76 matches found
CVE-2022-39234
GLPI (Gestionnaire Libre de Parc Informatique) is affected by CVE-2022-39234: a deleted or deactivated user may continue to use their account while a valid session cookie exists. The remediation is to upgrade to GLPI 10.0.4 or later; no workaround is documented in the provided sources.
CVE-2022-39376
CVE-2022-39376 affects GLPI (Gestionnaire Libre de Parc Informatique). The issue allows injecting custom field values in mailto links. It has been patched; upgrade to GLPI v10.0.4 or later to mitigate. The connected security sources also cite GLPI-related risks in older branches (pre-10.0.13), in...
CVE-2022-39371
GLPI (Gestionnaire Libre de Parc Informatique) has a vulnerability CVE-2022-39371 where script-related HTML tags in assets inventory information are not properly neutralized. The advisory and Nessus plugin indicate upgrading to version 10.0.4 to apply the patch; no public exploitation details are...
UBUNTU-CVE-2022-36112
GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Usage of RSS feeds or extenal calendar in planning is subject to SSRF exploit. Server-side requests ca...
UBUNTU-CVE-2022-35945
GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Information associated to registration key are not properly escaped in registration key configuration...
CVE-2022-31187
GLPI (Gestionnaire Libre de Parc Informatique) is affected by CVE-2022-31187 due to insufficient neutralization of HTML tags in the global search context. The public advisory states that affected GLPI versions require upgrading to 10.0.3 to resolve the issue, or, if upgrading is not possible, dis...
CVE-2022-35945
GLPI (Gestionnaire Libre de Parc Informatique) is affected by CVE-2022-35945 due to improper escaping of data on the registration key configuration page, enabling theft of an administrator cookie. The issue is addressed by upgrading to GLPI 10.0.3 or later; there are no documented workarounds in ...
versaillesgrandparc.fr Cross Site Scripting vulnerability OBB-2828760
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
GLPI SQL injection vulnerability
GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner cartridg...
rustracts (0.2.0) potentially affected by unknown CVE via parc (1.0.1)
parc CARGO version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on parc and may be impacted: - rustracts 0.2.0 Source cves: unknown CVE Source advisory: GHSA-XWXC-J97J-84GF...
GHSA-XWXC-J97J-84GF Race condition in Parc
In the affected versions of this crate, LockWeak unconditionally implemented Send with no trait bounds on T. LockWeak doesn't own T and only provides &T. This allows concurrent access to a non-Sync T, which can cause undefined behavior like data races...
rustracts (0.2.0) potentially affected by CVE-2020-36454 via parc (1.0.1)
parc CARGO version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on parc and may be impacted: - rustracts 0.2.0 Source cves: CVE-2020-36454 Source advisory: OSV:GHSA-XWXC-J97J-84GF...
Race condition in Parc
In the affected versions of this crate, LockWeak unconditionally implemented Send with no trait bounds on T. LockWeak doesn't own T and only provides &T. This allows concurrent access to a non-Sync T, which can cause undefined behavior like data races...
rustracts (0.2.0) potentially affected by CVE-2020-36454 via parc (1.0.1)
parc CARGO version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on parc and may be impacted: - rustracts 0.2.0 Source cves: CVE-2020-36454 Source advisory: OSV:GHSA-29V7-3V4C-GF38...
GHSA-29V7-3V4C-GF38 Data races in parc
In the affected versions of this crate, LockWeak unconditionally implemented Send with no trait bounds on T. LockWeak doesn't own T and only provides &T. This allows concurrent access to a non-Sync T, which can cause undefined behavior like data races...
rustracts (0.2.0) potentially affected by CVE-2020-36454 via parc (1.0.1)
parc CARGO version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on parc and may be impacted: - rustracts 0.2.0 Source cves: CVE-2020-36454 Source advisory: GHSA-29V7-3V4C-GF38...
CVE-2020-36454
An issue was discovered in the parc crate through 2020-11-14 for Rust. LockWeak has an unconditional implementation of Send without trait bounds on T...
CVE-2020-36454
An issue was discovered in the parc crate through 2020-11-14 for Rust. LockWeak has an unconditional implementation of Send without trait bounds on T...
