CVE-2022-39234 user session persists even after permanently deleting account in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Deleted/deactivated user could continue to use their account as long as its cookie is valid. This iss...

CVE-2022-39277 Cross-Site Scripting (XSS) in external links in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. External links are not properly sanitized and can therefore be used for a Cross-Site Scripting XSS...

CVE-2022-39371 Stored Cross-Site Scripting (XSS) through asset inventory in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Script related HTML tags in assets inventory information are not properly neutralized. This issue has...

CVE-2022-39371 Stored Cross-Site Scripting (XSS) through asset inventory in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Script related HTML tags in assets inventory information are not properly neutralized. This issue has...

CVE-2022-39376

CVE-2022-39376 affects GLPI (Gestionnaire Libre de Parc Informatique). The issue allows injecting custom field values in mailto links. It has been patched; upgrade to GLPI v10.0.4 or later to mitigate. The connected security sources also cite GLPI-related risks in older branches (pre-10.0.13), in...

CVE-2022-39373

CVE-2022-39373 affects GLPI where an administrator can store malicious code in an entity name; the issue has been patched and users should upgrade to GLPI 10.0.4 to remediate.

CVE-2022-39376 Improper input validation on emails links in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Users may be able to inject custom fields values in mailto links. This issue has been patched, please...

CVE-2022-39370 Improper access to debug panel in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Connected users may gain access to debug panel through the GLPI update script. This issue has been...

CVE-2022-39370

CVE-2022-39370 affects GLPI. The issue allows connected users to gain access to the debug panel via the GLPI update script. It has been patched; upgrade to 10.0.4 is recommended. As a workaround, delete the install/update.php script. Public details in the initial description indicate mitigation t...

Last Years Open Source - Tomorrow's Vulnerabilities

Linus Torvalds, the creator of Linux and Git, has his own law in software development, and it goes like this: "given enough eyeballs, all bugs are shallow." This phrase puts the finger on the very principle of open source: the more, the merrier - if the code is easily available for anyone and...

The vulnerability in the console, Telnet, and SSH program-and-device tools for diagnosing and auditing computer networks in FortiTester allows a perpetrator to execute arbitrary code.

The vulnerability in the console, Telnet, and SSH programming-hardware tools for diagnosing and auditing computer networks in FortiTester relates to the possibility of executing unauthorized code or commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Unbreakable Enterprise kernel security update

5.4.17-2136.311.6 - Revert 'KVM: x86: Print error code in exception injection tracepoint iff valid' Sherry Yang Orabug: 34535896 5.4.17-2136.311.5 - netfilter: nftables: do not allow RULEID to refer to another chain Thadeu Lima de Souza Cascardo Orabug: 34495567 CVE-2022-2586 - netfilter: nftable...

CVE-2022-36112

GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Usage of RSS feeds or extenal calendar in planning is subject to SSRF exploit. Server-side requests ca...

CVE-2022-35945

GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Information associated to registration key are not properly escaped in registration key configuration...

UBUNTU-CVE-2022-35947

GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Affected versions have been found to be vulnerable to a SQL injection attack which an attacker could...

Out-of-bounds

GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Affected versions were found to not properly neutralize HTML tags in the global search context. Users...

CVE-2022-35947

CVE-2022-35947 affects GLPI (Gestionnaire Libre de Parc Informatique). Affected versions have a SQL injection vulnerability that could allow an attacker to simulate an arbitrary user login. The advisory explicitly recommends upgrading to version 10.0.3 . As a workaround if upgrading isn’t possibl...

CVE-2022-31143

CVE-2022-31143 affects GLPI (Gestionnaire Libre de Parc Informatique). The issue is an exposure of private information defined in GLPI setup (e.g., SMTP/cas hosts); passwords are not exposed. Affected versions disclose configuration data, not credentials, per the description. The action recommend...

CVE-2022-31143 Leak of sensitive information through login page error in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. It was found that in affected versions there is an exposure of private information defined in setup of...

Pinecone - A WLAN Red Team Framework

Pinecone is a WLAN networks auditing tool, suitable for red team usage. It is extensible via modules, and it is designed to be run in Debian-based operating systems. Pinecone is specially oriented to be used with a Raspberry Pi, as a portable wireless auditing box. This tool is designed for...