CVE-2017-11474

GLPI before 9.1.5.1 has an SQL injection in the $crit variable in inc/computer_softwareversion.class.php, exploitable via ajax/common.tabs.php. The CVE-2017-11474 entry is supported by several connected advisories and translations indicating affected versions and vendor responses. Public referenc...

CVE-2017-11475

GLPI before 9.1.5.1 contains a SQL Injection in the condition rule field, exploitable via front/rulesengine.test.php. The issue is confirmed in CVE-2017-11475 (CVSS up to 8.8 for 3.0) with network attack and high impact on confidentiality, integrity, and availability. Remediation shown in connect...

CVE-2017-11474

GLPI before 9.1.5.1 has SQL Injection in the $crit variable in inc/computersoftwareversion.class.php, exploitable via ajax/common.tabs.php...

CVE-2017-11474: Improper Neutralization of Special Elements used in an SQL Command

GLPI before 9.1.5.1 has SQL Injection in the $crit variable in inc/computersoftwareversion.class.php, exploitable via ajax/common.tabs.php...

CVE-2017-11475: Improper Neutralization of Special Elements used in an SQL Command

GLPI before 9.1.5.1 has SQL Injection in the condition rule field, exploitable via front/rulesengine.test.php...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in GLPI 0.90.4 allows remote authenticated attackers to submit a request that could lead to the creation of an admin account in the application...

CVE-2016-7507

Cross-Site Request Forgery CSRF vulnerability in GLPI 0.90.4 allows remote authenticated attackers to submit a request that could lead to the creation of an admin account in the application...

CVE-2016-7509

Cross-site scripting XSS vulnerability in GLPI 0.90.4 allows remote authenticated attackers to inject arbitrary web script or HTML by attaching a crafted HTML file to a ticket...

CVE-2016-7507

Cross-Site Request Forgery CSRF vulnerability in GLPI 0.90.4 allows remote authenticated attackers to submit a request that could lead to the creation of an admin account in the application...

CVE-2016-7507

Cross-Site Request Forgery CSRF vulnerability in GLPI 0.90.4 allows remote authenticated attackers to submit a request that could lead to the creation of an admin account in the application...

CVE-2016-7509

Cross-site scripting XSS vulnerability in GLPI 0.90.4 allows remote authenticated attackers to inject arbitrary web script or HTML by attaching a crafted HTML file to a ticket...

CVE-2016-7509

Cross-site scripting XSS vulnerability in GLPI 0.90.4 allows remote authenticated attackers to inject arbitrary web script or HTML by attaching a crafted HTML file to a ticket...

Cross site scripting

Cross-site scripting XSS vulnerability in GLPI 0.90.4 allows remote authenticated attackers to inject arbitrary web script or HTML by attaching a crafted HTML file to a ticket...

CVE-2016-7509

Cross-site scripting XSS vulnerability in GLPI 0.90.4 allows remote authenticated attackers to inject arbitrary web script or HTML by attaching a crafted HTML file to a ticket...

CVE-2016-7507

CVE-2016-7507 describes a CSRF vulnerability in GLPI 0.90.4 where a remote authenticated attacker can submit a request to create an administrator account. The incident is documented across several sources (NVD entry and related CNVD/PRION/UBUNTU records) confirming the same flaw in GLPI 0.90.4. A...

CVE-2016-7509

Cross-site scripting XSS vulnerability in GLPI 0.90.4 allows remote authenticated attackers to inject arbitrary web script or HTML by attaching a crafted HTML file to a ticket...

CVE-2016-7507

Cross-Site Request Forgery CSRF vulnerability in GLPI 0.90.4 allows remote authenticated attackers to submit a request that could lead to the creation of an admin account in the application...

CVE-2016-7509

GLPI 0.90.4 is affected by CVE-2016-7509, a cross-site scripting (XSS) vulnerability. The issue arises when an attacker with authentication attaches a specially crafted HTML file to a ticket, enabling injection of arbitrary script/HTML in the web context. No exploitation details are provided in t...

CVE-2016-7507: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in GLPI 0.90.4 allows remote authenticated attackers to submit a request that could lead to the creation of an admin account in the application...

CVE-2016-7509: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in GLPI 0.90.4 allows remote authenticated attackers to inject arbitrary web script or HTML by attaching a crafted HTML file to a ticket...