Filtered by vendor Glpi-project Subscriptions
Filtered by product Glpi Subscriptions
Total 143 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2015-7684 1 Glpi-project 1 Glpi 2024-11-21 N/A
Unrestricted file upload in GLPI before 0.85.3 allows remote authenticated users to execute arbitrary code by adding a file with an executable extension as an attachment to a new ticket, then accessing it via a direct request to the file in files/_tmp/.
CVE-2014-9258 1 Glpi-project 1 Glpi 2024-11-21 N/A
SQL injection vulnerability in ajax/getDropdownValue.php in GLPI before 0.85.1 allows remote authenticated users to execute arbitrary SQL commands via the condition parameter.
CVE-2014-8360 1 Glpi-project 1 Glpi 2024-11-21 N/A
Directory traversal vulnerability in inc/autoload.function.php in GLPI before 0.84.8 allows remote attackers to include and execute arbitrary local files via a .._ (dot dot underscore) in an item type to the getItemForItemtype, as demonstrated by the itemtype parameter in ajax/common.tabs.php.
CVE-2014-5032 1 Glpi-project 1 Glpi 2024-11-21 N/A
GLPI before 0.84.7 does not properly restrict access to cost information, which allows remote attackers to obtain sensitive information via the cost criteria in the search bar.
CVE-2013-5696 1 Glpi-project 1 Glpi 2024-11-21 N/A
inc/central.class.php in GLPI before 0.84.2 does not attempt to make install/install.php unavailable after an installation is completed, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and (1) perform a SQL injection via an Etape_4 action or (2) execute arbitrary PHP code via an update_1 action.
CVE-2013-2227 2 Debian, Glpi-project 2 Debian Linux, Glpi 2024-11-21 7.5 High
GLPI 0.83.7 has Local File Inclusion in common.tabs.php.
CVE-2013-2226 1 Glpi-project 1 Glpi 2024-11-21 N/A
Multiple SQL injection vulnerabilities in GLPI before 0.83.9 allow remote attackers to execute arbitrary SQL commands via the (1) users_id_assign parameter to ajax/ticketassigninformation.php, (2) filename parameter to front/document.form.php, or (3) table parameter to ajax/comments.php.
CVE-2013-2225 1 Glpi-project 1 Glpi 2024-11-21 N/A
inc/ticket.class.php in GLPI 0.83.9 and earlier allows remote attackers to unserialize arbitrary PHP objects via the _predefined_fields parameter to front/ticket.form.php.
CVE-2012-4003 1 Glpi-project 1 Glpi 2024-11-21 N/A
Multiple cross-site scripting (XSS) vulnerabilities in GLPI-PROJECT GLPI before 0.83.3 allow remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVE-2012-4002 1 Glpi-project 1 Glpi 2024-11-21 N/A
Cross-site request forgery (CSRF) vulnerability in GLPI-PROJECT GLPI before 0.83.3 allows remote attackers to hijack the authentication of unspecified victims via unknown vectors.
CVE-2012-1037 1 Glpi-project 1 Glpi 2024-11-21 N/A
PHP remote file inclusion vulnerability in front/popup.php in GLPI 0.78 through 0.80.61 allows remote authenticated users to execute arbitrary PHP code via a URL in the sub_type parameter.
CVE-2011-2720 1 Glpi-project 1 Glpi 2024-11-21 N/A
The autocompletion functionality in GLPI before 0.80.2 does not blacklist certain username and password fields, which allows remote attackers to obtain sensitive information via a crafted POST request.
CVE-2024-40638 1 Glpi-project 1 Glpi 2024-11-20 8.1 High
GLPI is a free asset and IT management software package. An authenticated user can exploit multiple SQL injection vulnerabilities. One of them can be used to alter another user account data and take control of it. Upgrade to 10.0.17.
CVE-2024-41678 1 Glpi-project 1 Glpi 2024-11-20 6.5 Medium
GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability. Upgrade to 10.0.17.
CVE-2024-41679 1 Glpi-project 1 Glpi 2024-11-20 6.5 Medium
GLPI is a free asset and IT management software package. An authenticated user can exploit a SQL injection vulnerability from the ticket form. Upgrade to 10.0.17.
CVE-2024-43417 1 Glpi-project 1 Glpi 2024-11-20 6.5 Medium
GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability located in the Software form. Upgrade to 10.0.17.
CVE-2024-43418 1 Glpi-project 1 Glpi 2024-11-20 6.5 Medium
GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability. Upgrade to 10.0.17.
CVE-2024-45608 1 Glpi-project 1 Glpi 2024-11-20 6.5 Medium
GLPI is a free asset and IT management software package. An authenticated user can perfom a SQL injection by changing its preferences. Upgrade to 10.0.17.
CVE-2024-43416 1 Glpi-project 1 Glpi 2024-11-20 7.5 High
GLPI is a free asset and IT management software package. Starting in version 0.80 and prior to version 10.0.17, an unauthenticated user can use an application endpoint to check if an email address corresponds to a valid GLPI user. Version 10.0.17 fixes the issue.
CVE-2024-45609 1 Glpi-project 1 Glpi 2024-11-20 6.5 Medium
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability located in the reports pages. Upgrade to 10.0.17.