7249 matches found
CVE-2024-27096
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in the search engine to extract data from the database. This issue has been patched in versi...
UBUNTU-CVE-2024-27914
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An unauthenticated user can provide a malicious link to a GLPI administrator in order to exploit a reflected XSS vulnerability. The XSS will only trigger if...
CVE-2024-27914
CVE-2024-27914 affects GLPI (Asset and IT Management Software). The vulnerability is a reflected XSS that can be triggered when an unauthenticated user entices a GLPI administrator with a malicious link and the administrator navigates through the debug bar. The issue is explicitly described as en...
CVE-2024-27937
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can obtain the email address of all GLPI users. This issue has been patched in version 10.0.13...
CVE-2024-27930
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can access sensitive fields data from items on which he has read access. This issue has been patched in version 10.0.13...
CVE-2024-27098 Blind Server-Side Request Forgery (SSRF) using Arbitrary Object Instantiation in GLPI
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can execute a SSRF based attack using Arbitrary Object Instantiation. This issue has been patched in version 10.0.13...
CVE-2024-27098
CVE-2024-27098 concerns GLPI, a Free Asset and IT Management Software. An authenticated user can perform a server-side request forgery (SSRF) via Arbitrary Object Instantiation. The issue affects GLPI prior to the patched version and is mitigated by upgrading to version 10.0.13 or newer. The conn...
CVE-2024-27096 SQL Injection in through the search engine
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in the search engine to extract data from the database. This issue has been patched in versi...
CVE-2024-27937
GLPI (Asset/IT Management software) is affected by CVE-2024-27937 where an authenticated user can obtain the email addresses of all GLPI users. Root cause details across connected docs include: a patch exists in GLPI 10.0.13 (NVD/Red Hat/OSV notes), while another advisory notes that versions prio...
WordPress Tracking Code Manager Plugin <= 2.0.16 is vulnerable to Cross Site Scripting (XSS)
Software Tracking Code Manager Type Plugin Vulnerable versions = 2.0.16 Fixed in 2.1.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-2579 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 5ffb225ee347 Credits Joshua Chan Required privilege...
CVE-2021-47127
In the Linux kernel, the following vulnerability has been resolved: ice: track AFXDP ZC enabled queues in bitmap Commit c7a219048e45 "ice: Remove xskbuffpool from VSI structure" silently introduced a regression and broke the Tx side of AFXDP in copy mode. xskpool on icering is set only based on t...
Scholars Tracking System SQL Injection Vulnerability (CNVD-2024-14047)
Scholars Tracking System is a scholars tracking system by the individual developer Fabian Ros. A SQL injection vulnerability exists in Scholars Tracking System version 1.0, which stems from a lack of validation of externally entered SQL statements when updating employment status information, and...
Scholars Tracking System SQL Injection Vulnerability (CNVD-2024-14045)
Scholars Tracking System is a scholars tracking system by the individual developer Fabian Ros. Scholars Tracking System suffers from a SQL injection vulnerability that can be exploited by an attacker to send crafted SQL statements to Eligibility Information Update...
Scholars Tracking System SQL Injection Vulnerability (CNVD-2024-14043)
Scholars Tracking System is a scholars tracking system by the individual developer Fabian Ros. Scholars Tracking System version 1.0 suffers from a SQL injection vulnerability that stems from the application's lack of validation of externally entered SQL statements, which can be exploited by an...
Scholars Tracking System SQL Injection Vulnerability (CNVD-2024-14044)
Scholars Tracking System is a scholars tracking system by the individual developer Fabian Ros. Scholars Tracking System suffers from a SQL injection vulnerability that can be exploited by an attacker to send specially crafted SQL statements to Personal Information Update messages...
Scholars Tracking System Cross-Site Scripting Vulnerability
Scholars Tracking System is a scholars tracking system by the individual developer Fabian Ros. Scholars Tracking System version 1.0 suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied data, which can be...
CVE-2024-28195 Cross-Site Request Forgery (CSRF) vulnerability in API and login in your_spotify
yourspotify is an open source, self hosted Spotify tracking dashboard. YourSpotify versions 1.9.0 do not protect the API and login flow against Cross-Site Request Forgery CSRF. Attackers can use this to execute CSRF attacks on victims, allowing them to retrieve, modify or delete data on the...
CVE-2024-28196 Clickjacking in your_spotify
yourspotify is an open source, self hosted Spotify tracking dashboard. YourSpotify version 1.9.0 does not prevent other pages from displaying it in an iframe and is thus vulnerable to clickjacking. Clickjacking can be used to trick an existing user of YourSpotify to trigger actions, such as...
