CVE-2022-35947

CVE-2022-35947 affects GLPI (Gestionnaire Libre de Parc Informatique). Affected versions have a SQL injection vulnerability that could allow an attacker to simulate an arbitrary user login. The advisory explicitly recommends upgrading to version 10.0.3 . As a workaround if upgrading isn’t possibl...

CVE-2022-35947 SQL injection in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Affected versions have been found to be vulnerable to a SQL injection attack which an attacker could...

CVE-2022-36112

GLPI (Gestionnaire Libre de Parc Informatique) contains a blind Server-Side Request Forgery (SSRF) vulnerability (CVE-2022-36112) affecting RSS feeds and planning features. The underlying issue allows server-side requests to be made from the GLPI server to internal ports/services on its private n...

CVE-2022-36112 Blind Server-Side Request Forgery (SSRF) in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Usage of RSS feeds or extenal calendar in planning is subject to SSRF exploit. Server-side requests ca...

CVE-2022-35945

GLPI (Gestionnaire Libre de Parc Informatique) is affected by CVE-2022-35945 due to improper escaping of data on the registration key configuration page, enabling theft of an administrator cookie. The issue is addressed by upgrading to GLPI 10.0.3 or later; there are no documented workarounds in ...

CVE-2022-31143

CVE-2022-31143 affects GLPI (Gestionnaire Libre de Parc Informatique). The issue is an exposure of private information defined in GLPI setup (e.g., SMTP/cas hosts); passwords are not exposed. Affected versions disclose configuration data, not credentials, per the description. The action recommend...

CVE-2022-31143 Leak of sensitive information through login page error in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. It was found that in affected versions there is an exposure of private information defined in setup of...

CVE-2022-22330

IBM Control Desk 7.6.1 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie. IBM X-Force ID: 219126...

CVE-2022-22330

IBM Control Desk 7.6.1 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie. IBM X-Force ID: 219126...

CVE-2022-22329

IBM Control Desk 7.6.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacke...

Information disclosure

IBM Control Desk 7.6.1 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie. IBM X-Force ID: 219126...

Authorization

IBM Control Desk 7.6.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacke...

CVE-2022-22330

IBM Control Desk 7.6.1 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie. IBM X-Force ID: 219126...

CVE-2022-22330

CVE-2022-22330 affects IBM Control Desk 7.6.x (notably 7.6.1) and is caused by the HTTPOnly flag not being set on a cookie (BAYEUX_BROWSER). A remote attacker could access cookie data due to this missing flag. IBM’s security bulletin confirms the vulnerability and provides a remediation path: upg...

CVE-2022-22329

IBM Control Desk 7.6.1 is vulnerable because authorization tokens and session cookies lack the secure attribute, allowing cookie values to be captured if a user visits an http link or a link is planted on a site. The issue affects IBM Control Desk 7.6.x (notably 7.6.1). Mitigation documented by I...

CVE-2022-22329

IBM Control Desk 7.6.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacke...

PT-2022-15367 · Ibm · Ibm Control Desk

Name of the Vulnerable Software and Affected Versions: IBM Control Desk version 7.6.1 Description: The issue allows attackers to obtain cookie values by sending an http link to a user or planting this link in a site the user visits. When the user clicks the link, the cookie will be sent to the...

IBM Control Desk 信息泄露漏洞

IBM Control Desk is an application from International Business Machines IBM. Automated service management and seamlessly integrated, best-practice based service desk functionality. A security vulnerability exists in IBM Control Desk version 7.6.1, which stems from the fact that its unset HTTP Onl...

PT-2022-15369 · Ibm · Ibm Control Desk

Name of the Vulnerable Software and Affected Versions: IBM Control Desk version 7.6.1 Description: The issue is caused by the failure to set the HTTPOnly flag, allowing a remote attacker to obtain sensitive information from the cookie. Recommendations: For IBM Control Desk version 7.6.1, set the...

IBM Control Desk 安全漏洞

IBM Control Desk is an application from International Business Machines IBM. Automated service management and seamlessly integrated, best-practice based service desk functionality. A security vulnerability exists in IBM Control Desk version 7.6.1, which stems from the fact that it does not set...