CVE-2022-39262

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package, GLPI administrator can define rich-text content to be displayed on login page. The displayed content is can contains malicious code that can be used to steal credentials. This issue h...

CVE-2022-39234

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Deleted/deactivated user could continue to use their account as long as its cookie is valid. This iss...

UBUNTU-CVE-2022-39234

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Deleted/deactivated user could continue to use their account as long as its cookie is valid. This iss...

Design/Logic Flaw

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Deleted/deactivated user could continue to use their account as long as its cookie is valid. This iss...

CVE-2022-39323 SQL Injection on REST API in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Time based attack using a SQL injection in api REST usertoken. This issue has been patched, please...

CVE-2022-39372 Stored Cross-Site Scripting (XSS) in user information in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Authenticated users may store malicious code in their account information. This issue has been patche...

CVE-2022-39262

GLPI (Gestionnaire Libre de Parc Informatique) has multiple documented vulnerabilities across several advisories. Reported issues include SQL injection in search-related features (map/search and saved searches), SSRF via Arbitrary Object Instantiation, XSS in dashboard-related workflows, and unau...

CVE-2022-39372

GLPI, CVE-2022-39372, affects GLPI before 10.0.13 (updates also mention 10.0.15 as a fix level). Connected sources document multiple vulnerabilities in GLPI’s components across versions prior to 10.0.13/10.0.15, including: SQL injection in search/map/search-related features, SSRF, and cross‑site ...

CVE-2022-39372 Stored Cross-Site Scripting (XSS) in user information in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Authenticated users may store malicious code in their account information. This issue has been patche...

CVE-2022-39323

GLPI (Gestionnaire Libre de Parc Informatique) is affected by multiple CVEs described for GLPI-related components. CVE-2022-39323 involves a time-based SQL injection in the api REST user_token that can lead to full confidentiality and integrity/availability impact; the initial recommendation is t...

CVE-2022-39371 Stored Cross-Site Scripting (XSS) through asset inventory in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Script related HTML tags in assets inventory information are not properly neutralized. This issue has...

CVE-2022-39276 Blind Server-Side Request Forgery (SSRF) in RSS feeds and planning

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Usage of RSS feeds or an external calendar in planning is subject to SSRF exploit. In case a remote...

CVE-2022-39323 SQL Injection on REST API in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Time based attack using a SQL injection in api REST usertoken. This issue has been patched, please...

CVE-2022-39276

GLPI (Gestionnaire Libre de Parc Informatique) contains a SSRF-type issue in the planning features (RSS feeds or external calendar). If a remote script returns a redirect, the target URL isn’t checked against the administrator’s allow-list, enabling potential redirection-based access. This CVE (C...

CVE-2022-39370

CVE-2022-39370 affects GLPI. The issue allows connected users to gain access to the debug panel via the GLPI update script. It has been patched; upgrade to 10.0.4 is recommended. As a workaround, delete the install/update.php script. Public details in the initial description indicate mitigation t...

CVE-2022-39277 Cross-Site Scripting (XSS) in external links in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. External links are not properly sanitized and can therefore be used for a Cross-Site Scripting XSS...

CVE-2022-39277

CVE-2022-39277 affects GLPI (Gestionnaire Libre de Parc Informatique) where external links are not properly sanitized, enabling a Cross-Site Scripting (XSS) attack. The issue is mitigated by upgrading to GLPI 10.0.4, as noted in the description. According to the provided documents, the CVSS detai...

CVE-2022-39276 Blind Server-Side Request Forgery (SSRF) in RSS feeds and planning

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Usage of RSS feeds or an external calendar in planning is subject to SSRF exploit. In case a remote...

CVE-2022-39372 Stored Cross-Site Scripting (XSS) in user information in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Authenticated users may store malicious code in their account information. This issue has been patche...

CVE-2022-39371 Stored Cross-Site Scripting (XSS) through asset inventory in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Script related HTML tags in assets inventory information are not properly neutralized. This issue has...