Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
440 results · page 7 of 9
Jun 5, 2023Kanboard is open source project management software that focuses on the Kanban methodology.CVE-2023-33956 · Other software · kanboard · reported by GitHubMedium 4.3
Kanboard is open source project management software that focuses on the Kanban methodology. Versions prior to 1.2.30 are subject to an Insecure direct object reference (IDOR) vulnerability present in the application's URL parameter. This vulnerability enables any user to read files uploaded by any other user, regardless of their privileges or restrictions. By Changing the file_id any user can render all the files where MimeType is image uploaded under **/files** directory regard less of uploaded by any user. This vulnerability poses a significant impact and severity to the application's security. By manipulating the URL parameter, an attacker can access sensitive files that should only be available to authorized users. This includes confidential documents or any other type of file stored within the application. The ability to read these files can lead to various detrimental consequences, such as unauthorized disclosure of sensitive information, privacy breaches, intellectual property theft, or exposure of trade secrets. Additionally, it could result in legal and regulatory implications, reputation damage, financial losses, and potential compromise of user trust. Users are advised t
- Product
- kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 1, 2023OpenProject is web-based project management software.CVE-2023-33960 · Other software · opf · reported by GitHubHigh 7.5
OpenProject is web-based project management software. For any OpenProject installation, a `robots.txt` file is generated through the server to denote which routes shall or shall not be accessed by crawlers. These routes contain project identifiers of all public projects in the instance. Prior to version 12.5.6, even if the entire instance is marked as `Login required` and prevents all truly anonymous access, the `/robots.txt` route remains publicly available. Version 12.5.6 has a fix for this issue. Alternatively, users can download a patchfile to apply the patch to any OpenProject version greater than 10.0 As a workaround, one may mark any public project as non-public and give anyone in need of access to the project a membership.
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.openproject.orggithub.com
May 30, 2023Kanboard is project management software that focuses on the Kanban methodology.CVE-2023-32685 · Other software · kanboard · reported by GitHubMedium 4.4
Kanboard is project management software that focuses on the Kanban methodology. Due to improper handling of elements under the `contentEditable` element, maliciously crafted clipboard content can inject arbitrary HTML tags into the DOM. A low-privileged attacker with permission to attach a document on a vulnerable Kanboard instance can trick the victim into pasting malicious screenshot data and achieve cross-site scripting if CSP is improperly configured. This issue has been patched in version 1.2.29.
- Product
- kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2023OpenProject is open source project management software.CVE-2023-31140 · Other software · opf · reported by GitHubMedium 4.8
OpenProject is open source project management software. Starting with version 7.4.0 and prior to version 12.5.4, when a user registers and confirms their first two-factor authentication (2FA) device for an account, existing logged in sessions for that user account are not terminated. Likewise, if an administrators creates a mobile phone 2FA device on behalf of a user, their existing sessions are not terminated. The issue has been resolved in OpenProject version 12.5.4 by actively terminating sessions of user accounts having registered and confirmed a 2FA device. As a workaround, users who register the first 2FA device on their account can manually log out to terminate all other active sessions. This is the default behavior of OpenProject but might be disabled through a configuration option. Double check that this option is not overridden if one plans to employ the workaround.
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcommunity.openproject.orggithub.com
Apr 5, 2023GLPI is a free asset and IT management software package.CVE-2023-28852 · Other software · glpi-project · reported by GitHubMedium 4.8
GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to versions 9.5.13 and 10.0.7, a user with dashboard administration rights may hack the dashboard form to store malicious code that will be executed when other users will use the related dashboard. Versions 9.5.13 and 10.0.7 contain a patch for this issue.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023GLPI is a free asset and IT management software package.CVE-2023-28849 · Other software · glpi-project · reported by GitHubCritical 10
GLPI is a free asset and IT management software package. Starting in version 10.0.0 and prior to version 10.0.7, GLPI inventory endpoint can be used to drive a SQL injection attack. It can also be used to store malicious code that could be used to perform XSS attack. By default, GLPI inventory endpoint requires no authentication. Version 10.0.7 contains a patch for this issue. As a workaround, disable native inventory.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023GLPI is a free asset and IT management software package.CVE-2023-28838 · Other software · glpi-project · reported by GitHubCritical 9.6
GLPI is a free asset and IT management software package. Starting in version 0.50 and prior to versions 9.5.13 and 10.0.7, a SQL Injection vulnerability allow users with access rights to statistics or reports to extract all data from database and, in some cases, write a webshell on the server. Versions 9.5.13 and 10.0.7 contain a patch for this issue. As a workaround, remove `Assistance > Statistics` and `Tools > Reports` read rights from every user.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023GLPI is a free asset and IT management software package.CVE-2023-28639 · Other software · glpi · reported by GitHubMedium 6.1
GLPI is a free asset and IT management software package. Starting in version 0.85 and prior to versions 9.5.13 and 10.0.7, a malicious link can be crafted by an unauthenticated user. It will be able to exploit a reflected XSS in case any authenticated user opens the crafted link. This issue is fixed in versions 9.5.13 and 10.0.7.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023GLPI is a free asset and IT management software package.CVE-2023-28636 · Other software · glpi-project · reported by GitHubMedium 4.5
GLPI is a free asset and IT management software package. Starting in version 0.60 and prior to versions 9.5.13 and 10.0.7, a vulnerability allows an administrator to create a malicious external link. This issue is fixed in versions 9.5.13 and 10.0.7.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023GLPI is a free asset and IT management software package.CVE-2023-28634 · Other software · glpi-project · reported by GitHubHigh 8.8
GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.7, a user who has the Technician profile could see and generate a Personal token for a Super-Admin. Using such token it is possible to negotiate a GLPI session and hijack the Super-Admin account, resulting in a Privilege Escalation. Versions 9.5.13 and 10.0.7 contain a patch for this issue.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023GLPI is a free asset and IT management software package.CVE-2023-28633 · Other software · glpi-project · reported by GitHubLow 3.5
GLPI is a free asset and IT management software package. Starting in version 0.84 and prior to versions 9.5.13 and 10.0.7, usage of RSS feeds is subject to server-side request forgery (SSRF). In case the remote address is not a valid RSS feed, an RSS autodiscovery feature is triggered. This feature does not check safety or URLs. Versions 9.5.13 and 10.0.7 contain a patch for this issue.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 5, 2023GLPI is a free asset and IT management software package.CVE-2023-28632 · Other software · glpi-project · reported by GitHubHigh 8.1
GLPI is a free asset and IT management software package. Starting in version 0.83 and prior to versions 9.5.13 and 10.0.7, an authenticated user can modify emails of any user, and can therefore takeover another user account through the "forgotten password" feature. By modifying emails, the user can also receive sensitive data through GLPI notifications. Versions 9.5.13 and 10.0.7 contain a patch for this issue. As a workaround, account takeover can be prevented by deactivating all notifications related to `Forgotten password?` event. However, it will not prevent unauthorized modification of any user emails.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 28, 2023 Dell PowerScale nodes A200, A2000, H400, H500, H600, H5600, F800, F810 integrated hardware management software contains an uncontrolled resource consumption vuCVE-2023-23689 · Other software · Dell · reported by security_alert@emc.comMedium 5.3
Dell PowerScale nodes A200, A2000, H400, H500, H600, H5600, F800, F810 integrated hardware management software contains an uncontrolled resource consumption vulnerability. This may allow an unauthenticated network host to impair built-in hardware management functionality and trigger OneFS data protection mechanism causing a denial of service.
- Product
- PowerScale OneFS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2023Hardcoded credentials in Global Facilities Management Software (GFMS) Version 3 software distributed by Key Systems Management permits remote attackers to impacCVE-2022-45766 · Other software · Keystorage · reported by MITRECritical 9.1
Hardcoded credentials in Global Facilities Management Software (GFMS) Version 3 software distributed by Key Systems Management permits remote attackers to impact availability, confidentiality, accessibility and dependability of electronic key boxes.
- Product
- Global Facilities Management Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgirlslearncyber.comgirlslearncyber.com
Jan 26, 2023GLPI is a Free Asset and IT Management Software package.CVE-2023-23610 · Other software · glpi-project · reported by GitHubMedium 6.5
GLPI is a Free Asset and IT Management Software package. Versions prior to 9.5.12 and 10.0.6 are vulnerable to Improper Privilege Management. Any user having access to the standard interface can export data of almost any GLPI item type, even those on which user is not allowed to access (including assets, tickets, users, ...). This issue is patched in 10.0.6.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023GLPI is a Free Asset and IT Management Software package.CVE-2023-22725 · Other software · glpi-project · reported by GitHubMedium 6.2
GLPI is a Free Asset and IT Management Software package. Versions 0.6.0 and above, prior to 10.0.6 are vulnerable to Cross-site Scripting. This vulnerability allow for an administrator to create a malicious external link. This issue is patched in 10.0.6.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023GLPI is a Free Asset and IT Management Software package.CVE-2023-22724 · Other software · glpi-project · reported by GitHubMedium 6.2
GLPI is a Free Asset and IT Management Software package. Versions prior to 10.0.6 are subject to Cross-site Scripting via malicious RSS feeds. An Administrator can import a malicious RSS feed that contains Cross Site Scripting (XSS) payloads inside RSS links. Victims who wish to visit an RSS content and click on the link will execute the Javascript. This issue is patched in 10.0.6.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023GLPI is a Free Asset and IT Management Software package.CVE-2023-22722 · Other software · glpi-project · reported by GitHubMedium 6.8
GLPI is a Free Asset and IT Management Software package. Versions 9.4.0 and above, prior to 10.0.6 are subject to Cross-site Scripting. An attacker can persuade a victim into opening a URL containing a payload exploiting this vulnerability. After exploited, the attacker can make actions as the victim or exfiltrate session cookies. This issue is patched in version 10.0.6.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023GLPI is a Free Asset and IT Management Software package.CVE-2023-22500 · Other software · glpi-project · reported by GitHubHigh 7.5
GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6 are vulnerable to Incorrect Authorization. This vulnerability allow unauthorized access to inventory files. Thus, if anonymous access to FAQ is allowed, inventory files are accessbile by unauthenticated users. This issue is patched in version 10.0.6. As a workaround, disable native inventory and delete inventory files from server (default location is `files/_inventory`).
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2023GLPI is a Free Asset and IT Management Software package.CVE-2022-41941 · Other software · glpi-project · reported by GitHubMedium 6.2
GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6, are subject to Cross-site Scripting. An administrator may store malicious code in help links. This issue is patched in 10.0.6.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2022HotelDruid Hotel Management Software v3.0.3 and below was discovered to have exposed session tokens in multiple links via GET parameters, allowing attackers to CVE-2021-42948 · Other software · Digitaldruid · reported by MITRELow 3.7
HotelDruid Hotel Management Software v3.0.3 and below was discovered to have exposed session tokens in multiple links via GET parameters, allowing attackers to access user session id's.
- Product
- Hoteldruid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2022The component controlla_login function in HotelDruid Hotel Management Software v3.0.3 generates a predictable session token, allowing attackers to bypass authenCVE-2021-42949 · Other software · Digitaldruid · reported by MITRECritical 9.8
The component controlla_login function in HotelDruid Hotel Management Software v3.0.3 generates a predictable session token, allowing attackers to bypass authentication via bruteforce attacks.
- Product
- Hoteldruid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2022GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licensCVE-2022-36112 · Other software · glpi-project · reported by GitHubLow 3.5
GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Usage of RSS feeds or extenal calendar in planning is subject to SSRF exploit. Server-side requests can be used to scan server port or services opened on GLPI server or its private network. Queries responses are not exposed to end-user (blind SSRF). Users are advised to upgrade to version 10.0.3 to resolve this issue. There are no known workarounds.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2022GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licensCVE-2022-35947 · Other software · glpi-project · reported by GitHubCritical 10
GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Affected versions have been found to be vulnerable to a SQL injection attack which an attacker could leverage to simulate an arbitrary user login. Users are advised to upgrade to version 10.0.3. Users unable to upgrade should disable the `Enable login with external token` API configuration.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2022GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licensCVE-2022-35946 · Other software · glpi-project · reported by GitHubMedium 5.5
GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In affected versions request input is not properly validated in the plugin controller and can be used to access low-level API of Plugin class. An attacker can, for instance, alter database data. Attacker must have "General setup" update rights to be able to perform this attack. Users are advised to upgrade to version 10.0.3. Users unable to upgrade should remove the `front/plugin.form.php` script.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2022GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licensCVE-2022-35945 · Other software · glpi-project · reported by GitHubMedium 6.3
GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Information associated to registration key are not properly escaped in registration key configuration page. They can be used to steal a GLPI administrator cookie. Users are advised to upgrade to 10.0.3. There are no known workarounds for this issue. ### Workarounds Do not use a registration key created by an untrusted person.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2022GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licensCVE-2022-31187 · Other software · glpi-project · reported by GitHubMedium 6.8
GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Affected versions were found to not properly neutralize HTML tags in the global search context. Users are advised to upgrade to version 10.0.3 to resolve this issue. Users unable to upgrade should disable global search.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 14, 2022GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licensCVE-2022-31143 · Other software · glpi-project · reported by GitHubMedium 5.3
GLPI stands for Gestionnaire Libre de Parc Informatique and is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. It was found that in affected versions there is an exposure of private information defined in setup of GLPI (like smtp or cas hosts). Note that passwords are not exposed. Users are advised to upgrade to version 10.0.3. There are no known workarounds for this issue.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 17, 2022Best Contact Management Software: Does not sanitise and escape its settingsCVE-2022-2151 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Best Contact Management Software WordPress plugin through 3.7.3 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Best Contact Management Software
- Affected
- up to 3.7.3
- What to do
- Affects up to 3.7.3. Update Best Contact Management Software to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 28, 2022GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.CVE-2022-31068 · Other software · glpi-project · reported by GitHubMedium 5.3
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions all GLPI instances with the native inventory used may leak sensitive information. The feature to get refused file is not authenticated. This issue has been addressed in version 10.0.2 and all affected users are advised to upgrade.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2022GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.CVE-2022-31061 · Other software · glpi-project · reported by GitHubCritical 9.8
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions there is a SQL injection vulnerability which is possible on login page. No user credentials are required to exploit this vulnerability. Users are advised to upgrade as soon as possible. There are no known workarounds for this issue.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2022GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.CVE-2022-31056 · Other software · glpi-project · reported by GitHubCritical 9.8
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In affected versions all assistance forms (Ticket/Change/Problem) permit sql injection on the actor fields. This issue has been resolved in version 10.0.2 and all affected users are advised to upgrade.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Jun 27, 2022GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing.CVE-2022-31082 · Other software · glpi-project · reported by GitHubMedium 5.8
GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. glpi-inventory-plugin is a plugin for GLPI to handle inventory management. In affected versions a SQL injection can be made using package deployment tasks. This issue has been resolved in version 1.0.2. Users are advised to upgrade. Users unable to upgrade should delete the `front/deploypackage.public.php` file if they are not using the `deploy tasks` feature.
- Product
- glpi-inventory-plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing.CVE-2022-29250 · Other software · glpi-project · reported by GitHubHigh 8.1
GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to version 10.0.1 it is possible to add extra information by SQL injection on search pages. In order to exploit this vulnerability a user must be logged in.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing.CVE-2022-24876 · Other software · glpi-project · reported by GitHubMedium 5.4
GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Kanban is a GLPI view to display Projects, Tickets, Changes or Problems on a task board. In versions prior to 10.0.1 a user can exploit a cross site scripting vulnerability in Kanban by injecting HTML code in its user name. Users are advised to upgrade. There are no known workarounds for this issue.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2022NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where the memory management software does not release a CVE-2022-28187 · Other software · NVIDIA · reported by psirt@nvidia.comMedium 5.5
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where the memory management software does not release a resource after its effective lifetime has ended, which may lead to denial of service.
- Product
- NVIDIA GPU Display Driver
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordnvidia.custhelp.comnvidia.custhelp.com
Apr 26, 2022HotelDruid Hotel Management Software v3.0.3 contains a cross-site scripting (XSS) vulnerability via the prezzoperiodo4 parameter in creaprezzi.php.CVE-2022-26564 · Other software · Digitaldruid · reported by MITREMedium 6.1
HotelDruid Hotel Management Software v3.0.3 contains a cross-site scripting (XSS) vulnerability via the prezzoperiodo4 parameter in creaprezzi.php.
- Product
- Hoteldruid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordrydzak.mehoteldruid.com
Apr 21, 2022GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing.CVE-2022-24869 · Other software · glpi-project · reported by GitHubMedium 4.6
GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to 10.0.0 one can use ticket's followups or setup login messages with a stylesheet link. This may allow for a cross site scripting attack vector. This issue is partially mitigated by cors security of browsers, though users are still advised to upgrade.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2022GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing.CVE-2022-24868 · Other software · glpi-project · reported by GitHubHigh 7.3
GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. In versions prior to 10.0.0 one can exploit a lack of sanitization on SVG file uploads and inject javascript into their user avatar. As a result any user viewing the avatar will be subject to a cross site scripting attack. Users of GLPI are advised to upgrade. Users unable to upgrade should disallow SVG avatars.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2022GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing.CVE-2022-24867 · Other software · glpi-project · reported by GitHubHigh 7.5
GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. When you pass the config to the javascript, some entries are filtered out. The variable ldap_pass is not filtered and when you look at the source code of the rendered page, we can see the password for the root dn. Users are advised to upgrade. There is no known workaround for this issue.
- Product
- glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2022A Cross Site Scripting (XSS) vulnerability exists in Chikista Patient Management Software 2.0.2 via the last_name parameter in the (1) patient/insert, (2) patieCVE-2021-42869 · Other software · Chikitsa · reported by MITREMedium 4.8
A Cross Site Scripting (XSS) vulnerability exists in Chikista Patient Management Software 2.0.2 via the last_name parameter in the (1) patient/insert, (2) patient_report, (3) /appointment_report, (4) visit_report, and (5) /bill_detail_report pages.
- Product
- Patient Management Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2022A Cross Site Scripting (XSS) vulnerability exists in Chikista Patient Management Software 2.0.2 in the first_name parameter in (1) patient/insert, (2) patient_rCVE-2021-42868 · Other software · Chikitsa · reported by MITREMedium 4.8
A Cross Site Scripting (XSS) vulnerability exists in Chikista Patient Management Software 2.0.2 in the first_name parameter in (1) patient/insert, (2) patient_report, (3) appointment_report, (4) visit_report, and (5) bill_detail_report pages. .
- Product
- Patient Management Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2022GLPI is a free asset and IT management software package.CVE-2022-21720 · Other software · Glpi-project · reported by GitHubMedium 4.9
GLPI is a free asset and IT management software package. Prior to version 9.5.7, an entity administrator is capable of retrieving normally inaccessible data via SQL injection. Version 9.5.7 contains a patch for this issue. As a workaround, disabling the `Entities` update right prevents exploitation of this vulnerability.
- Product
- Glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2022GLPI is a free asset and IT management software package.CVE-2022-21719 · Other software · Glpi-project · reported by GitHubMedium 6.1
GLPI is a free asset and IT management software package. All GLPI versions prior to 9.5.7 are vulnerable to reflected cross-site scripting. Version 9.5.7 contains a patch for this issue. There are no known workarounds.
- Product
- Glpi
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2021OpenProject is a web-based project management software.CVE-2021-43830 · Other software · opf · reported by GitHubHigh 7.4
OpenProject is a web-based project management software. OpenProject versions >= 12.0.0 are vulnerable to a SQL injection in the budgets module. For authenticated users with the "Edit budgets" permission, the request to reassign work packages to another budget unsufficiently sanitizes user input in the `reassign_to_id` parameter. The vulnerability has been fixed in version 12.0.4. Versions prior to 12.0.0 are not affected. If you're upgrading from an older version, ensure you are upgrading to at least version 12.0.4. If you are unable to upgrade in a timely fashion, the following patch can be applied: https://github.com/opf/openproject/pull/9983.patch
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2021A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files CVE-2021-38460 · Other software · Moxa · reported by ics-cert@hq.dhs.govHigh 7.5
A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files used to execute code, such as programs or libraries.
- Product
- MXview Network Management Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Oct 12, 2021A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files CVE-2021-38458 · Other software · Moxa · reported by ics-cert@hq.dhs.govCritical 9.8
A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files used to execute code, such as programs or libraries.
- Product
- MXview Network Management Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Oct 12, 2021A use of hard-coded password vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to gain access through accCVE-2021-38456 · Other software · Moxa · reported by ics-cert@hq.dhs.govCritical 9.8
A use of hard-coded password vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to gain access through accounts using default passwords
- Product
- MXview Network Management Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Oct 12, 2021A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files CVE-2021-38454 · Other software · Moxa · reported by ics-cert@hq.dhs.govCritical 10
A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files used to execute code, such as programs or libraries.
- Product
- MXview Network Management Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Oct 12, 2021A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files CVE-2021-38452 · Other software · Moxa · reported by ics-cert@hq.dhs.govHigh 7.5
A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files used to execute code, such as programs or libraries.
- Product
- MXview Network Management Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordus-cert.cisa.govus-cert.cisa.gov
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.