Product:

Glpi

(Glpi\-Project)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 127
Date Id Summary Products Score Patch Annotated
2019-03-27 CVE-2019-10233 Teclib GLPI before 9.4.1.1 is affected by a timing attack associated with a cookie. Glpi N/A
2019-07-12 CVE-2019-1010310 GLPI GLPI Product 9.3.1 is affected by: Frame and Form tags Injection allowing admins to phish users by putting code in reminder description. The impact is: Admins can phish any user or group of users for credentials / credit cards. The component is: Tools > Reminder > Description .. Set the description to any iframe/form tags and apply. The attack vector is: The attacker puts a login form, the user fills it and clicks on submit .. the request is sent to the attacker domain saving the data.... Glpi 3.5
2019-07-15 CVE-2019-1010307 GLPI GLPI Product 9.3.1 is affected by: Cross Site Scripting (XSS). The impact is: All dropdown values are vulnerable to XSS leading to privilege escalation and executing js on admin. The component is: /glpi/ajax/getDropDownValue.php. The attack vector is: 1- User Create a ticket , 2- Admin opens another ticket and click on the "Link Tickets" feature, 3- a request to the endpoint fetches js and executes it. Glpi 5.4
2019-07-10 CVE-2019-13240 An issue was discovered in GLPI before 9.4.1. After a successful password reset by a user, it is possible to change that user's password again during the next 24 hours without any information except the associated email address. Glpi 5.9
2019-07-04 CVE-2019-13239 inc/user.class.php in GLPI before 9.4.3 allows XSS via a user picture. Glpi 6.1
2018-03-12 CVE-2018-7563 An issue was discovered in GLPI through 9.2.1. The application is affected by XSS in the query string to front/preference.php. An attacker is able to create a malicious URL that, if opened by an authenticated user with debug privilege, will execute JavaScript code supplied by the attacker. The attacker-supplied code can perform a wide variety of actions, such as stealing the victim's session token or login credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes. Glpi 6.1
2018-03-12 CVE-2018-7562 A remote code execution issue was discovered in GLPI through 9.2.1. There is a race condition that allows temporary access to an uploaded executable file that will be disallowed. The application allows an authenticated user to upload a file when he/she creates a new ticket via front/fileupload.php. This feature is protected using different types of security features like the check on the file's extension. However, the application uploads and creates a file, though this file is not allowed,... Glpi 7.5
2018-07-02 CVE-2018-13049 The constructSQL function in inc/search.class.php in GLPI 9.2.x through 9.3.0 allows SQL Injection, as demonstrated by triggering a crafted LIMIT clause to front/computer.php. Glpi 8.8
2017-07-20 CVE-2017-11475 GLPI before 9.1.5.1 has SQL Injection in the condition rule field, exploitable via front/rulesengine.test.php. Glpi 8.8
2017-07-20 CVE-2017-11474 GLPI before 9.1.5.1 has SQL Injection in the $crit variable in inc/computer_softwareversion.class.php, exploitable via ajax/common.tabs.php. Glpi 9.8