CVE-2022-39376 Improper input validation on emails links in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Users may be able to inject custom fields values in mailto links. This issue has been patched, please...

CVE-2022-39370 Improper access to debug panel in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Connected users may gain access to debug panel through the GLPI update script. This issue has been...

CVE-2022-39277

CVE-2022-39277 affects GLPI (Gestionnaire Libre de Parc Informatique) where external links are not properly sanitized, enabling a Cross-Site Scripting (XSS) attack. The issue is mitigated by upgrading to GLPI 10.0.4, as noted in the description. According to the provided documents, the CVSS detai...

CVE-2022-39373

CVE-2022-39373 affects GLPI where an administrator can store malicious code in an entity name; the issue has been patched and users should upgrade to GLPI 10.0.4 to remediate.

CVE-2022-39376

CVE-2022-39376 affects GLPI (Gestionnaire Libre de Parc Informatique). The issue allows injecting custom field values in mailto links. It has been patched; upgrade to GLPI v10.0.4 or later to mitigate. The connected security sources also cite GLPI-related risks in older branches (pre-10.0.13), in...

CVE-2022-39277 Cross-Site Scripting (XSS) in external links in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. External links are not properly sanitized and can therefore be used for a Cross-Site Scripting XSS...

Last Years Open Source - Tomorrow's Vulnerabilities

Linus Torvalds, the creator of Linux and Git, has his own law in software development, and it goes like this: "given enough eyeballs, all bugs are shallow." This phrase puts the finger on the very principle of open source: the more, the merrier - if the code is easily available for anyone and...

The vulnerability in the console, Telnet, and SSH program-and-device tools for diagnosing and auditing computer networks in FortiTester allows a perpetrator to execute arbitrary code.

The vulnerability in the console, Telnet, and SSH programming-hardware tools for diagnosing and auditing computer networks in FortiTester relates to the possibility of executing unauthorized code or commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Unbreakable Enterprise kernel security update

5.4.17-2136.311.6 - Revert 'KVM: x86: Print error code in exception injection tracepoint iff valid' Sherry Yang Orabug: 34535896 5.4.17-2136.311.5 - netfilter: nftables: do not allow RULEID to refer to another chain Thadeu Lima de Souza Cascardo Orabug: 34495567 CVE-2022-2586 - netfilter: nftable...

CVE-2022-36112

GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Usage of RSS feeds or extenal calendar in planning is subject to SSRF exploit. Server-side requests ca...

CVE-2022-35945

GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Information associated to registration key are not properly escaped in registration key configuration...

Out-of-bounds

GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Affected versions were found to not properly neutralize HTML tags in the global search context. Users...

UBUNTU-CVE-2022-35947

GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Affected versions have been found to be vulnerable to a SQL injection attack which an attacker could...

CVE-2022-35947

CVE-2022-35947 affects GLPI (Gestionnaire Libre de Parc Informatique). Affected versions have a SQL injection vulnerability that could allow an attacker to simulate an arbitrary user login. The advisory explicitly recommends upgrading to version 10.0.3 . As a workaround if upgrading isn’t possibl...

CVE-2022-31143 Leak of sensitive information through login page error in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. It was found that in affected versions there is an exposure of private information defined in setup of...

CVE-2022-31143

CVE-2022-31143 affects GLPI (Gestionnaire Libre de Parc Informatique). The issue is an exposure of private information defined in GLPI setup (e.g., SMTP/cas hosts); passwords are not exposed. Affected versions disclose configuration data, not credentials, per the description. The action recommend...

Pinecone - A WLAN Red Team Framework

Pinecone is a WLAN networks auditing tool, suitable for red team usage. It is extensible via modules, and it is designed to be run in Debian-based operating systems. Pinecone is specially oriented to be used with a Raspberry Pi, as a portable wireless auditing box. This tool is designed for...

Aura - Python Source Code Auditing And Static Analysis On A Large Scale

Source code auditing and static code analysis Aura is a static analysis framework developed as a response to the ever-increasing threat of malicious packages and vulnerable code published on PyPI. Project goals: provide an automated monitoring system over uploaded packages to PyPI, alert on...

Wrong values are passed to _checkpoint mess up accounting

Lines of code Vulnerability details Impact The increaseUnlockTime function sends a wrong unlock time to the checkpoint function in the oldLocked variable - the locked variable which is the new LockedBalance is copied into the oldLocked variable which is supposed to be the previous LockedBalance,...

Unsafe usage of ERC20 transfer and transferFrom

Lines of code Vulnerability details Impact Some ERC20 tokens functions don't return a boolean, for example USDT, BNB, OMG. So the VotingEscrow contract simply won't work with tokens like that as the token. Proof of Concept The USDT's transfer and transferFrom functions doesn't return a bool, so t...