CVE-2022-39371

GLPI (Gestionnaire Libre de Parc Informatique) has a vulnerability CVE-2022-39371 where script-related HTML tags in assets inventory information are not properly neutralized. The advisory and Nessus plugin indicate upgrading to version 10.0.4 to apply the patch; no public exploitation details are...

UBUNTU-CVE-2022-36112

GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Usage of RSS feeds or extenal calendar in planning is subject to SSRF exploit. Server-side requests ca...

CVE-2022-31187

GLPI (Gestionnaire Libre de Parc Informatique) is affected by CVE-2022-31187 due to insufficient neutralization of HTML tags in the global search context. The public advisory states that affected GLPI versions require upgrading to 10.0.3 to resolve the issue, or, if upgrading is not possible, dis...

CVE-2022-35945

GLPI (Gestionnaire Libre de Parc Informatique) is affected by CVE-2022-35945 due to improper escaping of data on the registration key configuration page, enabling theft of an administrator cookie. The issue is addressed by upgrading to GLPI 10.0.3 or later; there are no documented workarounds in ...

UBUNTU-CVE-2020-11031

In GLPI before version 9.5.0, the encryption algorithm used is insecure. The security of the data encrypted relies on the password used, if a user sets a weak/predictable password, an attacker could decrypt data. This is fixed in version 9.5.0 by using a more secure encryption library. The librar...