Authorization

GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6 are vulnerable to Incorrect Authorization. This vulnerability allow unauthorized access to inventory files. Thus, if anonymous access to FAQ is allowed, inventory files are accessbile by...

Cross site scripting

GLPI is a Free Asset and IT Management Software package. Versions prior to 10.0.6 are subject to Cross-site Scripting via malicious RSS feeds. An Administrator can import a malicious RSS feed that contains Cross Site Scripting XSS payloads inside RSS links. Victims who wish to visit an RSS conten...

Cross site scripting

GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6, are subject to Cross-site Scripting. An administrator may store malicious code in help links. This issue is patched in 10.0.6...

November 8, 2022—KB5019980 (OS Build 22621.819)

None None...

CVE-2023-23610

GLPI is a Free Asset and IT Management Software package. Versions prior to 9.5.12 and 10.0.6 are vulnerable to Improper Privilege Management. Any user having access to the standard interface can export data of almost any GLPI item type, even those on which user is not allowed to access including...

CVE-2022-41941

CVE-2022-41941 affects GLPI: versions 10.0.0 through 10.0.5 are vulnerable to a stored Cross-site Scripting (XSS) flaw in help links, enabling an administrator to store malicious code. Root cause: improper handling of help links allowing stored scripts. Impact: potential theft or manipulation of ...

CVE-2022-41941 glpi contains XSS Stored inside Standard Interface Help Link href attribute

GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6, are subject to Cross-site Scripting. An administrator may store malicious code in help links. This issue is patched in 10.0.6...

CVE-2023-22500 glpi Unauthorized access to inventory files

GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6 are vulnerable to Incorrect Authorization. This vulnerability allow unauthorized access to inventory files. Thus, if anonymous access to FAQ is allowed, inventory files are accessbile by...

CVE-2023-22500

GLPI CVE-2023-22500 affects GLPI 10.0.0 through 10.0.5, where an Incorrect Authorization flaw allows unauthorized access to inventory files if anonymous FAQ access is enabled. Impact is exposure of inventory data (confidentiality) without privilege escalation details beyond that. The issue is fix...

CVE-2023-22722

CVE-2023-22722 concerns GLPI (Free Asset and IT Management). Affected: GLPI versions 9.4.0 and above, prior to 10.0.6; vulnerability is Cross-site Scripting achievable when a user opens a crafted URL. Successful exploit enables actions as the victim or exfiltration of session cookies. The issue i...

CVE-2023-22725

CVE-2023-22725 affects GLPI (Free Asset and IT Management Software). Vulnerability: Cross-site Scripting in versions 0.6.0 and above, prior to 10.0.6, allowing an administrator to create a malicious external link. Root cause details are not fully elaborated beyond this description. Impact: user-f...

CVE-2023-23610

CVE-2023-23610 affects GLPI; prior to 10.0.6 (and older) versions, users with access to the standard interface could export data from most GLPI item types regardless of permissions. The entry states the issue is patched in 10.0.6. Other connected advisories describe separate issues (SQLi, XSS, SS...

SaaS Security Posture Management (SSPM) as a Layer in Your Identity Fabric

The move to SaaS and other cloud tools has put an emphasis on Identity & Access Management IAM. After all, user identity is one of the only barriers standing between sensitive corporate data and any unauthorized access. The tools used to define IAM make up its identity fabric. The stronger the...

it-smeta.com Cross Site Scripting vulnerability OBB-3160732

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

it-creed.com Cross Site Scripting vulnerability OBB-3160722

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

SLIMS 9.5.2 Cross Site Scripting Vulnerability

Title: SLIMS-9.5.2 - XSS Reflected - Account Exploit Development: nu11secur1ty Vendor: https://slims.web.id/web/ Software: https://github.com/slims/slims9bulian/releases/tag/v9.5.2 Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/slims.web.id/SLIMS-9.5.2 Description:...

Oracle VM VirtualBox 安全漏洞

A security vulnerability exists in Oracle VM VirtualBox, a virtual machine management software from Oracle Corporation. A low privilege attacker can log into the server where Oracle VM VirtualBox resides to compromise Oracle VM VirtualBox...

forex-it.com Cross Site Scripting vulnerability OBB-3157066

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

University suffers leaks, shutdowns at the hands of Vice Society

The Vice Society ransomware gang is back and making some unfortunate waves in the education sector. According to Bleeping Computer, the Society has held their ransomware laden hands up and admitted an attack on the University of Duisberg-Essen. Sadly this isnt the Universitys first encounter with...

Wallarm adds Cybersecurity Leaders to its Board of Advisors

New Advisory Board Members Bring Extensive Experience to Assist Organizations Needing to Enhance and Accelerate their API Security Posture January 12, 2023 02:30 PM Eastern Standard Time SAN FRANCISCO -BUSINESS WIRE- Wallarm, the end-to-end API security company, is pleased to introduce the newest...