Information disclosure

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions all GLPI instances with the native inventory used may leak sensitive information. The feature to get refused file is not authenticated...

CVE-2022-31056

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions all assistance forms Ticket/Change/Problem permit sql injection on the actor fields. This issue has been resolved in version 10.0.2 and...

CVE-2022-31068 Sensitive Data Exposure on Refused Inventory Files in GLPI

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions all GLPI instances with the native inventory used may leak sensitive information. The feature to get refused file is not authenticated...

CVE-2022-31068 Sensitive Data Exposure on Refused Inventory Files in GLPI

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions all GLPI instances with the native inventory used may leak sensitive information. The feature to get refused file is not authenticated...

CVE-2022-31068

CVE-2022-31068 affects GLPI installations that use the native inventory, where all such instances may leak sensitive information due to an unauthenticated access path. The issue is addressed in GLPI version 10.0.2; all affected users are advised to upgrade to 10.0.2 or newer. The provided documen...

CVE-2022-31056 SQL injection with _actor parameter in GLPI

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions all assistance forms Ticket/Change/Problem permit sql injection on the actor fields. This issue has been resolved in version 10.0.2 and...

Sql injection

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. glpi-inventory-plugin is a plugin for GLPI to handle inventory management. In affected versions a SQL injection can be made using package deployment tasks...

CVE-2022-31082

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. glpi-inventory-plugin is a plugin for GLPI to handle inventory management. In affected versions a SQL injection can be made using package deployment tasks...

CVE-2022-31082

GLPI and its glpi-inventory-plugin are affected by CVE-2022-31082 due to a SQL injection via package deployment tasks. The issue affects versions prior to 1.0.2 and is fixed in 1.0.2; upgrade is advised. As a workaround for users unable to upgrade, delete front/deploypackage.public.php if the dep...

Exploit for Expression Language Injection in Atlassian Confluence_Data_Center

POC - Atlassian Confluence OGNL Injection Remote Code Executio...

REST API falsely updates Project Category without necessary permissions

panel:bgColor=e7f4fa NOTE: This is for JIRA Server and JIRA Data Center . panel h3. Issue Summary A User with Project Administrator permissions is able to update the Project Category via REST API. But in the Jira UI only a Jira Administrator is allowed to update the Project Category. h3. Steps to...

Full Read SSRF in Mobile Plugin CVE-2022-26135

A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user including a user who joined via the sign-up feature to perform a full read server-side request forgery via a batch endpoint. This affects Jira Management Server and Data Center versions from versi...

Exploit for Expression Language Injection in Atlassian Confluence_Data_Center

CVE-2022-26134 - OGNL injection vulnerability. In affected...

Atlassian Bitbucket Data Center Insecure Deserialization (CVE-2022-26133)

A insecure deserialization vulnerability exists in Atlassian Bitbucket Data Center. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system via Java deserialization...

Rest API Endpoint Leaked Project Categories, Project categories, status categories, issue link types, priorities, and resolutions to Unauthorised users

Affected versions of Atlassian Jira Server and Data Center allows an Un-Authenticated attacker to view Project categories, status categories, issue link types, priorities, and resolutions via an Information Disclosure vulnerability on the following Endpoints: /rest/api/2/issueLinkType...

Exploit for Expression Language Injection in Atlassian Confluence_Data_Center

「💥」CVE-2022-26134 Description In affected versions of Con...

CVE-2021-35092

Processing DCB/AVB algorithm with an invalid queue index from IOCTL request could lead to arbitrary address modification in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music...

IBM Spectrum Copy Data Management跨站请求伪造漏洞

IBM Spectrum Copy Data Management, an IBM company that modernizes, simplifies and automates data center copy management processes, is vulnerable to cross-site request forgery in IBM Spectrum Copy Data Management versions 2.2.0.0 through 2.2.15.0. An attacker could exploit the vulnerability to...

Powertek PDU Buffer Overflow Vulnerability

Powertek is a company that manufactures data center-grade intelligent PDUs Power Distribution Units, i.e., heavy-duty power strips for server racks. The Powertek PDUs suffer from a buffer overflow vulnerability that can be exploited by an attacker to cause disclosure of the active session id of t...

PT-2022-3484 · Unknown · Data Center Expert

Name of the Vulnerable Software and Affected Versions: Data Center Expert versions prior to 7.9.0 Description: The issue is related to insufficient protection of registration data in the Data Center Expert software. This could allow a remote attacker to gain full control over the software. The...