CVE-2022-24868

GLPI prior to version 10.0.0 is vulnerable to a cross-site scripting (XSS) via SVG avatar uploads due to insufficient sanitization. An attacker can inject JavaScript into user avatars, and any user viewing the affected avatar could be exposed to the XSS payload. Remediation per the provided sourc...

CVE-2022-24867 LDAP password exposure in glpi

GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. When you pass the config to the javascript, some entries are filtered out. The variable ldappass is not filtered and when you look at the source code of the...

CVE-2022-24867 LDAP password exposure in glpi

GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. When you pass the config to the javascript, some entries are filtered out. The variable ldappass is not filtered and when you look at the source code of the...

CVE-2022-24867

GLPI (Asset & IT Management Software) has a CVE-2022-24867 issue where, when passing config to the JavaScript, the ldap_pass variable is not filtered and the root DN password is exposed in the rendered page source. This is a data exposure flaw in the authentication/config handling path. The advis...

Jira Service Desk Sign Up Detected

Atlassian Jira is a software application used for issue tracking and project management. An internal only Atlassian Jira Service Desk instance may be misconfigured to be accessible to 3rd parties to sign up, potentially leading to attackers creating accounts and raising ticket requests for...

Security Bulletin: IBM Maximo Asset Management is vulnerable to cross-site request forgery (CVE-2020-4526)

Summary IBM Maximo Asset Management is vulnerable to cross-site request forgery. Vulnerability Details CVEID: CVE-2020-4526 DESCRIPTION: IBM Maximo Asset Management is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted...

Security Bulletin: IBM Maximo Asset Management is vulnerable to Security/Authentication Bypass (CVE-2019-4591)

Summary IBM Maximo Asset Management is vulnerable to Security/Authentication Bypass. Vulnerability Details CVEID: CVE-2019-4591 DESCRIPTION: IBM Maximo Asset Management does not invalidate session after logout which could allow a local user to impersonate another user on the system. CVSS Base...

Security Bulletin: IBM Maximo Asset Management is vulnerable to Java Deserialization (CVE-2020-4521)

Summary IBM Maximo Asset Management is vulnerable to Java Deserialization. Vulnerability Details CVEID:CVE-2020-4521 DESCRIPTION: IBM Maximo Asset Management could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization in Java. By sendin...

Security Bulletin: IBM Maximo Asset Management is vulnerable to reverse tabnabbing (CVE-2020-4409)

Summary IBM Maximo Asset Management is vulnerable to reverse tabnabbing. Vulnerability Details CVEID: CVE-2020-4409 DESCRIPTION: IBM Maximo Asset Management could allow a remote attacker to conduct phishing attacks, using a tabnabbing attack. By persuading a victim to visit a specially-crafted We...

CVE-2022-25245

Zoho ManageEngine ServiceDesk Plus before 13001 allows anyone to know the organisation's default currency name...

ZOHO ManageEngine ServiceDesk Plus 访问控制错误漏洞

ZOHO ManageEngine ServiceDesk Plus SDP is a set of ITIL-based IT service management software from ZOHO, USA. The software integrates incident management, issue management, asset management IT project management, procurement and contract management, and other functional modules.ZOHO ManageEngine...

CVE-2022-0373

Improper access control in GitLab CE/EE versions 12.4 to 14.5.4, 14.5 to 14.6.4, and 12.6 to 14.7.1 allows project non-members to retrieve the service desk email address...

CVE-2022-0373

Improper access control in GitLab CE/EE versions 12.4 to 14.5.4, 14.5 to 14.6.4, and 12.6 to 14.7.1 allows project non-members to retrieve the service desk email address...

UBUNTU-CVE-2022-0373

Improper access control in GitLab CE/EE versions 12.4 to 14.5.4, 14.5 to 14.6.4, and 12.6 to 14.7.1 allows project non-members to retrieve the service desk email address...

CVE-2022-0373

Improper access control in GitLab CE/EE versions 12.4 to 14.5.4, 14.5 to 14.6.4, and 12.6 to 14.7.1 allows project non-members to retrieve the service desk email address...

CVE-2022-0373

Removed by vendor...

PT-2022-13134 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 12.4 through 14.7.1 Description: The issue is related to improper access control, allowing project non-members to retrieve the service desk email address. Recommendations: For GitLab CE/EE versions 12.4 through 14.7.1,...

SolarWinds Web Help Desk Installed (Windows)

Binary data solarwindswebhelpdeskinstalled.nbin...

PT-2022-10456 · Solarwinds · Web Help Desk

Name of the Vulnerable Software and Affected Versions: WebHelpDesk affected versions not specified Description: The issue is related to an input that was not sanitized in WebHelpDesk. SolarWinds has removed this input field to prevent its misuse. Recommendations: At the moment, there is no...

Solarwinds Web Help Desk 安全漏洞

SolarWinds Web Help Desk is a suite of help desk and asset management software from SolarWinds USA. The software supports features such as centralized knowledge base, IT asset management, project and task management. A security vulnerability exists in SolarWinds Web Help Desk 12.7.8 and prior...