CVE-2023-22724 glpi contains XSS in RSS Description Link

GLPI is a Free Asset and IT Management Software package. Versions prior to 10.0.6 are subject to Cross-site Scripting via malicious RSS feeds. An Administrator can import a malicious RSS feed that contains Cross Site Scripting XSS payloads inside RSS links. Victims who wish to visit an RSS conten...

CVE-2023-22724

GLPI is affected by CVE-2023-22724: versions prior to 10.0.6 are vulnerable to Cross-site Scripting via malicious RSS feeds imported by an administrator. Visiting RSS content with a crafted link can execute JavaScript in a user’s browser. The flaw is mitigated by upgrading to 10.0.6 or newer, per...

CVE-2023-22724 glpi contains XSS in RSS Description Link

GLPI is a Free Asset and IT Management Software package. Versions prior to 10.0.6 are subject to Cross-site Scripting via malicious RSS feeds. An Administrator can import a malicious RSS feed that contains Cross Site Scripting XSS payloads inside RSS links. Victims who wish to visit an RSS conten...

CVE-2023-22724 glpi contains XSS in RSS Description Link

GLPI is a Free Asset and IT Management Software package. Versions prior to 10.0.6 are subject to Cross-site Scripting via malicious RSS feeds. An Administrator can import a malicious RSS feed that contains Cross Site Scripting XSS payloads inside RSS links. Victims who wish to visit an RSS conten...

CVE-2023-22725 glpi vulnerable to XSS on external links

GLPI is a Free Asset and IT Management Software package. Versions 0.6.0 and above, prior to 10.0.6 are vulnerable to Cross-site Scripting. This vulnerability allow for an administrator to create a malicious external link. This issue is patched in 10.0.6...

CVE-2023-22725 glpi vulnerable to XSS on external links

GLPI is a Free Asset and IT Management Software package. Versions 0.6.0 and above, prior to 10.0.6 are vulnerable to Cross-site Scripting. This vulnerability allow for an administrator to create a malicious external link. This issue is patched in 10.0.6...

CVE-2023-22725 glpi vulnerable to XSS on external links

GLPI is a Free Asset and IT Management Software package. Versions 0.6.0 and above, prior to 10.0.6 are vulnerable to Cross-site Scripting. This vulnerability allow for an administrator to create a malicious external link. This issue is patched in 10.0.6...

CVE-2023-22725

CVE-2023-22725 affects GLPI (Free Asset and IT Management Software). Vulnerability: Cross-site Scripting in versions 0.6.0 and above, prior to 10.0.6, allowing an administrator to create a malicious external link. Root cause details are not fully elaborated beyond this description. Impact: user-f...

CVE-2023-23610 glpi vulnerable to Unauthorized access to data export

GLPI is a Free Asset and IT Management Software package. Versions prior to 9.5.12 and 10.0.6 are vulnerable to Improper Privilege Management. Any user having access to the standard interface can export data of almost any GLPI item type, even those on which user is not allowed to access including...

CVE-2023-23610

CVE-2023-23610 affects GLPI; prior to 10.0.6 (and older) versions, users with access to the standard interface could export data from most GLPI item types regardless of permissions. The entry states the issue is patched in 10.0.6. Other connected advisories describe separate issues (SQLi, XSS, SS...

CVE-2023-23610 glpi vulnerable to Unauthorized access to data export

GLPI is a Free Asset and IT Management Software package. Versions prior to 9.5.12 and 10.0.6 are vulnerable to Improper Privilege Management. Any user having access to the standard interface can export data of almost any GLPI item type, even those on which user is not allowed to access including...

CVE-2023-23610 glpi vulnerable to Unauthorized access to data export

GLPI is a Free Asset and IT Management Software package. Versions prior to 9.5.12 and 10.0.6 are vulnerable to Improper Privilege Management. Any user having access to the standard interface can export data of almost any GLPI item type, even those on which user is not allowed to access including...

PT-2023-9269 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions 9.4.0 through 10.0.5 Description: The issue is related to Cross-site Scripting XSS due to improper neutralization of input data during web page generation. An attacker can exploit this by persuading a victim to open a URL...

Authenticated Remote Command Execution on GLPI 10.0.5 due to vulnerable marketplace plugin

Description It was found that GLPI at the current version 10.0.5 is vulnerable to a remote command execution when an attacker has super-user privileges. This is possible due to an attacker being able to download a plugin that contains files that was calling unserialize into $POST'entityrestrict'...

GLPI 9.1 < 10.0.3 SQL Injection

GLPI in version 9.1 10.0.3 has an unauthenticated SQL Injection via the 'usertoken' parameter on the REST API. An attacker can use this injection to simulate an arbitrary user login. No source data...

GLPI < 9.3.4 SQL Injection

GLPI in version 9.3.4 has an unauthenticated SQL Injection via the 'cycle' parameter of the 'unlocktasks.php' page. No source data...

GLPI 9.1 < 9.5.6 Rest API IP Restriction Bypass

GLPI in version 9.1 9.5.6 with API Rest enabled is vulnerable to API bypass with custom header injection. No source data...

GLPI Default Credentials

The scanner successfully authenticated on the GLPI web application by using predictable credentials on its login form. No source data...

CVE-2022-39181

GLPI - Reports plugin for GLPI Reflected Cross-Site-Scripting RXSS. Type 1: Reflected XSS or Non-Persistent - The server reads data directly from the HTTP request and reflects it back in the HTTP response. Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content t...

CVE-2022-39181

GLPI - Reports plugin for GLPI Reflected Cross-Site-Scripting RXSS. Type 1: Reflected XSS or Non-Persistent - The server reads data directly from the HTTP request and reflects it back in the HTTP response. Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content t...