Glpi-project

Glpi

176 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.4

CVE-2022-24869

  • EPSS 0.31%
  • Published 21.04.2022 17:15:08
  • Last modified 21.11.2024 06:51:17

GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to 10.0.0 one can use ticket's followups or setup login messages with a stylesheet link. Thi...

9.8

CVE-2021-44617

Exploit
  • EPSS 0.54%
  • Published 28.03.2022 02:15:06
  • Last modified 21.11.2024 06:31:16

A SQL Injection vulnerability exits in the Ramo plugin for GLPI 9.4.6 via the idu parameter in plugins/ramo/ramoapirest.php/getOutdated.

4.9

CVE-2022-21720

  • EPSS 0.41%
  • Published 28.01.2022 11:15:08
  • Last modified 05.05.2025 17:17:47

GLPI is a free asset and IT management software package. Prior to version 9.5.7, an entity administrator is capable of retrieving normally inaccessible data via SQL injection. Version 9.5.7 contains a patch for this issue. As a workaround, disabling ...

6.1

CVE-2022-21719

  • EPSS 0.31%
  • Published 28.01.2022 10:15:07
  • Last modified 05.05.2025 17:17:47

GLPI is a free asset and IT management software package. All GLPI versions prior to 9.5.7 are vulnerable to reflected cross-site scripting. Version 9.5.7 contains a patch for this issue. There are no known workarounds.

6.5

CVE-2021-39210

  • EPSS 0.33%
  • Published 15.09.2021 17:15:10
  • Last modified 21.11.2024 06:18:54

GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, the cookie used to store the autologin cookie (when a user uses the "remember me" feature) is accessible by scripts. A malicious plugin that could steal this cookie ...

5.3

CVE-2021-39211

  • EPSS 54.4%
  • Published 15.09.2021 17:15:10
  • Last modified 21.11.2024 06:18:54

GLPI is a free Asset and IT management software package. Starting in version 9.2 and prior to version 9.5.6, the telemetry endpoint discloses GLPI and server information. This issue is fixed in version 9.5.6. As a workaround, remove the file `ajax/te...

8.8

CVE-2021-39213

  • EPSS 0.35%
  • Published 15.09.2021 17:15:10
  • Last modified 21.11.2024 06:18:55

GLPI is a free Asset and IT management software package. Starting in version 9.1 and prior to version 9.5.6, GLPI with API Rest enabled is vulnerable to API bypass with custom header injection. This issue is fixed in version 9.5.6. One may disable AP...

8.8

CVE-2021-39209

  • EPSS 0.14%
  • Published 15.09.2021 16:15:07
  • Last modified 21.11.2024 06:18:54

GLPI is a free Asset and IT management software package. In versions prior to 9.5.6, a user who is logged in to GLPI can bypass Cross-Site Request Forgery (CSRF) protection in many places. This could allow a malicious actor to perform many actions on...

6.1

CVE-2021-3486

Exploit
  • EPSS 0.71%
  • Published 26.05.2021 22:15:08
  • Last modified 21.11.2024 06:21:39

GLPi 9.5.4 does not sanitize the metadata. This way its possible to insert XSS into plugins to execute JavaScript code.

6.5

CVE-2021-21326

  • EPSS 0.21%
  • Published 08.03.2021 17:15:13
  • Last modified 21.11.2024 05:48:01

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. In GLPI before version 9.5.4 it is possible to create tickets for another user with self-service interf...