3411 matches found
CVE-2016-7509
Cross-site scripting XSS vulnerability in GLPI 0.90.4 allows remote authenticated attackers to inject arbitrary web script or HTML by attaching a crafted HTML file to a ticket...
CVE-2016-7507
Cross-Site Request Forgery CSRF vulnerability in GLPI 0.90.4 allows remote authenticated attackers to submit a request that could lead to the creation of an admin account in the application...
CVE-2016-7509
Cross-site scripting XSS vulnerability in GLPI 0.90.4 allows remote authenticated attackers to inject arbitrary web script or HTML by attaching a crafted HTML file to a ticket...
CVE-2016-7509
GLPI 0.90.4 is affected by CVE-2016-7509, a cross-site scripting (XSS) vulnerability. The issue arises when an attacker with authentication attaches a specially crafted HTML file to a ticket, enabling injection of arbitrary script/HTML in the web context. No exploitation details are provided in t...
CVE-2016-7507
Cross-Site Request Forgery CSRF vulnerability in GLPI 0.90.4 allows remote authenticated attackers to submit a request that could lead to the creation of an admin account in the application...
CVE-2016-7507
CVE-2016-7507 describes a CSRF vulnerability in GLPI 0.90.4 where a remote authenticated attacker can submit a request to create an administrator account. The incident is documented across several sources (NVD entry and related CNVD/PRION/UBUNTU records) confirming the same flaw in GLPI 0.90.4. A...
CVE-2016-7509
Cross-site scripting XSS vulnerability in GLPI 0.90.4 allows remote authenticated attackers to inject arbitrary web script or HTML by attaching a crafted HTML file to a ticket...
PT-2017-9215
Name of the Vulnerable Software and Affected Versions GLPI version 0.90.4 Description A cross-site scripting XSS issue allows remote authenticated attackers to inject arbitrary web script or HTML by attaching a crafted HTML file to a ticket. This enables attackers to execute malicious scripts on...
CVE-2016-7509: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in GLPI 0.90.4 allows remote authenticated attackers to inject arbitrary web script or HTML by attaching a crafted HTML file to a ticket...
PT-2017-9213
Name of the Vulnerable Software and Affected Versions GLPI version 0.90.4 Description A Cross-Site Request Forgery CSRF issue allows remote authenticated attackers to submit a request that could lead to the creation of an admin account in the application. Recommendations For GLPI version 0.90.4,...
CVE-2016-7507: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in GLPI 0.90.4 allows remote authenticated attackers to submit a request that could lead to the creation of an admin account in the application...
CVE-2017-11329
GLPI before 9.1.5 allows SQL injection via an ajax/getDropdownValue.php request with an entityrestrict parameter that is not a list of integers...
CVE-2017-11329
GLPI before 9.1.5 allows SQL injection via an ajax/getDropdownValue.php request with an entityrestrict parameter that is not a list of integers...
UBUNTU-CVE-2017-11329
GLPI before 9.1.5 allows SQL injection via an ajax/getDropdownValue.php request with an entityrestrict parameter that is not a list of integers...
CVE-2017-11329
GLPI before 9.1.5 allows SQL injection via an ajax/getDropdownValue.php request with an entityrestrict parameter that is not a list of integers...
Sql injection
GLPI before 9.1.5 allows SQL injection via an ajax/getDropdownValue.php request with an entityrestrict parameter that is not a list of integers...
CVE-2017-11329: Improper Neutralization of Special Elements used in an SQL Command
GLPI before 9.1.5 allows SQL injection via an ajax/getDropdownValue.php request with an entityrestrict parameter that is not a list of integers...
CVE-2017-11329
GLPI before 9.1.5 allows SQL injection via an ajax/getDropdownValue.php request with an entityrestrict parameter that is not a list of integers...
CVE-2017-11329
GLPI before 9.1.5 is vulnerable to SQL injection via an ajax/getDropdownValue.php request where entity_restrict is not a list of integers. The issue is documented across multiple feeds; remediation is to upgrade to GLPI 9.1.5 or newer (e.g., 9.1.6 per Mageia update), which fixes the vulnerability...