UBUNTU-CVE-2022-29250

GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to version 10.0.1 it is possible to add extra information by SQL injection on search pages. In order to exploit this vulnerability a user...

CVE-2022-29250

GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to version 10.0.1 it is possible to add extra information by SQL injection on search pages. In order to exploit this vulnerability a user...

CVE-2022-29250 SQL injection in GLPI

GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to version 10.0.1 it is possible to add extra information by SQL injection on search pages. In order to exploit this vulnerability a user...

CVE-2022-29250

GLPI vulnerability CVE-2022-29250 affects versions before 10.0.1. A SQL injection flaw on search pages allows a logged-in user to potentially modify information. Root cause: unsafely concatenated/retrieved search queries enabling injection. Impact: integrity is HIGH, confidentiality/availability ...

CVE-2022-29250 SQL injection in GLPI

GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to version 10.0.1 it is possible to add extra information by SQL injection on search pages. In order to exploit this vulnerability a user...

CVE-2022-29250 SQL injection in GLPI

GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to version 10.0.1 it is possible to add extra information by SQL injection on search pages. In order to exploit this vulnerability a user...

CVE-2022-24876

GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Kanban is a GLPI view to display Projects, Tickets, Changes or Problems on a task board. In versions prior to 10.0.1 a user can exploit a cross site scriptin...

CVE-2022-24876 Stored cross site scrpting in GLPI's Kanban

GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Kanban is a GLPI view to display Projects, Tickets, Changes or Problems on a task board. In versions prior to 10.0.1 a user can exploit a cross site scriptin...

CVE-2022-24876

CVE-2022-24876 is a stored cross-site scripting vulnerability in GLPI’s Kanban view. Public details confirm that versions prior to 10.0.1 are vulnerable to HTML injection via a user’s name, enabling a user-controllable script that could affect other users whenKanban pages are loaded. The issue is...

laral.istc.cnr.it Cross Site Scripting vulnerability OBB-2644426

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

control.disp.uniroma2.it Cross Site Scripting vulnerability OBB-2643193

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Malicious code in @tide-web-apps/bert2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 99d5f53797185072dc53ede74701d23610dd6e6cf3724c3e2e813142e0008738 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GLPI SQL injection vulnerability

GLPI is an IT and asset management software. The software provides a full-featured IT resource management interface that can be used to create a database to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner cartridges and ink cartridges, etc. A SQL...

CVE-2022-25152

The CVE-2022-25152 entry concerns ITarian’s platform (SaaS and on-premise) where a flaw in the agent-Run code workflow (procedures) allows bypassing the mandatory approval process. Versions before 6.35.37347.20040 are affected; a user with a valid session token can create a procedure, bypass appr...

Identifying Cloud Waste to Contain Unnecessary Costs

Cloud adoption has exploded over the past decade or so, and for good reason. Many digital transformation advancements – and even the complete reimagination of entire industries – can be directly mapped and attributed to cloud innovation. While this rapid pace of innovation has had a profound impa...

The Hidden Harm of Silent Patches

Hey all. I'm about to head off to RSAC 2022, but I wanted to jot down some thoughts I've had lately on a particularly squirrelly issue that comes up occasionally in coordinated vulnerability disclosure CVD — the issue of silent patches, and how they tend to help focused attackers and harm IT...

AM Live Vulnerability Management Conference 2022: my impressions and position

Hello everyone! This episode will be about the AM Live Vulnerability Management online conference. I participated in it on May 17th. Alternative video link for Russia: The event lasted 2 hours. Repeating everything that has been said is difficult and makes little sense. Those who want can watch t...

Microsoft Blocks Iran-linked Lebanese Hackers Targeting Israeli Companies

Microsoft on Thursday said it took steps to disable malicious activity stemming from abuse of OneDrive by a previously undocumented threat actor it tracks under the chemical element-themed moniker Polonium. In addition to removing the offending accounts created by the Lebanon-based activity group...

Command Injection

google-it is vulnerable to command injection. The vulnerability exists in the openInBrowser function in googleIt.js due to a lack of input sanitization which allows an attacker to inject and execute arbitrary codes...

GHSA-7XHV-MPJW-422F Command injection in google-it

Google-it is a Node.js package which allows its users to send search queries to Google and receive the results in a JSON format. When using the 'Open in browser' option in versions up to 1.6.2, google-it will unsafely concat the result's link retrieved from google to a shell command, potentially...