve.org/view.php?id=CVE-2022-39376
03 Nov 2022 — GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Users may be able to inject custom fields values in `mailto` links. This issue has been patched, please upgrade to version 10.0.4. There are currently no known workarounds. • https://github.com/glpi-project/glpi/security/advisories/GHSA-6rh5-m5g7-327w • CWE-20: Improper Input Validation •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-39234 – user session persists even after permanently deleting account in GLPI
https://notcve.org/view.php?id=CVE-2022-39234
03 Nov 2022 — GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Deleted/deactivated user could continue to use their account as long as its cookie is valid. This issue has been patched, please upgrade to version 10.0.4. There are currently no known workarounds. • https://github.com/glpi-project/glpi/security/advisories/GHSA-pgcx-mc58-3gmg • CWE-613: Insufficient Session Expiration •
CVSS: 10.0EPSS: 94%CPEs: 1EXPL: 14CVE-2022-35914 – Teclib GLPI Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2022-35914
19 Sep 2022 — /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection. El archivo /vendor/htmlawed/htmlawed/htmLawedTest.php en el módulo htmlawed para GLPI versiones hasta 10.0.2, permite una inyección de código PHP Teclib GLPI contains a remote code execution vulnerability in the third-party library, htmlawed. • https://packetstorm.news/files/id/178425 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-31187 – Stored Cross Site Scripting (XSS) through global search in GLPI
https://notcve.org/view.php?id=CVE-2022-31187
14 Sep 2022 — GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Affected versions were found to not properly neutralize HTML tags in the global search context. Users are advised to upgrade to version 10.0.3 to resolve this issue. Users unable to upgrade should disable global search. GLPI son las siglas de Gestionnaire Libre de Parc Informatique y es un Paquete de Software Libre ... • https://github.com/glpi-project/glpi/commit/e248ed5649d267c0f61a17d99b7bd6be4074aadb • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.7EPSS: 0%CPEs: 1EXPL: 0CVE-2022-35946 – SQL injection through plugin controller in GLPI
https://notcve.org/view.php?id=CVE-2022-35946
14 Sep 2022 — GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In affected versions request input is not properly validated in the plugin controller and can be used to access low-level API of Plugin class. An attacker can, for instance, alter database data. Attacker must have "General setup" update rights to be able to perform this attack. Users are advised to upgrade to versio... • https://github.com/glpi-project/glpi/commit/f542ec8378afbd8038aeca5975b15eca3f0574c8 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-35947 – SQL injection in GLPI
https://notcve.org/view.php?id=CVE-2022-35947
14 Sep 2022 — GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Affected versions have been found to be vulnerable to a SQL injection attack which an attacker could leverage to simulate an arbitrary user login. Users are advised to upgrade to version 10.0.3. Users unable to upgrade should disable the `Enable login with external token` API configuration. GLPI es el acrónimo de Ge... • https://github.com/glpi-project/glpi/commit/564309d2c1180d5ba1615f4bbaf6623df81b4962 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 5.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-36112 – Blind Server-Side Request Forgery (SSRF) in GLPI
https://notcve.org/view.php?id=CVE-2022-36112
14 Sep 2022 — GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Usage of RSS feeds or extenal calendar in planning is subject to SSRF exploit. Server-side requests can be used to scan server port or services opened on GLPI server or its private network. Queries responses are not exposed to end-user (blind SSRF). Users are advised to upgrade to version 10.0.3 to resolve this issu... • https://github.com/glpi-project/glpi/commit/ad66d69049ae02bead8ed0f4ee654a458643244e • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2022-35945 – Cross site scripting (XSS) via registration API in GLPI
https://notcve.org/view.php?id=CVE-2022-35945
14 Sep 2022 — GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Information associated to registration key are not properly escaped in registration key configuration page. They can be used to steal a GLPI administrator cookie. Users are advised to upgrade to 10.0.3. There are no known workarounds for this issue. ### Workarounds Do not use a registration key created by an untrust... • https://github.com/glpi-project/glpi/commit/2b8f9aa54ae4a4ec07bde0c8db739a292b8ec09a • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •