glpi vulnerabilities (Ubuntu)
195 vulnerabilities.
glpiUbuntuBypassable CSRF protection8.8 HighglpiUbuntuGLPi 9.5.4 does not sanitize the metadata. This way its possible to insert XSS into plugins to execute JavaScript code.6.1 MediumglpiUbuntuInsecure Direct Object Reference (IDOR) on "Solutions"6.8 MediumglpiUbuntuStored XSS in budget type6.2 MediumglpiUbuntuHorizontal Privilege Escalation7.7 HighglpiUbuntuUnsafe Reflection in getItemForItemtype()6.8 MediumglpiUbuntuXSS injection on ticket update5.4 MediumglpiUbuntuStored XSS on documents5.4 MediumglpiUbuntuXSS on tabs4.9 MediumglpiUbuntuXSS injection in ajax/kanban6.8 MediumglpiUbuntuentities switch IDOR5.8 MediumglpiUbuntuIn GLPI before 9.5.3, ajax/getDropdownValue.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read data from any itemType (e.g., Ticket, Users, etc.).4.3 MediumglpiUbuntuIn GLPI before 9.5.3, ajax/comments.php has an Insecure Direct Object Reference (IDOR) vulnerability that allows an attacker to read data from any database table (e.g., glpi_tickets, glpi_users, etc.)…4.3 MediumglpiUbuntuUnauthenticated Stored XSS in GLPI8.0 HighglpiUbuntuUnauthenticated File Deletion in GLPI7.4 HighglpiUbuntuInsecure encryption algorithm in GLPI7.8 HighglpiUbuntuSQL Injection in glpi7.1 HighglpiUbuntuRemote Code Execution in GLPI7.4 HighglpiUbuntuReflexive XSS in GLPI6.0 MediumglpiUbuntuPublic GLPIKEY can be used to decrypt any data in GLPI7.2 HighglpiUbuntuXSS in GLPI7.6 HighglpiUbuntuweak CSRF tokens in GLPI7.5 HighglpiUbuntubypass of manageRedirect in GLPI6.1 MediumglpiUbuntuAble to read any token through API user endpoint in GLPI6.6 MediumglpiUbuntuSQL injection on addme_observer and addme_assign in GLPI7.6 HighglpiUbuntuGLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php...8.8 HighglpiUbuntuGLPI GLPI Product 9.3.1 is affected by: Frame and Form tags Injection allowing admins to phish...3.5 LowglpiUbuntuinc/user.class.php in GLPI before 9.4.3 allows XSS via a user picture.6.1 MediumglpiUbuntuTeclib GLPI before 9.4.1.1 is affected by a timing attack associated with a cookie.8.1 HighglpiUbuntuTeclib GLPI through 9.3.3 has SQL injection via the "cycle" parameter in /scripts/unlock_tasks.php.9.8 CriticalglpiUbuntuTeclib GLPI before 9.4.1.1 is affected by a PHP type juggling vulnerability allowing bypass of...9.8 CriticalglpiUbuntuAn issue was discovered in GLPI through 9.2.1. The application is affected by XSS in the query...6.1 MediumglpiUbuntuA remote code execution issue was discovered in GLPI through 9.2.1. There is a race condition...7.5 HighglpiUbuntuSQL injection exists in front/devicesoundcard.php in GLPI before 9.1.5 via the start parameter.9.8 CriticalglpiUbuntufront/backup.php in GLPI before 9.1.5 allows remote authenticated administrators to delete...4.9 MediumglpiUbuntuGLPI before 9.1.5.1 has SQL Injection in the condition rule field, exploitable via front...8.8 HighglpiUbuntuGLPI before 9.1.5.1 has SQL Injection in the $crit variable in inc/computer_softwareversion.class...9.8 CriticalglpiUbuntuGLPI before 9.1.5 allows SQL injection via an ajax/getDropdownValue.php request with an...9.8 CriticalglpiUbuntuMultiple SQL injection vulnerabilities in GLPI 0.90.4 allow an authenticated remote attacker to...7.5 HighglpiUbuntuGLPI before 0.85.3 allows remote authenticated users to create super-admin accounts by leveraging...4.0 MediumglpiUbuntuUnrestricted file upload in GLPI before 0.85.3 allows remote authenticated users to execute...9.0 HighglpiUbuntuSQL injection vulnerability in ajax/getDropdownValue.php in GLPI before 0.85.1 allows remote...6.5 Medium