Note:
This project will be discontinued after December 13, 2021. [more]
Product:
Glpi
(Glpi\-Project)| Repositories |
Unknown: This might be proprietary software. |
| #Vulnerabilities | 149 |
| Date | Id | Summary | Products | Score | Patch | Annotated |
|---|---|---|---|---|---|---|
| 2023-12-13 | CVE-2023-46727 | GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.11, GLPI inventory endpoint can be used to drive a SQL injection attack. Version 10.0.11 contains a patch for the issue. As a workaround, disable native inventory. | Glpi | 9.8 | ||
| 2024-02-01 | CVE-2023-51446 | GLPI is a Free Asset and IT Management Software package. When authentication is made against a LDAP, the authentication form can be used to perform LDAP injection. Upgrade to 10.0.12. | Glpi | 8.1 | ||
| 2024-02-01 | CVE-2024-23645 | GLPI is a Free Asset and IT Management Software package. A malicious URL can be used to execute XSS on reports pages. Upgrade to 10.0.12. | Glpi | 6.1 | ||
| 2024-11-15 | CVE-2024-40638 | GLPI is a free asset and IT management software package. An authenticated user can exploit multiple SQL injection vulnerabilities. One of them can be used to alter another user account data and take control of it. Upgrade to 10.0.17. | Glpi | 8.8 | ||
| 2024-11-15 | CVE-2024-41678 | GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability. Upgrade to 10.0.17. | Glpi | 6.1 | ||
| 2024-11-15 | CVE-2024-41679 | GLPI is a free asset and IT management software package. An authenticated user can exploit a SQL injection vulnerability from the ticket form. Upgrade to 10.0.17. | Glpi | 8.8 | ||
| 2024-11-15 | CVE-2024-43417 | GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability located in the Software form. Upgrade to 10.0.17. | Glpi | 6.1 | ||
| 2024-11-15 | CVE-2024-43418 | GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability. Upgrade to 10.0.17. | Glpi | 6.1 | ||
| 2024-11-15 | CVE-2024-45608 | GLPI is a free asset and IT management software package. An authenticated user can perfom a SQL injection by changing its preferences. Upgrade to 10.0.17. | Glpi | 8.8 | ||
| 2024-11-15 | CVE-2024-45609 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability located in the reports pages. Upgrade to 10.0.17. | Glpi | 6.1 |