GLPI XSS

The vulnerability of the GLPI system’s request, incident, and computer equipment inventory management functions is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks...

ROS-20250109-04

Vulnerability of the Fields plug-in of the GLPI system of requests, incidents and inventory of computer equipment is related to failure to take measures to protect the SQL query structure. Exploitation of the vulnerability could allow An attacker acting remotely could execute arbitrary SQL code...

PT-2024-37075 · Glpi · Tasklists

Name of the Vulnerable Software and Affected Versions: Tasklists versions prior to 2.0.4 Description: The issue is related to a blind SQL injection vulnerability. Tasklists provides plugin tasklists for GLPI. Versions prior to 2.0.4 are affected. Recommendations: For versions prior to 2.0.4, upda...

GLPI Improper Access Control Account Bypass

The vulnerability of the GLPI system for managing requests, incidents, and inventory of computer equipment is related to improper access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to the account through the API...

PT-2024-10105 · Glpi +1 · Glpi +1

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 10.0.17 Description: The issue is related to a lack of protection of the web page structure in the GLPI system, which can be exploited by a remote attacker to conduct a cross-site scripting XSS attack. Specifically, an...

GLPI Improper Session Management

The vulnerability of the GLPI system’s request, incident, and asset inventory management is related to improper session management. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain full access to the application by intercepting sessions...

PT-2024-8000 · Glpi +1 · Glpi +1

Name of the Vulnerable Software and Affected Versions: GLPI versions 0.80 through 10.0.16 Description: The issue is related to a lack of password recovery mechanism in the GLPI system, which can be exploited by a remote attacker to bypass existing security restrictions. An administrator with acce...

PT-2024-9895 · Glpi +1 · Fields Plugin +1

Name of the Vulnerable Software and Affected Versions: Fields plugin for GLPI versions prior to 1.21.13 Description: The issue is related to a lack of protection against SQL injection attacks in the Fields plugin for GLPI. This allows an authenticated user to perform a SQL injection when the plug...

ROS-20240812-12

Vulnerability of GLPI system of requests, incidents and inventory of computer equipment is related to Failure to take measures to protect the SQL query structure. Exploitation of the vulnerability could allow an attacker, acting remotely, to execute arbitrary SQL queries...

GLPI Improper Input Cancellation Unauthorized Access

The vulnerability of the GLPI request and incident handling system lies in the fact that the registration key is not properly encrypted on the configuration page for the registration key. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to the...

GLPI Auth Bypass Unauthorized Access

The vulnerability in the GLPI system’s request and incident handling process is related to an error in passing configuration data via JavaScript. In this error, some records are filtered out, but the ldappass variable is not filtered. Exploiting this vulnerability could allow a remote attacker to...

GLPI Falsifying Requests Redirect

The vulnerability in the GLPI system for handling requests and incidents is related to the possibility of forged requests on the server side. Exploiting this vulnerability allows a malicious actor to redirect users to an arbitrary URL address...

GLPI Request External Link

The vulnerability of the GLPI system for handling requests and incidents is related to the improper elimination of input data during the generation of the web page. Exploiting this vulnerability allows a malicious actor to create a malicious external link...

GLPI XSS

The vulnerability in the GLPI request and incident handling system relates to the improper elimination of input data during the generation of web pages. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks...

GLPI XSS

The vulnerability in the GLPI request and incident handling system relates to improper input validation during the creation of web pages. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks...

GLPI Authorization Bypass Info Disclosure

The vulnerability of the GLPI system for requests, incidents, and inventory management is related to deficiencies in authorization procedures. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

GLPI Injection Vulnerability

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner and ink...

GLPI SQL Injection

The vulnerability of the GLPI system’s request, incident, and computer equipment inventory management functions is related to the improper elimination of special elements used in SQL queries. Exploiting this vulnerability allows a malicious actor to alter the query logic to the database, by...

GLPI Code Execution

The vulnerability of the GLPI system for managing requests, incidents, and inventory of computer equipment is related to incorrect neutralization of certain elements in the output data. Exploiting this vulnerability allows a malicious actor to execute arbitrary codes remotely...

GLPI Insufficient Access Control Unauthorized Access

The vulnerability of the GLPI system for requests, incidents, and inventory management is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to another user’s account...