Alemmi

**Name of the Vulnerable Software and Affected Versions** Icinga Web 2 versions prior to 2.11.5 Icinga Web 2 versions prior to 2.12.13 **Description** A vulnerability in Icinga Web 2 allows an attacker to craft a URL that, once visited by any user, enables the embedding of arbitrary Javascript into Icinga Web and allows the attacker to act on behalf of that user. **Recommendations** For versions prior to 2.11.5, update to version 2.11.5 or later. For versions prior to 2.12.13, update to version 2.12.3 or later. As a temporary workaround for version 2.12.2, enable a content security policy in the application settings.

**Name of the Vulnerable Software and Affected Versions** GLPI Agent versions prior to 1.5 **Description** The issue affects the GLPI Agent, a generic management agent, when running the remoteinventory task against a Unix platform using the ssh command. An administrator user on the remote system can inject a command into a specific workflow that the agent runs with its privileges. If the agent is running with administration privileges, a malicious user could gain high privileges on the computer running the GLPI Agent. Additionally, a malicious user could disclose all remote accesses configured for the remoteinventory task. **Recommendations** For versions prior to 1.5, update to version 1.5 to resolve the issue. As a temporary workaround, consider restricting the privileges of the GLPI Agent when running the remoteinventory task to minimize the risk of exploitation. Restrict access to the remoteinventory task to trusted users only.

**Name of the Vulnerable Software and Affected Versions** GLPI versions 0.85 through 9.5.12 GLPI versions 10.0.0 through 10.0.6 **Description** The issue is related to insufficient user data sanitization on search pages, allowing an attacker to craft a malicious link that can exploit a reflected XSS when opened by an authenticated user. This can lead to the execution of arbitrary HTML and script code in the user's browser, potentially allowing a remote attacker to steal confidential information, modify the webpage's appearance, or conduct phishing and drive-by download attacks. **Recommendations** For GLPI versions 0.85 through 9.5.12, update to version 9.5.13 or later. For GLPI versions 10.0.0 through 10.0.6, update to version 10.0.7 or later.

**Name of the Vulnerable Software and Affected Versions** GLPI versions 10.0.0 through 10.0.6 **Description** The issue is related to insufficient cleaning of user data in the GLPI inventory endpoint, allowing an unauthenticated user to send a specially crafted request to the vulnerable application and execute arbitrary SQL commands in the application's database. This can enable a remote attacker to read, delete, or modify data in the database and gain full control over the vulnerable application. The GLPI inventory endpoint requires no authentication by default. **Recommendations** For GLPI versions 10.0.0 through 10.0.6, update to version 10.0.7 to resolve the issue. As a temporary workaround, consider disabling the native inventory endpoint until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** HedgeDoc versions prior to 1.7.1 **Description** The issue allows an attacker to inject arbitrary `script` tags in HedgeDoc notes using mermaid diagrams. Although the content security policy prevents loading scripts from most locations, `www.google-analytics.com` is allowed, which can be exploited using Google Tag Manager to inject arbitrary JavaScript and execute it on page load. Depending on the instance configuration, the attacker may not need authentication to create or edit notes. **Recommendations** For HedgeDoc versions prior to 1.7.1, update to version 1.7.1 to resolve the issue. As a temporary workaround, consider disallowing `www.google-analytics.com` in the `Content-Security-Policy` header to minimize the risk of exploitation.