ALT-PU-2013-1123-1
Closed vulnerabilities
Modified: 2024-11-21
CVE-2013-2225
inc/ticket.class.php in GLPI 0.83.9 and earlier allows remote attackers to unserialize arbitrary PHP objects via the _predefined_fields parameter to front/ticket.form.php.
- 94683
- 94683
- [oss-security] 20130627 CVE request for GLPI
- [oss-security] 20130627 CVE request for GLPI
- [oss-security] 20130630 Re: CVE request for GLPI
- [oss-security] 20130630 Re: CVE request for GLPI
- 26530
- 26530
- 60823
- 60823
- https://forge.indepnet.net/projects/glpi/repository/revisions/21169/diff
- https://forge.indepnet.net/projects/glpi/repository/revisions/21169/diff
Modified: 2024-11-21
CVE-2013-2226
Multiple SQL injection vulnerabilities in GLPI before 0.83.9 allow remote attackers to execute arbitrary SQL commands via the (1) users_id_assign parameter to ajax/ticketassigninformation.php, (2) filename parameter to front/document.form.php, or (3) table parameter to ajax/comments.php.
- http://www.glpi-project.org/spip.php?page=annonce&id_breve=297&lang=en&debut_autres_breves=
- http://www.glpi-project.org/spip.php?page=annonce&id_breve=297&lang=en&debut_autres_breves=
- 60693
- 60693
- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5146.php
- http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5146.php
Modified: 2024-11-21
CVE-2013-2227
GLPI 0.83.7 has Local File Inclusion in common.tabs.php.
- http://www.openwall.com/lists/oss-security/2013/06/30/10
- http://www.openwall.com/lists/oss-security/2013/06/30/10
- http://www.securityfocus.com/bid/60692
- http://www.securityfocus.com/bid/60692
- https://access.redhat.com/security/cve/cve-2013-2227
- https://access.redhat.com/security/cve/cve-2013-2227
- https://packetstormsecurity.com/files/122087/GLPI-0.83.7-Parameter-Traversal-Arbitrary-File-Access.html
- https://packetstormsecurity.com/files/122087/GLPI-0.83.7-Parameter-Traversal-Arbitrary-File-Access.html
- https://security-tracker.debian.org/tracker/CVE-2013-2227
- https://security-tracker.debian.org/tracker/CVE-2013-2227
Modified: 2024-11-21
CVE-2013-5696
inc/central.class.php in GLPI before 0.84.2 does not attempt to make install/install.php unavailable after an installation is completed, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and (1) perform a SQL injection via an Etape_4 action or (2) execute arbitrary PHP code via an update_1 action.
- http://www.glpi-project.org/spip.php?page=annonce&id_breve=308
- http://www.glpi-project.org/spip.php?page=annonce&id_breve=308
- https://forge.indepnet.net/issues/4480
- https://forge.indepnet.net/issues/4480
- https://forge.indepnet.net/projects/glpi/repository/revisions/21753
- https://forge.indepnet.net/projects/glpi/repository/revisions/21753
- https://forge.indepnet.net/projects/glpi/repository/revisions/21753/diff/branches/0.84-bugfixes/inc/central.class.php
- https://forge.indepnet.net/projects/glpi/repository/revisions/21753/diff/branches/0.84-bugfixes/inc/central.class.php
- https://www.navixia.com/blog/entry/navixia-finds-critical-vulnerabilities-in-glpi-cve-2013-5696.html
- https://www.navixia.com/blog/entry/navixia-finds-critical-vulnerabilities-in-glpi-cve-2013-5696.html
Closed bugs
Обновить до версии 0.83.91