CVE-2021-4406

An authenticated attacker is able to create alerts that trigger a stored XSS attack. POC go to the alert manager open the ITSM tab add a webhook with the URL/service token value ' -h && id | tee /tmp/ttttttddddssss ' whitespaces are tab characters click add click apply create a test alert The tes...

kleeberg-it.de Cross Site Scripting vulnerability OBB-3497241

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

The growth of commercial spyware based intelligence providers without legal or ethical supervision

Attackers have long used commercial products developed by legitimate companies to compromise targeted devices. These products are known as commercial spyware. Commercial spyware operations mainly target mobile platforms with zero- or one-click zero-day exploits to deliver spyware. This threat...

CVE-2023-35940

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a file allows an unauthenticated user to be able to access dashboards data. Version 10.0.8 contains a patch for this issue...

Design/Logic Flaw

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a file allows an unauthenticated user to be able to access dashboards data. Version 10.0.8 contains a patch for this issue...

CVE-2023-35940

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a file allows an unauthenticated user to be able to access dashboards data. Version 10.0.8 contains a patch for this issue...

Design/Logic Flaw

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a on a file accessible by an authenticated user or not for certain actions, allows a threat actor to interact, modify, or see Dashboard data. Version 10.0.8...

CVE-2023-36808

GLPI (asset and IT management software) has a SQL injection vulnerability affecting versions prior to 10.0.8, involving the Computer Virtual Machine form and GLPI inventory request. The issue is addressed by a patch in version 10.0.8; as a workaround, disable native inventory. Other security sour...

CVE-2023-35940

GLPI vulnerability CVE-2023-35940 concerns an incorrect rights check on a file that, in versions prior to 10.0.8 (and starting from 9.5.0), could allow an unauthenticated user to access dashboards data. The issue is mitigated by the 10.0.8 patch. Several connected sources confirm GLPI versions be...

CVE-2023-35939

GLPI CVE-2023-35939 concerns an incorrect rights check in GLPI prior to version 10.0.8, affecting 9.5.0 and all versions before 10.0.8. A threat actor with authentication (or in some cases without) could interact with, modify, or view Dashboard data due to this rights check flaw. The patch is ava...

CVE-2023-35939 GLPI vulnerable to unauthorized access to Dashboard data

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a on a file accessible by an authenticated user or not for certain actions, allows a threat actor to interact, modify, or see Dashboard data. Version 10.0.8...

CVE-2023-34107

GLPI is a free asset and IT management software package. Versions of the software starting with 9.2.0 and prior to 10.0.8 have an incorrect rights check on a on a file accessible by an authenticated user, allows access to the view all KnowbaseItems. Version 10.0.8 has a patch for this issue...

CVE-2023-35924

GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.8, GLPI inventory endpoint can be used to drive a SQL injection attack. By default, GLPI inventory endpoint requires no authentication. Version 10.0.8 has a patch for this issue. As a...

CVE-2023-35924

GLPI CVE-2023-35924 covers a SQL injection in the inventory endpoint of GLPI versions 10.0.0 through prior to 10.0.8, with the endpoint requiring no authentication by default. The issue can be exploited over the network and is mitigated by upgrading to version 10.0.8, which includes a patch; as a...

CVE-2023-34244

CVE-2023-34244 (GLPI) affects GLPI, a free asset/IT management software. The initial description documents an unauthenticated user crafting a link that triggers a reflected XSS when an authenticated user opens it, with a patch released in version 10.0.8. Connected sources detail additional GLPI i...

CVE-2023-34107

GLPI CVE-2023-34107 affects GLPI versions 9.2.0 up to, but not including, 10.0.8, where an incorrect rights check on a file accessible by an authenticated user allows viewing all KnowbaseItems. The issue is rooted in insufficient access control for a file/resource; the vendor issued a patch in ve...

CVE-2023-34106

CVE-2023-34106 affects GLPI: versions starting from 0.68 up to 10.0.7/10.0.8 expose a rights check flaw on a file accessible to authenticated users, allowing access to the list of all users and their personal information. The advisory explicitly recommends upgrading to 10.0.8 for the patch. Conne...

CVE-2023-34106 GLPI vulnerable to unauthorized access to User data

GLPI is a free asset and IT management software package. Versions of the software starting with 0.68 and prior to 10.0.8 have an incorrect rights check on a on a file accessible by an authenticated user. This allows access to the list of all users and their personal information. Users should...

Multicloud Strategies Must Evolve to Meet the Needs of Global IT Leaders

In a Forrester study commissioned by Akamai, global IT leaders explain why they are adopting cloud-native architecture and distributing apps and workloads...

GLPI vulnerable to unauthorized access to KnowbaseItem data

[email protected] reports: GLPI is a free asset and IT management software package. Versions of the software starting with 9.2.0 and prior to 10.0.8 have an incorrect rights check on a on a file accessible by an authenticated user, allows access to the view all KnowbaseItems. Version...