Design/Logic Flaw

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a on a file accessible by an authenticated user or not for certain actions, allows a threat actor to interact, modify, or see Dashboard data. Version 10.0.8...

CVE-2023-36808

GLPI (asset and IT management software) has a SQL injection vulnerability affecting versions prior to 10.0.8, involving the Computer Virtual Machine form and GLPI inventory request. The issue is addressed by a patch in version 10.0.8; as a workaround, disable native inventory. Other security sour...

CVE-2023-35939

GLPI CVE-2023-35939 concerns an incorrect rights check in GLPI prior to version 10.0.8, affecting 9.5.0 and all versions before 10.0.8. A threat actor with authentication (or in some cases without) could interact with, modify, or view Dashboard data due to this rights check flaw. The patch is ava...

CVE-2023-35939 GLPI vulnerable to unauthorized access to Dashboard data

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a on a file accessible by an authenticated user or not for certain actions, allows a threat actor to interact, modify, or see Dashboard data. Version 10.0.8...

CVE-2023-34107

GLPI is a free asset and IT management software package. Versions of the software starting with 9.2.0 and prior to 10.0.8 have an incorrect rights check on a on a file accessible by an authenticated user, allows access to the view all KnowbaseItems. Version 10.0.8 has a patch for this issue...

UBUNTU-CVE-2023-34107

GLPI is a free asset and IT management software package. Versions of the software starting with 9.2.0 and prior to 10.0.8 have an incorrect rights check on a on a file accessible by an authenticated user, allows access to the view all KnowbaseItems. Version 10.0.8 has a patch for this issue...

CVE-2023-34244

GLPI is a free asset and IT management software package. Starting in version 9.4.0 and prior to version 10.0.8, a malicious link can be crafted by an unauthenticated user that can exploit a reflected XSS in case any authenticated user opens the crafted link. Users should upgrade to version 10.0.8...

CVE-2023-35924

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.8, GLPI inventory endpoint can be used to drive a SQL injection attack. By default, GLPI inventory endpoint requires no authentication. Version 10.0.8 has a patch for this issue. As a...

CVE-2023-35924

GLPI CVE-2023-35924 covers a SQL injection in the inventory endpoint of GLPI versions 10.0.0 through prior to 10.0.8, with the endpoint requiring no authentication by default. The issue can be exploited over the network and is mitigated by upgrading to version 10.0.8, which includes a patch; as a...

CVE-2023-34244

CVE-2023-34244 (GLPI) affects GLPI, a free asset/IT management software. The initial description documents an unauthenticated user crafting a link that triggers a reflected XSS when an authenticated user opens it, with a patch released in version 10.0.8. Connected sources detail additional GLPI i...

CVE-2023-34107

GLPI CVE-2023-34107 affects GLPI versions 9.2.0 up to, but not including, 10.0.8, where an incorrect rights check on a file accessible by an authenticated user allows viewing all KnowbaseItems. The issue is rooted in insufficient access control for a file/resource; the vendor issued a patch in ve...

UBUNTU-CVE-2023-34106

GLPI is a free asset and IT management software package. Versions of the software starting with 0.68 and prior to 10.0.8 have an incorrect rights check on a on a file accessible by an authenticated user. This allows access to the list of all users and their personal information. Users should...

CVE-2023-34106

CVE-2023-34106 affects GLPI: versions starting from 0.68 up to 10.0.7/10.0.8 expose a rights check flaw on a file accessible to authenticated users, allowing access to the list of all users and their personal information. The advisory explicitly recommends upgrading to 10.0.8 for the patch. Conne...

CVE-2023-34106 GLPI vulnerable to unauthorized access to User data

GLPI is a free asset and IT management software package. Versions of the software starting with 0.68 and prior to 10.0.8 have an incorrect rights check on a on a file accessible by an authenticated user. This allows access to the list of all users and their personal information. Users should...

GLPI 安全漏洞

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner cartridg...

addLiquidity() unable to work

Lines of code Vulnerability details Impact missing the first transfer of the asset to router, addLiquidity unable to work Proof of Concept UlyssesRouter.addLiquidityuse for mint LP The code is as follows: function addLiquidityuint256 amount, uint256 minOutput, uint256 poolId external returns...

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server shipped with Asset and Service Management (CVE-2023-35890)

Summary IBM WebSphere Application Server is shipped as a component of Maximo Asset Management, Maximo Industry Solutions including Maximo for Nuclear Power, Maximo for Transportation, Maximo for Life Sciences, Maximo for Oil and Gas, and Maximo for Utilities, Maximo Adapter for Primavera,...

Calls to rigidRedemption can fail due to an underflow when collateralAsset price falls.

Lines of code Vulnerability details Impact When the collateralAsset price falls drastically a wrong collateralAmount is calculated in the line below from the eusdAmount. The collateralAmount calculated can be greater than the amount deposited by the provider in the rigidRedemption. Which leads to...

In LybraStETHVault.sol (LybraEUSDVaultBase.sol) a user could rigid redeem an amount more than their deposited collateral when the collateral ratio of the user goes below 100% even if they have been super-liquidated.

Lines of code Vulnerability details Impact If the collateral ratio of a user goes below 100%, the user would be able to redeem all of their eUSD for a collateral amount greater than their depositedAssetuser even after they have been super-liquidated. For eg, let us say we have a user X. Now, in...

Security Bulletin: There is a vulnerability in GraphQL used by IBM Maximo Asset Management (CVE-2023-28867)

Summary There is a vulnerability in GraphQL used by IBM Maximo Asset Management Vulnerability Details CVEID:CVE-2023-28867 DESCRIPTION: GraphQL Java is vulnerable to a denial of service, caused by a stack-based buffer overflow. By sending a specially crafted GraphQL query, a remote attacker could...