81 matches found
CVE-2019-12723
The CVE-2019-12723 entry concerns the Teclib Fields plugin for GLPI (affected version up to 1.9.2). The issue is a SQL Injection via container_id and old_order parameters to ajax/reorder.php that can be exploited by an unauthenticated user. Impact is described in the sources as high/critical (CVS...
CVE-2019-12723
An issue was discovered in the Teclib Fields plugin through 1.9.2 for GLPI. it allows SQL Injection via containerid and oldorder parameters to ajax/reorder.php by an unauthenticated user...
CVE-2019-12723
An issue was discovered in the Teclib Fields plugin through 1.9.2 for GLPI. it allows SQL Injection via containerid and oldorder parameters to ajax/reorder.php by an unauthenticated user...
PT-2019-12900
Name of the Vulnerable Software and Affected Versions Teclib News plugin for GLPI versions through 1.5.2 Description The issue allows a stored XSS attack via the name parameter in the $ POST request. Recommendations For versions through 1.5.2, as a temporary workaround, consider validating and...
CVE-2019-12723: Improper Neutralization of Special Elements used in an SQL Command
An issue was discovered in the Teclib Fields plugin through 1.9.2 for GLPI. it allows SQL Injection via containerid and oldorder parameters to ajax/reorder.php by an unauthenticated user...
PT-2019-12899
Name of the Vulnerable Software and Affected Versions GLPI Teclib Fields plugin versions through 1.9.2 Description The issue allows SQL Injection via the container id and old order parameters to the "ajax/reorder.php" endpoint by an unauthenticated user. Recommendations For versions through 1.9.2...
CVE-2019-12724: Improper Neutralization of Input During Web Page Generation
An issue was discovered in the Teclib News plugin through 1.5.2 for GLPI. It allows a stored XSS attack via the $POST'name' parameter...
GLPI Cross-Site Scripting Vulnerability (CNVD-2019-21438)
Teclib GLPI is an open source IT asset management suite from the French company Teclib. The suite includes features such as device status management, asset inventory storage, management processes and work log management. A cross-site scripting vulnerability exists in the inc/user.class.php file i...
Teclib GLPI SQL Injection Vulnerability
Teclib GLPI is an IT asset management solution. A SQL injection vulnerability exists in Teclib GLPI version 9.3.3 and earlier. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands with the 'cycle' parameter of the /scripts/unlocktasks.php file...
Teclib GLPI Competitive Conditions Issue Vulnerability
Teclib GLPI is an open source IT asset management suite from the French company Teclib. The suite includes features such as device status management, asset inventory storage, management processes and work log management. A competitive conditions issue vulnerability exists in Teclib GLPI versions...
CVE-2019-10231
Teclib GLPI before 9.4.1.1 is affected by a PHP type juggling vulnerability allowing bypass of authentication. This occurs in Auth::checkPassword inc/auth.class.php...
CVE-2019-10233
Teclib GLPI before 9.4.1.1 is affected by a timing attack associated with a cookie...
CVE-2019-10232
Teclib GLPI through 9.3.3 has SQL injection via the "cycle" parameter in /scripts/unlocktasks.php...
CVE-2019-10231
Teclib GLPI before 9.4.1.1 is affected by a PHP type juggling vulnerability allowing bypass of authentication. This occurs in Auth::checkPassword inc/auth.class.php...
CVE-2019-10232
Teclib GLPI through 9.3.3 has SQL injection via the "cycle" parameter in /scripts/unlocktasks.php...
CVE-2019-10233
Teclib GLPI before 9.4.1.1 is affected by a timing attack associated with a cookie...
Authentication flaw
Teclib GLPI before 9.4.1.1 is affected by a PHP type juggling vulnerability allowing bypass of authentication. This occurs in Auth::checkPassword inc/auth.class.php...
Sql injection
Teclib GLPI through 9.3.3 has SQL injection via the "cycle" parameter in /scripts/unlocktasks.php...
