PT-2024-5859 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 10.0.16 Description: The issue is related to the GLPI system, which is an open-source asset and IT management software package providing ITIL Service Desk features, licenses tracking, and software auditing. An...

Infotel Conseil GLPI 安全漏洞

Infotel Conseil GLPI is an application from Infotel, Inc. A security vulnerability exists in Infotel Conseil GLPI v.10.X.X and prior versions, which stems from insufficient validation of user-supplied input and allows remote attackers to execute arbitrary code...

The vulnerability of software for managing assets and data centers in GLPI lies in the insufficient protection of SQL queries, allowing attackers to execute arbitrary SQL queries.

The vulnerability of software for managing assets and data centers in GLPI is related to the implementation of SQL code through administrative control of information panels. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

CVE-2024-27756

GLPI through 10.0.12 allows CSV injection by an attacker who is able to create an asset with a crafted title...

PT-2024-5872 · Glpi +1 · Glpi +1

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 10.0.13 Description: The issue is related to CSV injection, where an attacker can create an asset with a crafted title, potentially allowing a remote attacker to impact the confidentiality, integrity, and availability o...

GLPI Injection Vulnerability

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner cartridg...

The vulnerability of the GLPI system’s request, incident, and inventory management functions arises from incorrect restrictions on the path to the restricted catalog when processing URL parameters. This allows attackers to carry out phishing attacks against user accounts.

The vulnerability of the GLPI system’s request, incident, and computer equipment inventory management processes is related to incorrect restrictions on the path to the restricted access catalog when processing URL parameters. Exploiting this vulnerability allows a malicious actor to carry out...

CVE-2023-42802 GLPI vulnerable to unallowed PHP script execution

GLPI is a free asset and IT management software package. Starting in version 10.0.7 and prior to version 10.0.10, an unverified object instantiation allows one to upload malicious PHP files to unwanted directories. Depending on web server configuration and available system libraries, malicious PH...

GLPI Input Validation Error Vulnerability

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner cartridg...

GLPI Security Vulnerabilities

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner and ink...

GLPI Code Issue Vulnerability

GLPI is an open source IT and asset management software for individual developers. The software provides a fully functional IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner...

PT-2023-6822 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 10.0.10 Description: The issue is related to information disclosure in the GLPI system. Exploitation of this issue may allow a remote attacker to disclose protected information. An API user can enumerate sensitive field...

UBUNTU-CVE-2023-35924

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.8, GLPI inventory endpoint can be used to drive a SQL injection attack. By default, GLPI inventory endpoint requires no authentication. Version 10.0.8 has a patch for this issue. As a...

GLPI 安全漏洞

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner and ink...

The vulnerability of the GLPI system’s request and incident handling process, related to the possibility of forging requests on the server side, allows attackers to perform SSRF attacks.

The vulnerability of the GLPI system’s request and incident handling functionality lies in insufficient verification of data entered by users in the automatic RSS detection function. Users can send specially crafted HTTP requests to trick the application into initiating requests to arbitrary...

CVE-2022-34127

The Managentities plugin before 4.0.2 for GLPI allows reading local files via directory traversal in the inc/cri.class.php file parameter...

CVE-2022-34126

The Activity plugin before 3.1.1 for GLPI allows reading local files via directory traversal in the front/cra.send.php file parameter...

CVE-2023-28636 GLPI vulnerable to stored Cross-site Scripting in external links

GLPI is a free asset and IT management software package. Starting in version 0.60 and prior to versions 9.5.13 and 10.0.7, a vulnerability allows an administrator to create a malicious external link. This issue is fixed in versions 9.5.13 and 10.0.7...

CVE-2023-28634 GLPI vulnerable to Privilege Escalation from Technician to Super-Admin

GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.7, a user who has the Technician profile could see and generate a Personal token for a Super-Admin. Using such token it is possible to negotiate a GLPI session and hijack the...

CVE-2023-28632 GLPI vulnerable to account takeover by authenticated user

GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.7, an authenticated user can modify emails of any user, and can therefore takeover another user account through the "forgotten password" feature. By modifying emails, the user c...