CVE-2023-41888

CVE-2023-41888 concerns GLPI (Gestionnaire Libre de Parc Informatique). Multiple connected sources describe vulnerabilities in GLPI prior to fixed versions, including pre-10.13 and pre-10.0.13 lines, with various flaws (SQL injection, SSRF, XSS, unauthorized data access) that could enable informa...

CVE-2023-41326 Account takeover via Kanban feature in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. A logged user from any profile can hijack the Kanban feature to alter any user field, and end-up with...

CVE-2023-41324

GLPI (Gestionnaire Libre de Parc Informatique) vulnerability CVE-2023-41324 is evidenced in connected records as a SQL injection flaw in GLPI’s search functionality. Affected are GLPI versions prior to 10.0.13 (per PT Security entries); authenticated users can exploit the flaw to access or extrac...

CVE-2023-41323

CVE-2023-41323 affects GLPI (Gestionnaire Libre de Parc Informatique). An unauthenticated attacker can enumerate user logins, exposing usernames. Root cause: information disclosure enabling enumeration without authentication; impact is limited to confidentiality (usernames exposed) with no other ...

CVE-2023-41322 Privilege Escalation from technician to super-admin in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. A user with write access to another user can make requests to change the latter's password and then take...

CVE-2023-41322

GLPI (Gestionnaire Libre de Parc Informatique) is affected by CVE-2023-41322. A user with write access to another user can request a password change and take control of that account, representing an authentication/authorization risk. The initial description recommends upgrading to version 10.0.10...

CVE-2023-41321

GLPI (Gestionnaire Libre de Parc Informatique) prior to version 10.0.10 contains an API issue where an API user with read access can enumerate sensitive field values on resources. The vulnerability affects confidentiality (C) but has no impact on integrity/availability according to the provided d...

CVE-2023-41321 Sensitive fields enumeration through API in GLPI

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. An API user can enumerate sensitive fields values on resources on which he has read access. Users are...

PT-2023-6847 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 10.0.10 Description: The issue is related to the use of the ITIL actors input field from the ticket form, which can be exploited to perform a SQL injection. This allows a remote attacker to potentially capture an...

CVE-2023-42461: Improper Neutralization of Special Elements used in an SQL Command

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. The ITIL actors input field from the Ticket form can be used to perform a SQL injection. Users are advised...

CVE-2023-41320: Improper Neutralization of Special Elements used in an SQL Command

GLPI stands for Gestionnaire Libre de Parc Informatique is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. UI layout preferences management can be hijacked to lead to SQL injection. This injection can be use to...

CVE-2023-37278

GLPI (Asset and IT Management software) is affected by SQL injection vulnerabilities disclosed across multiple sources. The initial CVE-2023-37278 entry states an administrator can trigger SQL injection via dashboards administration, with a patch available in version 10.0.9. Connected documents d...

CVE-2022-39376

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Users may be able to inject custom fields values in mailto links. This issue has been patched, please...

CVE-2022-39370

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Connected users may gain access to debug panel through the GLPI update script. This issue has been...

CVE-2022-39372

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Authenticated users may store malicious code in their account information. This issue has been patche...

CVE-2022-39373

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Administrator may store malicious code in entity name. This issue has been patched, please upgrade to...

CVE-2022-39277

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. External links are not properly sanitized and can therefore be used for a Cross-Site Scripting XSS...

Design/Logic Flaw

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Users may be able to create a public RSS feed to inject malicious code in dashboards of other users...

Design/Logic Flaw

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Users may be able to inject custom fields values in mailto links. This issue has been patched, please...

Design/Logic Flaw

GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, licenses tracking and software auditing. Connected users may gain access to debug panel through the GLPI update script. This issue has been...