CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-45609 – GLPI has a Reflected XSS in /front/stat.graph.php
https://notcve.org/view.php?id=CVE-2024-45609
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability located in the reports pages. Upgrade to 10.0.17. • https://github.com/glpi-project/glpi/security/advisories/GHSA-3j2f-3j4v-hppr • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-43418 – GLPI has multiple reflected XSS
https://notcve.org/view.php?id=CVE-2024-43418
GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability. Upgrade to 10.0.17. • https://github.com/glpi-project/glpi/security/advisories/GHSA-x8jv-fcwx-3x6m • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-41678 – GLPI has multiple reflected XSS
https://notcve.org/view.php?id=CVE-2024-41678
GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability. Upgrade to 10.0.17. • https://github.com/glpi-project/glpi/security/advisories/GHSA-xwmx-mmrf-hqf9 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.7EPSS: 0%CPEs: 1EXPL: 0CVE-2024-31456 – GLPI contains an authenticated SQL injection
https://notcve.org/view.php?id=CVE-2024-31456
GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability from map search. This vulnerability is fixed in 10.0.15. GLPI es un paquete gratuito de software de gestión de TI y activos. Antes de 10.0.15, un usuario autenticado podía aprovechar una vulnerabilidad de inyección SQL desde la búsqueda de mapas. • https://github.com/glpi-project/glpi/commit/730c3db29a1edc32f9b9d1e2a940e90a0211ab26 https://github.com/glpi-project/glpi/security/advisories/GHSA-gcj4-2cp3-6h5j • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-29889 – GLPI contains an SQL injection through the saved searches
https://notcve.org/view.php?id=CVE-2024-29889
GLPI is a Free Asset and IT Management Software package. Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability in the saved searches feature to alter another user account data take control of it. This vulnerability is fixed in 10.0.15. GLPI es un paquete gratuito de software de gestión de TI y activos. Antes de 10.0.15, un usuario autenticado podía explotar una vulnerabilidad de inyección SQL en la función de búsquedas guardadas para alterar los datos de la cuenta de otro usuario y tomar el control de ella. • https://github.com/glpi-project/glpi/commit/0a6b28be4c0f848106c60b554c703ec2e178d6c7 https://github.com/glpi-project/glpi/security/advisories/GHSA-8xvf-v6vv-r75g • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •