PT-2023-4275 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions 10.0.0 through 10.0.7 Description: The issue is related to a SQL injection attack that can be driven through the GLPI inventory endpoint, which by default requires no authentication. This allows a remote attacker to execute...

GLPI SQL注入漏洞

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner cartridg...

GLPI vulnerable to SQL injection via inventory agent request

[email protected] reports: GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.8, GLPI inventory endpoint can be used to drive a SQL injection attack. By default, GLPI inventory endpoint requires no authentication. Version...

How To Safeguard Your Data With Cloud MRP System

By Owais Sultan A cloud MRP system is an online platform that allows businesses to streamline their production planning, inventory control, and schedule operations. This is a post from HackRead.com Read the original post: How To Safeguard Your Data With Cloud MRP System...

CVE-2023-2842

The WP Inventory Manager WordPress plugin before 2.1.0.14 does not have CSRF checks, which could allow attackers to make logged-in admins delete Inventory Items via a CSRF attack...

CVE-2023-2842

The WP Inventory Manager WordPress plugin before 2.1.0.14 does not have CSRF checks, which could allow attackers to make logged-in admins delete Inventory Items via a CSRF attack...

Cross site request forgery (csrf)

The WP Inventory Manager WordPress plugin before 2.1.0.14 does not have CSRF checks, which could allow attackers to make logged-in admins delete Inventory Items via a CSRF attack...

CVE-2023-2842 WP Inventory Manager < 2.1.0.14 - Inventory Items Deletion via CSRF

The WP Inventory Manager WordPress plugin before 2.1.0.14 does not have CSRF checks, which could allow attackers to make logged-in admins delete Inventory Items via a CSRF attack...

CVE-2023-2842 WP Inventory Manager < 2.1.0.14 - Inventory Items Deletion via CSRF

The WP Inventory Manager WordPress plugin before 2.1.0.14 does not have CSRF checks, which could allow attackers to make logged-in admins delete Inventory Items via a CSRF attack...

CVE-2023-2842

CVE-2023-2842 affects the WordPress plugin WP Inventory Manager (pre-2.1.0.14). The vulnerability stems from missing CSRF checks, enabling a CSRF attack to cause logged-in admins to delete Inventory Items. Remediation: upgrade to version 2.1.0.14 or later. Reported impact aligns with CVSS v3.1: a...

Company finds lost SSD—and confidential data—for sale on eBay

Major software company SAP is putting the pieces of a story involving missing SSD disks back together. Four SSD disks are alleged to have gone on an adventure last November, making their way out of a Walldorf, Germany, datacenter with one of them ending up on eBay. An investigation revealed that...

PT-2023-21706 · WordPress · Wp Inventory Manager

Name of the Vulnerable Software and Affected Versions: WP Inventory Manager versions prior to 2.1.0.14 Description: The issue allows attackers to make logged-in admins delete Inventory Items via a CSRF attack due to the lack of CSRF checks. Recommendations: For versions prior to 2.1.0.14, update ...

WordPress plugin WP Inventory Manager 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

WordPress WP Inventory Manager Plugin < 2.1.0.14 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP Inventory Manager Type Plugin Vulnerable versions 2.1.0.14 Fixed in 2.1.0.14 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-2842 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID bec6aa4f94a2 Credits NGO VAN TU...

Supporting Our U.S. Federal Customers for BOD 23–02 by Mitigating the Risk From Internet-Exposed Management Interfaces

On June 13, 2023, the U.S. Cybersecurity & Infrastructure Security Agency CISA released Binding Operational Directive BOD 23-02: Mitigating the Risk from Internet-Exposed Management Interfaces. The directive requires federal civilian executive-branch agencies to adhere to two primary actions:...

The vulnerability of the GLPI system’s handling of requests and incidents, related to improper neutralization of special elements used in SQL commands, allows attackers to execute arbitrary SQL queries in the database.

The vulnerability of the GLPI application’s request and incident handling system lies in the insufficient cleaning of user data at the final inventory registration stage. Users can send specially created requests to the affected application and execute arbitrary SQL commands in the application’s...

CVE-2023-34254 Remote inventory task command injection when using ssh command mode

The GLPI Agent is a generic management agent. Prior to version 1.5, if glpi-agent is running remoteinventory task against an Unix platform with ssh command, an administrator user on the remote can manage to inject a command in a specific workflow the agent would run with the privileges it uses. I...

CVE-2023-34254 Remote inventory task command injection when using ssh command mode

The GLPI Agent is a generic management agent. Prior to version 1.5, if glpi-agent is running remoteinventory task against an Unix platform with ssh command, an administrator user on the remote can manage to inject a command in a specific workflow the agent would run with the privileges it uses. I...

InventoryPress <= 1.7 - Author+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow users with the role of author and above to perform Stored Cross-Site Scripting attacks. 1. Create a "New Inventory Item" 2. In the "Description" field, add the value "alert"xss" 3. Edit the created item and see the XS...

PT-2023-24778 · Unknown +1 · Glpi Agent +1

Name of the Vulnerable Software and Affected Versions: GLPI Agent versions prior to 1.5 Description: The issue affects the GLPI Agent, a generic management agent, when running the remoteinventory task against a Unix platform using the ssh command. An administrator user on the remote system can...