CVE-2023-22725 glpi vulnerable to XSS on external links

GLPI is a Free Asset and IT Management Software package. Versions 0.6.0 and above, prior to 10.0.6 are vulnerable to Cross-site Scripting. This vulnerability allow for an administrator to create a malicious external link. This issue is patched in 10.0.6...

CVE-2023-22725

CVE-2023-22725 affects GLPI (Free Asset and IT Management Software). Vulnerability: Cross-site Scripting in versions 0.6.0 and above, prior to 10.0.6, allowing an administrator to create a malicious external link. Root cause details are not fully elaborated beyond this description. Impact: user-f...

CVE-2023-23610 glpi vulnerable to Unauthorized access to data export

GLPI is a Free Asset and IT Management Software package. Versions prior to 9.5.12 and 10.0.6 are vulnerable to Improper Privilege Management. Any user having access to the standard interface can export data of almost any GLPI item type, even those on which user is not allowed to access including...

CVE-2023-23610 glpi vulnerable to Unauthorized access to data export

GLPI is a Free Asset and IT Management Software package. Versions prior to 9.5.12 and 10.0.6 are vulnerable to Improper Privilege Management. Any user having access to the standard interface can export data of almost any GLPI item type, even those on which user is not allowed to access including...

CVE-2023-23610

CVE-2023-23610 affects GLPI; prior to 10.0.6 (and older) versions, users with access to the standard interface could export data from most GLPI item types regardless of permissions. The entry states the issue is patched in 10.0.6. Other connected advisories describe separate issues (SQLi, XSS, SS...

CVE-2023-23610 glpi vulnerable to Unauthorized access to data export

GLPI is a Free Asset and IT Management Software package. Versions prior to 9.5.12 and 10.0.6 are vulnerable to Improper Privilege Management. Any user having access to the standard interface can export data of almost any GLPI item type, even those on which user is not allowed to access including...

CVE-2023-22724: Improper Neutralization of Input During Web Page Generation

GLPI is a Free Asset and IT Management Software package. Versions prior to 10.0.6 are subject to Cross-site Scripting via malicious RSS feeds. An Administrator can import a malicious RSS feed that contains Cross Site Scripting XSS payloads inside RSS links. Victims who wish to visit an RSS conten...

CVE-2023-23610: Improper Privilege Management

GLPI is a Free Asset and IT Management Software package. Versions prior to 9.5.12 and 10.0.6 are vulnerable to Improper Privilege Management. Any user having access to the standard interface can export data of almost any GLPI item type, even those on which user is not allowed to access including...

CVE-2023-22722: Improper Neutralization of Input During Web Page Generation

GLPI is a Free Asset and IT Management Software package. Versions 9.4.0 and above, prior to 10.0.6 are subject to Cross-site Scripting. An attacker can persuade a victim into opening a URL containing a payload exploiting this vulnerability. After exploited, the attacker can make actions as the...

CVE-2023-22725: Improper Neutralization of Input During Web Page Generation

GLPI is a Free Asset and IT Management Software package. Versions 0.6.0 and above, prior to 10.0.6 are vulnerable to Cross-site Scripting. This vulnerability allow for an administrator to create a malicious external link. This issue is patched in 10.0.6...

PT-2023-9269 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions 9.4.0 through 10.0.5 Description: The issue is related to Cross-site Scripting XSS due to improper neutralization of input data during web page generation. An attacker can exploit this by persuading a victim to open a URL...

CVE-2023-22500: Incorrect Authorization

GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6 are vulnerable to Incorrect Authorization. This vulnerability allow unauthorized access to inventory files. Thus, if anonymous access to FAQ is allowed, inventory files are accessbile by...

CVE-2022-41941: Improper Neutralization of Input During Web Page Generation

GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6, are subject to Cross-site Scripting. An administrator may store malicious code in help links. This issue is patched in 10.0.6...

Authenticated Remote Command Execution on GLPI 10.0.5 due to vulnerable marketplace plugin

Description It was found that GLPI at the current version 10.0.5 is vulnerable to a remote command execution when an attacker has super-user privileges. This is possible due to an attacker being able to download a plugin that contains files that was calling unserialize into $POST'entityrestrict'...

GLPI < 9.3.4 SQL Injection

GLPI in version 9.3.4 has an unauthenticated SQL Injection via the 'cycle' parameter of the 'unlocktasks.php' page. No source data...

GLPI 9.1 < 10.0.3 SQL Injection

GLPI in version 9.1 10.0.3 has an unauthenticated SQL Injection via the 'usertoken' parameter on the REST API. An attacker can use this injection to simulate an arbitrary user login. No source data...

GLPI 9.1 < 9.5.6 Rest API IP Restriction Bypass

GLPI in version 9.1 9.5.6 with API Rest enabled is vulnerable to API bypass with custom header injection. No source data...

GLPI Default Credentials

The scanner successfully authenticated on the GLPI web application by using predictable credentials on its login form. No source data...

CVE-2022-39181

GLPI - Reports plugin for GLPI Reflected Cross-Site-Scripting RXSS. Type 1: Reflected XSS or Non-Persistent - The server reads data directly from the HTTP request and reflects it back in the HTTP response. Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content t...

CVE-2022-39181

GLPI - Reports plugin for GLPI Reflected Cross-Site-Scripting RXSS. Type 1: Reflected XSS or Non-Persistent - The server reads data directly from the HTTP request and reflects it back in the HTTP response. Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content t...