Trasher

Galette هو تطبيق ويب لإدارة الأعضاء مخصص للمنظمات غير الربحية. قبل الإصدار 1.2.0، كان من الممكن الحصول على امتيازات أعلى عن طريق تحديث حساب موجود باستخدام طلب POST مزور من قبل المهاجم نفسه. تم حل هذه المشكلة في الإصدار 1.2.0. يقبل التطبيق طلبات POST لتحديث معلومات الحساب، وقد سمح التحقق غير الكافي من صحة بيانات الطلب للمهاجم بالتلاعب بامتيازات الحساب. تتضمن العملية المعرضة للخطر إرسال طلب POST مصمم خصيصًا لتعديل تفاصيل الحساب، مما قد يؤدي إلى رفع مستوى دور المستخدم داخل النظام.

اسم البرنامج المعرض للخطر والإصدارات المتأثرة: إصدارات المكون الإضافي Escalade لـ GLPI الأقدم من 2.9.11 الوصف: تتعلق المشكلة بوجود ضوابط وصول غير ملائمة، مما قد يؤدي إلى تسرب البيانات وتعطيل سير العمل. التوصيات: بالنسبة للإصدارات الأقدم من 2.9.11، قم بالتحديث إلى الإصدار 2.9.11 لحل المشكلة.

The issue is related to the incorrect neutralization of input data during web page generation, which can be exploited by a remote attacker to create a malicious external link. This can allow an administrator to create harmful links.

The issue concerns cross-site scripting via malicious RSS feeds. An administrator can import a malicious RSS feed containing Cross Site Scripting (XSS) payloads inside RSS links. When victims visit the RSS content and click on the link, they will execute the Javascript.

The issue is related to the GLPI update script, which allows connected users to gain access to the debug panel. This could potentially allow a remote attacker to impact the system's integrity. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

The issue is related to the lack of proper sanitization of external links, which can be used for a Cross-Site Scripting (XSS) attack. This allows a remote attacker to exploit the vulnerability.

The issue allows authenticated users to store malicious code in their account information, potentially leading to a cross-site scripting (XSS) attack. This could enable a remote attacker to conduct such an attack by exploiting the lack of protection measures for the web page structure.

The issue is related to the usage of RSS feeds or an external calendar in planning, which is subject to a Server-Side Request Forgery (SSRF) exploit. If a remote script returns a redirect response, the redirect target URL is not checked against the URL allow list defined by the administrator. This could allow a remote attacker to redirect users to an arbitrary URL.

The issue allows an administrator to store malicious code in an entity name. This can potentially lead to security breaches. The estimated number of potentially affected devices is not specified.

The issue is related to a SQL injection attack that could allow an attacker to simulate an arbitrary user login. This is due to the lack of protection measures for the SQL query structure. The vulnerability can be exploited remotely, potentially allowing an attacker to scan server ports or services and conduct SQL injection attacks.

The issue concerns the exposure of private information defined in the setup of GLPI, such as smtp or cas hosts, to unauthorized individuals. This exposure can be exploited remotely, allowing attackers to disclose confidential data. Note that passwords are not exposed.

The issue is related to the usage of RSS feeds or external calendar in planning, which is subject to Server-Side Request Forgery (SSRF) exploit. This allows an attacker to scan server ports or services opened on the GLPI server or its private network. The queries' responses are not exposed to the end-user, making it a blind SSRF.

The issue is related to the improper escaping of information associated with the registration key on the registration key configuration page in GLPI, a Free Asset and IT Management Software package. This can be exploited to steal a GLPI administrator cookie, allowing an attacker to gain unauthorized access. There are no known workarounds for this issue.

The issue affects GLPI instances with the native inventory used, potentially leaking sensitive information due to a lack of authentication in the feature to get refused files.

The issue affects all assistance forms, including Ticket, Change, and Problem, allowing sql injection on the actor fields. This has been resolved in version 10.0.2.

The issue allows an attacker to add extra information by SQL injection on search pages. This can be exploited if a user is logged in.

The issue is related to a cross-site scripting vulnerability in the Kanban view of GLPI, which can be exploited by injecting HTML code in a user's name. Users are advised to upgrade to a newer version to resolve the issue.

The issue is related to a lack of sanitization on SVG file uploads, allowing an attacker to inject javascript into a user's avatar. This can lead to a cross-site scripting attack when any user views the avatar. The estimated number of potentially affected devices is not specified. There is no information about real-world incidents where this issue was exploited. The vulnerability can be exploited by uploading a specially crafted SVG file, which allows the attacker to conduct a cross-site scripting attack. Technical details about exploitation include the lack of sanitization on `SVG file uploads` and the ability to inject `javascript` into the `user avatar`.

The issue is related to an error in the configuration transfer to javascript in the GLPI system, where some entries are filtered out, but the `ldap pass` variable is not. This allows a remote attacker to gain unauthorized access to the root dn password. GLPI is a free asset and IT management software package that provides ITIL Service Desk features, licenses tracking, and software auditing.

The issue is related to reflected cross-site scripting in GLPI, a free asset and IT management software package. This can allow a remote attacker to perform cross-site scripting attacks by exploiting the lack of protection measures for the web page structure. There are no known workarounds for this issue.