3050 matches found
CVE-2013-5696
inc/central.class.php in GLPI before 0.84.2 does not attempt to make install/install.php unavailable after an installation is completed, which allows remote attackers to conduct cross-site request forgery CSRF attacks, and 1 perform a SQL injection via an Etape4 action or 2 execute arbitrary PHP...
Cross site request forgery (csrf)
inc/central.class.php in GLPI before 0.84.2 does not attempt to make install/install.php unavailable after an installation is completed, which allows remote attackers to conduct cross-site request forgery CSRF attacks, and 1 perform a SQL injection via an Etape4 action or 2 execute arbitrary PHP...
CVE-2013-5696
inc/central.class.php in GLPI before 0.84.2 does not attempt to make install/install.php unavailable after an installation is completed, which allows remote attackers to conduct cross-site request forgery CSRF attacks, and 1 perform a SQL injection via an Etape4 action or 2 execute arbitrary PHP...
UBUNTU-CVE-2013-5696
inc/central.class.php in GLPI before 0.84.2 does not attempt to make install/install.php unavailable after an installation is completed, which allows remote attackers to conduct cross-site request forgery CSRF attacks, and 1 perform a SQL injection via an Etape4 action or 2 execute arbitrary PHP...
CVE-2013-5696
GLPI before 0.84.2 is affected by CVE-2013-5696 due to inc/central.class.php not disabling install.php after installation, enabling CSRF and, via Etape_4 and update_1 actions, potential SQL injection and arbitrary PHP code execution. The CVE is documented with root cause as improper access contro...
CVE-2013-5696
inc/central.class.php in GLPI before 0.84.2 does not attempt to make install/install.php unavailable after an installation is completed, which allows remote attackers to conduct cross-site request forgery CSRF attacks, and 1 perform a SQL injection via an Etape4 action or 2 execute arbitrary PHP...
Fedora 20 : glpi-0.83.9.1-4.fc20 (2013-16533)
Security improvement: restrict access to installation wizard from local server only. Remote access need to be explicitly allowed in configuration /etc/httpd/conf.d/glpi.conf. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisor...
GLPI - 'install.php' Remote Command Execution (Metasploit)
This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'GLPI install.php Remote Command...
CVE-2013-5696: Cross-Site Request Forgery (CSRF)
inc/central.class.php in GLPI before 0.84.2 does not attempt to make install/install.php unavailable after an installation is completed, which allows remote attackers to conduct cross-site request forgery CSRF attacks, and 1 perform a SQL injection via an Etape4 action or 2 execute arbitrary PHP...
[SECURITY] Fedora 20 Update: glpi-0.83.9.1-4.fc20
GLPI is the Information Resource-Manager with an additional Administration- Interface. You can use it to build up a database with an inventory for your company computer, software, printers.... It has enhanced functions to make the daily life for the administrators easier, like a job-tracking-syst...
Fedora 18 : glpi-0.83.9.1-4.fc18 (2013-16575)
Security improvement: restrict access to installation wizard from local server only. Remote access need to be explicitly allowed in configuration /etc/httpd/conf.d/glpi.conf. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisor...
Fedora 19 : glpi-0.83.9.1-4.fc19 (2013-16601)
Security improvement: restrict access to installation wizard from local server only. Remote access need to be explicitly allowed in configuration /etc/httpd/conf.d/glpi.conf. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisor...
[SECURITY] Fedora 18 Update: glpi-0.83.9.1-4.fc18
GLPI is the Information Resource-Manager with an additional Administration- Interface. You can use it to build up a database with an inventory for your company computer, software, printers.... It has enhanced functions to make the daily life for the administrators easier, like a job-tracking-syst...
[SECURITY] Fedora 19 Update: glpi-0.83.9.1-4.fc19
GLPI is the Information Resource-Manager with an additional Administration- Interface. You can use it to build up a database with an inventory for your company computer, software, printers.... It has enhanced functions to make the daily life for the administrators easier, like a job-tracking-syst...
GLPI install.php Remote Command Execution Vulnerability
This Metasploit module exploits an arbitrary command execution vulnerability in the GLPI 'install.php' script. Users should use this exploit at his own risk, since it's going to overwrite database configuration. This file is part of the Metasploit Framework and may be subject to redistribution an...
Updated glpi package fixes security vulnerabilities
Multiple security vulnerabilities due to improper sanitation of user input in GLPI before versions 0.83.9 CVE-2013-2226, 0.83.91 CVE-2013-2225, and 0.84.2 CVE-2013-5696. This update provides GLPI version 0.83.91, with a patch from GLPI 0.84.2, to fix these issues...
MGASA-2013-0288 Updated glpi package fixes security vulnerabilities
Multiple security vulnerabilities due to improper sanitation of user input in GLPI before versions 0.83.9 CVE-2013-2226, 0.83.91 CVE-2013-2225, and 0.84.2 CVE-2013-5696. This update provides GLPI version 0.83.91, with a patch from GLPI 0.84.2, to fix these issues...
Security fix for the ALT Linux 10 package glpi version 0.84.2-alt1
Sept. 20, 2013 Pavel Zilke 0.84.2-alt1 - Security fixes: + CVE-2013-5696 : SQL Injection, PHP Code Execution, CSRF...
Security fix for the ALT Linux 9 package glpi version 0.84.2-alt1
Sept. 20, 2013 Pavel Zilke 0.84.2-alt1 - Security fixes: + CVE-2013-5696 : SQL Injection, PHP Code Execution, CSRF...
GLPI install.php Remote Command Execution
This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'GLPI install.php Remote Command...