Browse CVEs

HIGH 8.8 CVE-2018-13049 The constructSQL function in inc/search.class.php in GLPI 9.2.x through 9.3.0 allows SQL Injection, as demonstrated by triggering a crafted LIMIT cla… Glpi after 9.3.0 Fix from $1,9502018-07-02 HIGH 7.5 CVE-2018-7562 A remote code execution issue was discovered in GLPI through 9.2.1. There is a race condition that allows temporary access to an uploaded executable … Glpi after 9.2.1 Fix from $1,9502018-03-12 MEDIUM 6.1 CVE-2018-7563 An issue was discovered in GLPI through 9.2.1. The application is affected by XSS in the query string to front/preference.php. An attacker is able to… Glpi after 9.2.1 Fix from $1,6002018-03-12 CRITICAL 9.8 CVE-2017-11184 SQL injection exists in front/devicesoundcard.php in GLPI before 9.1.5 via the start parameter. Glpi after 9.1.4 Fix from $2,3002017-07-28 CRITICAL 9.8 CVE-2017-11474 GLPI before 9.1.5.1 has SQL Injection in the $crit variable in inc/computer_softwareversion.class.php, exploitable via ajax/common.tabs.php. Glpi after 9.1.5.0 Fix from $2,3002017-07-20 HIGH 8.8 CVE-2017-11475 GLPI before 9.1.5.1 has SQL Injection in the condition rule field, exploitable via front/rulesengine.test.php. Glpi after 9.1.5.0 Fix from $1,9502017-07-20 HIGH 8.0 CVE-2016-7507 Cross-Site Request Forgery (CSRF) vulnerability in GLPI 0.90.4 allows remote authenticated attackers to submit a request that could lead to the creat… Glpi Mitigation only Fix from $1,9502017-07-19 MEDIUM 5.4 CVE-2016-7509 Cross-site scripting (XSS) vulnerability in GLPI 0.90.4 allows remote authenticated attackers to inject arbitrary web script or HTML by attaching a c… Glpi Mitigation only Fix from $1,6002017-07-19 CRITICAL 9.8 CVE-2017-11329 GLPI before 9.1.5 allows SQL injection via an ajax/getDropdownValue.php request with an entity_restrict parameter that is not a list of integers. Glpi after 9.1.4 Fix from $2,3002017-07-17 HIGH 7.5 CVE-2016-7508 Multiple SQL injection vulnerabilities in GLPI 0.90.4 allow an authenticated remote attacker to execute arbitrary SQL commands by using a certain cha… Glpi No fix yet Fix from $1,9502017-06-21 HIGH 9.0 CVE-2015-7684 Unrestricted file upload in GLPI before 0.85.3 allows remote authenticated users to execute arbitrary code by adding a file with an executable extens… Glpi after 0.85.2 Fix from $1,9502015-10-05 HIGH 7.5 CVE-2014-8360 Directory traversal vulnerability in inc/autoload.function.php in GLPI before 0.84.8 allows remote attackers to include and execute arbitrary local f… Glpi after 0.84.7 Fix from $1,9502015-04-14 MEDIUM 5.0 CVE-2014-5032 GLPI before 0.84.7 does not properly restrict access to cost information, which allows remote attackers to obtain sensitive information via the cost … Glpi after 0.84.6 Fix from $1,6002015-04-14 MEDIUM 6.5 CVE-2014-9258 SQL injection vulnerability in ajax/getDropdownValue.php in GLPI before 0.85.1 allows remote authenticated users to execute arbitrary SQL commands vi… Glpi after 0.85 Fix from $1,6002014-12-19 MEDIUM 6.4 CVE-2013-2225EPSS 8% inc/ticket.class.php in GLPI 0.83.9 and earlier allows remote attackers to unserialize arbitrary PHP objects via the _predefined_fields parameter to … Glpi after 0.83.9 Fix from $1,6002014-05-27 HIGH 7.5 CVE-2013-2226 Multiple SQL injection vulnerabilities in GLPI before 0.83.9 allow remote attackers to execute arbitrary SQL commands via the (1) users_id_assign par… Glpi after 0.83.8 Fix from $1,9502014-05-14 MEDIUM 6.8 CVE-2013-5696EPSS 8% inc/central.class.php in GLPI before 0.84.2 does not attempt to make install/install.php unavailable after an installation is completed, which allows… Glpi after 0.84.1 Fix from $1,6002013-09-23 MEDIUM 6.8 CVE-2012-4002 Cross-site request forgery (CSRF) vulnerability in GLPI-PROJECT GLPI before 0.83.3 allows remote attackers to hijack the authentication of unspecifie… Glpi after 0.83.2 Fix from $1,6002012-10-09 MEDIUM 6.5 CVE-2012-1037 PHP remote file inclusion vulnerability in front/popup.php in GLPI 0.78 through 0.80.61 allows remote authenticated users to execute arbitrary PHP co… Glpi Mitigation only Fix from $1,6002012-07-12 MEDIUM 5.0 CVE-2011-2720 The autocompletion functionality in GLPI before 0.80.2 does not blacklist certain username and password fields, which allows remote attackers to obta… Glpi after 0.80.1 Fix from $1,6002011-08-05