UBUNTU-CVE-2017-11475

GLPI before 9.1.5.1 has SQL Injection in the condition rule field, exploitable via front/rulesengine.test.php...

UBUNTU-CVE-2017-11474

GLPI before 9.1.5.1 has SQL Injection in the $crit variable in inc/computersoftwareversion.class.php, exploitable via ajax/common.tabs.php...

CVE-2017-11475

GLPI before 9.1.5.1 has SQL Injection in the condition rule field, exploitable via front/rulesengine.test.php...

CVE-2017-11474

GLPI before 9.1.5.1 has SQL Injection in the $crit variable in inc/computersoftwareversion.class.php, exploitable via ajax/common.tabs.php...

CVE-2017-11474

GLPI before 9.1.5.1 has SQL Injection in the $crit variable in inc/computersoftwareversion.class.php, exploitable via ajax/common.tabs.php...

CVE-2017-11475

GLPI before 9.1.5.1 has SQL Injection in the condition rule field, exploitable via front/rulesengine.test.php...

CVE-2017-11474

GLPI before 9.1.5.1 has an SQL injection in the $crit variable in inc/computer_softwareversion.class.php, exploitable via ajax/common.tabs.php. The CVE-2017-11474 entry is supported by several connected advisories and translations indicating affected versions and vendor responses. Public referenc...

CVE-2017-11475

GLPI before 9.1.5.1 contains a SQL Injection in the condition rule field, exploitable via front/rulesengine.test.php. The issue is confirmed in CVE-2017-11475 (CVSS up to 8.8 for 3.0) with network attack and high impact on confidentiality, integrity, and availability. Remediation shown in connect...

CVE-2017-11475: Improper Neutralization of Special Elements used in an SQL Command

GLPI before 9.1.5.1 has SQL Injection in the condition rule field, exploitable via front/rulesengine.test.php...

PT-2017-12041

Name of the Vulnerable Software and Affected Versions GLPI versions prior to 9.1.5.1 Description The issue concerns SQL Injection in the condition rule field of GLPI, which can be exploited via the "front/rulesengine.test.php" API endpoint. Recommendations For versions prior to 9.1.5.1, update to...

PT-2017-12040

Name of the Vulnerable Software and Affected Versions GLPI versions prior to 9.1.5.1 Description The issue concerns SQL Injection in the crit variable within the inc/computer softwareversion.class.php file, which can be exploited through the ajax/common.tabs.php endpoint. Recommendations For...

CVE-2017-11474: Improper Neutralization of Special Elements used in an SQL Command

GLPI before 9.1.5.1 has SQL Injection in the $crit variable in inc/computersoftwareversion.class.php, exploitable via ajax/common.tabs.php...

Cross site scripting

Cross-site scripting XSS vulnerability in GLPI 0.90.4 allows remote authenticated attackers to inject arbitrary web script or HTML by attaching a crafted HTML file to a ticket...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in GLPI 0.90.4 allows remote authenticated attackers to submit a request that could lead to the creation of an admin account in the application...

CVE-2016-7509

Cross-site scripting XSS vulnerability in GLPI 0.90.4 allows remote authenticated attackers to inject arbitrary web script or HTML by attaching a crafted HTML file to a ticket...

CVE-2016-7507

Cross-Site Request Forgery CSRF vulnerability in GLPI 0.90.4 allows remote authenticated attackers to submit a request that could lead to the creation of an admin account in the application...

CVE-2016-7509

Cross-site scripting XSS vulnerability in GLPI 0.90.4 allows remote authenticated attackers to inject arbitrary web script or HTML by attaching a crafted HTML file to a ticket...

CVE-2016-7507

Cross-Site Request Forgery CSRF vulnerability in GLPI 0.90.4 allows remote authenticated attackers to submit a request that could lead to the creation of an admin account in the application...

CVE-2016-7507

Cross-Site Request Forgery CSRF vulnerability in GLPI 0.90.4 allows remote authenticated attackers to submit a request that could lead to the creation of an admin account in the application...

CVE-2016-7509

Cross-site scripting XSS vulnerability in GLPI 0.90.4 allows remote authenticated attackers to inject arbitrary web script or HTML by attaching a crafted HTML file to a ticket...