Glpi-Project
Page 3 of 3 — Glpi-Project CVEs from a corpus of 233, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-11033 | Medium | 6.6 | 2020-05-05 | In GLPI from version 9.1 and before version 9.4.6, any API user with READ right on User itemtype will have access to full list of users when querying apirest.p… |
CVE-2020-11032 | High | 7.6 | 2020-05-05 | In GLPI before version 9.4.6, there is a SQL injection vulnerability for all helpdesk instances. Exploiting this vulnerability requires a technician account. T… |
CVE-2013-2227 | High | 7.5 | 2019-11-01 | GLPI 0.83.7 has Local File Inclusion in common.tabs.php. |
CVE-2019-14666 | High | 8.8 | 2019-09-25 | GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. The lack of correct validation leads to recovery… |
CVE-2019-1010307 | Medium | 5.4 | 2019-07-15 | GLPI GLPI Product 9.3.1 is affected by: Cross Site Scripting (XSS). The impact is: All dropdown values are vulnerable to XSS leading to privilege escalation an… |
CVE-2019-1010310 | Low | 3.5 | 2019-07-12 | GLPI GLPI Product 9.3.1 is affected by: Frame and Form tags Injection allowing admins to phish users by putting code in reminder description. The impact is: Ad… |
CVE-2019-13240 | Medium | 5.9 | 2019-07-10 | An issue was discovered in GLPI before 9.4.1. After a successful password reset by a user, it is possible to change that user's password again during the next… |
CVE-2019-13239 | Medium | 6.1 | 2019-07-04 | inc/user.class.php in GLPI before 9.4.3 allows XSS via a user picture. |
CVE-2019-10477 | High | 7.5 | 2019-03-29 | The FusionInventory plugin before 1.4 for GLPI 9.3.x and before 1.1 for GLPI 9.4.x mishandles sendXML actions. |
CVE-2019-10233 | High | 8.1 | 2019-03-27 | Teclib GLPI before 9.4.1.1 is affected by a timing attack associated with a cookie. |
CVE-2018-13049 | High | 8.8 | 2018-07-02 | The constructSQL function in inc/search.class.php in GLPI 9.2.x through 9.3.0 allows SQL Injection, as demonstrated by triggering a crafted LIMIT clause to fro… |
CVE-2018-7563 | Medium | 6.1 | 2018-03-12 | An issue was discovered in GLPI through 9.2.1. The application is affected by XSS in the query string to front/preference.php. An attacker is able to create a… |
CVE-2018-7562 | High | 7.5 | 2018-03-12 | A remote code execution issue was discovered in GLPI through 9.2.1. There is a race condition that allows temporary access to an uploaded executable file that… |
CVE-2017-11184 | Critical | 9.8 | 2017-07-28 | SQL injection exists in front/devicesoundcard.php in GLPI before 9.1.5 via the start parameter. |
CVE-2017-11183 | Medium | 4.9 | 2017-07-28 | front/backup.php in GLPI before 9.1.5 allows remote authenticated administrators to delete arbitrary files via a crafted file parameter. |
CVE-2017-11475 | High | 8.8 | 2017-07-20 | GLPI before 9.1.5.1 has SQL Injection in the condition rule field, exploitable via front/rulesengine.test.php. |
CVE-2017-11474 | Critical | 9.8 | 2017-07-20 | GLPI before 9.1.5.1 has SQL Injection in the $crit variable in inc/computer_softwareversion.class.php, exploitable via ajax/common.tabs.php. |
CVE-2016-7509 | Medium | 5.4 | 2017-07-19 | Cross-site scripting (XSS) vulnerability in GLPI 0.90.4 allows remote authenticated attackers to inject arbitrary web script or HTML by attaching a crafted HTM… |
CVE-2016-7507 | High | 8.0 | 2017-07-19 | Cross-Site Request Forgery (CSRF) vulnerability in GLPI 0.90.4 allows remote authenticated attackers to submit a request that could lead to the creation of an… |
CVE-2017-11329 | Critical | 9.8 | 2017-07-17 | GLPI before 9.1.5 allows SQL injection via an ajax/getDropdownValue.php request with an entity_restrict parameter that is not a list of integers. |
CVE-2016-7508 | High | 7.5 | 2017-06-21 | Multiple SQL injection vulnerabilities in GLPI 0.90.4 allow an authenticated remote attacker to execute arbitrary SQL commands by using a certain character whe… |
CVE-2015-7685 | | 2015-10-05 | GLPI before 0.85.3 allows remote authenticated users to create super-admin accounts by leveraging permissions to create a user and the _profiles_id parameter t… | |
CVE-2015-7684 | | 2015-10-05 | Unrestricted file upload in GLPI before 0.85.3 allows remote authenticated users to execute arbitrary code by adding a file with an executable extension as an… | |
CVE-2014-8360 | | 2015-04-14 | Directory traversal vulnerability in inc/autoload.function.php in GLPI before 0.84.8 allows remote attackers to include and execute arbitrary local files via a… | |
CVE-2014-5032 | | 2015-04-14 | GLPI before 0.84.7 does not properly restrict access to cost information, which allows remote attackers to obtain sensitive information via the cost criteria i… | |
CVE-2014-9258 | | 2014-12-19 | SQL injection vulnerability in ajax/getDropdownValue.php in GLPI before 0.85.1 allows remote authenticated users to execute arbitrary SQL commands via the cond… | |
CVE-2013-2225 | | 2014-05-27 | inc/ticket.class.php in GLPI 0.83.9 and earlier allows remote attackers to unserialize arbitrary PHP objects via the _predefined_fields parameter to front/tick… | |
CVE-2013-2226 | | 2014-05-14 | Multiple SQL injection vulnerabilities in GLPI before 0.83.9 allow remote attackers to execute arbitrary SQL commands via the (1) users_id_assign parameter to… | |
CVE-2013-5696 | | 2013-09-23 | inc/central.class.php in GLPI before 0.84.2 does not attempt to make install/install.php unavailable after an installation is completed, which allows remote at… | |
CVE-2012-4003 | | 2012-10-09 | Multiple cross-site scripting (XSS) vulnerabilities in GLPI-PROJECT GLPI before 0.83.3 allow remote attackers to inject arbitrary web script or HTML via unknow… | |
CVE-2012-4002 | | 2012-10-09 | Cross-site request forgery (CSRF) vulnerability in GLPI-PROJECT GLPI before 0.83.3 allows remote attackers to hijack the authentication of unspecified victims… | |
CVE-2012-1037 | | 2012-07-12 | PHP remote file inclusion vulnerability in front/popup.php in GLPI 0.78 through 0.80.61 allows remote authenticated users to execute arbitrary PHP code via a U… | |
CVE-2011-2720 | | 2011-08-05 | The autocompletion functionality in GLPI before 0.80.2 does not blacklist certain username and password fields, which allows remote attackers to obtain sensiti… |