Authenticated Reflected XSS on ajax/common.tabs.php

Description There is a reflected XSS vulnerability on ajax/common.tabs.php due to the KnowBase tab not escaping the start parameter properly probably because it's not reflected inside quotes. There was some work into getting the exploit working, due to JQuery's $ not being defined and causing a...

CVE-2021-21313

GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is a vulnerability in the /ajax/common.tabs.php endpoint, indeed, at least two parameters target and id are not...

CVE-2021-21313

GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is a vulnerability in the /ajax/common.tabs.php endpoint, indeed, at least two parameters target and id are not...

CVE-2021-21313: Improper Neutralization of Special Elements in Output Used by a Downstream Component

GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4, there is a vulnerability in the /ajax/common.tabs.php endpoint, indeed, at least two parameters target and id are not...

Design/Logic Flaw

GLPI 0.83.7 has Local File Inclusion in common.tabs.php...

UBUNTU-CVE-2013-2227

GLPI 0.83.7 has Local File Inclusion in common.tabs.php...

CVE-2013-2227

GLPI 0.83.7 has Local File Inclusion in common.tabs.php...

CVE-2013-2227

GLPI 0.83.7 is affected by CVE-2013-2227: Local File Inclusion in common.tabs.php. Public records across multiple sources confirm the issue and track it under CVE-2013-2227, with mitigations implemented in later package updates (e.g., ALT Linux 0.83.9.1-alt1; Fedora 2013-11396 advisory; upstream ...

CVE-2013-2227

GLPI 0.83.7 has Local File Inclusion in common.tabs.php...

CVE-2013-2227: Improper Input Validation

GLPI 0.83.7 has Local File Inclusion in common.tabs.php...

PT-2019-6884

Name of the Vulnerable Software and Affected Versions GLPI version 0.83.7 Description The issue is related to Local File Inclusion in the common.tabs.php file. Recommendations For GLPI version 0.83.7, update to a newer version that contains a fix for this issue...

CVE-2017-11474

GLPI before 9.1.5.1 has SQL Injection in the $crit variable in inc/computersoftwareversion.class.php, exploitable via ajax/common.tabs.php...

PT-2017-12040

Name of the Vulnerable Software and Affected Versions GLPI versions prior to 9.1.5.1 Description The issue concerns SQL Injection in the crit variable within the inc/computer softwareversion.class.php file, which can be exploited through the ajax/common.tabs.php endpoint. Recommendations For...

CVE-2017-11474: Improper Neutralization of Special Elements used in an SQL Command

GLPI before 9.1.5.1 has SQL Injection in the $crit variable in inc/computersoftwareversion.class.php, exploitable via ajax/common.tabs.php...

CVE-2014-8360

Directory traversal vulnerability in inc/autoload.function.php in GLPI before 0.84.8 allows remote attackers to include and execute arbitrary local files via a .. dot dot underscore in an item type to the getItemForItemtype, as demonstrated by the itemtype parameter in ajax/common.tabs.php...

CVE-2014-8360

Directory traversal vulnerability in inc/autoload.function.php in GLPI before 0.84.8 allows remote attackers to include and execute arbitrary local files via a .. dot dot underscore in an item type to the getItemForItemtype, as demonstrated by the itemtype parameter in ajax/common.tabs.php...

CVE-2014-8360: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in inc/autoload.function.php in GLPI before 0.84.8 allows remote attackers to include and execute arbitrary local files via a .. dot dot underscore in an item type to the getItemForItemtype, as demonstrated by the itemtype parameter in ajax/common.tabs.php...

PT-2015-4032

Name of the Vulnerable Software and Affected Versions GLPI versions prior to 0.84.8 Description The issue allows remote attackers to include and execute arbitrary local files via a .. dot dot underscore in an item type to the getItemForItemtype. This can be demonstrated by the itemtype parameter ...

GLPI 0.83.7 Parameter Traversal Arbitrary File Access Vulnerability

GLPI version 0.83.7 suffers from a parameter traversal vulnerability that allows for arbitrary file access. GLPI v0.83.7 itemtype Parameter Traversal Arbitrary File Access Exploit Vendor: INDEPNET Development Team Product web page: http://www.glpi-project.org Affected version: 0.83.7 Summary: GLP...

GLPI 0.83.7 Parameter Traversal Arbitrary File Access

GLPI v0.83.7 itemtype Parameter Traversal Arbitrary File Access Exploit Vendor: INDEPNET Development Team Product web page: http://www.glpi-project.org Affected version: 0.83.7 Summary: GLPI, an initialism for Gestionnaire libre de parc informatique Free Management of Computer Equipment, was...