Glpi-Project GLPI

• CVE-2021-39213 Medium 6.8 IP restriction on GLPI API Bypass with custom header injection 1.0%
• CVE-2021-39211 Medium 5.3 Disclosure of GLPI and server information in telemetry endpoint 4.5%
• CVE-2021-39210 Medium 6.5 Autologin cookie accessible by scripts 1.0%
• CVE-2021-39209 High 8.8 Bypassable CSRF protection 0.5%
• CVE-2021-21324 Medium 6.8 Insecure Direct Object Reference (IDOR) on "Solutions" 1.4%
• CVE-2021-21325 Medium 6.2 Stored XSS in budget type 0.6%
• CVE-2021-21326 High 7.7 Horizontal Privilege Escalation 1.4%
• CVE-2021-21327 Medium 6.8 Unsafe Reflection in getItemForItemtype() 2.5%
• CVE-2021-21314 Medium 5.4 XSS injection on ticket update 0.6%
• CVE-2021-21312 Medium 5.4 Stored XSS on documents 0.6%
• CVE-2021-21313 Medium 4.9 XSS on tabs 0.9%
• CVE-2021-21258 Medium 6.8 XSS injection in ajax/kanban 0.6%
• CVE-2021-21255 Medium 5.8 entities switch IDOR 0.9%
• CVE-2020-26212 High 7.7 Any GLPI CalDAV calendars is read-only for every authenticated user 1.2%
• CVE-2020-15226 Medium 5.0 SQL Injection in GLPI Search API 1.0%
• CVE-2020-15217 Medium 5.3 User data exposure in GLPI 1.0%
• CVE-2020-15177 High 8.0 Unauthenticated Stored XSS in GLPI 0.8%
• CVE-2020-15176 High 8.7 SQL injection in GLPI 1.1%
• CVE-2020-15175 High 7.4 Unauthenticated File Deletion in GLPI 69.9%
• CVE-2020-11031 High 7.8 Insecure encryption algorithm in GLPI 0.3%
• CVE-2020-15108 High 7.1 SQL Injection in glpi 1.2%
• CVE-2020-11060 High 7.4 Remote Code Execution in GLPI 10.7%
• CVE-2020-5248 High 7.2 Public GLPIKEY can be used to decrypt any data in GLPI 1.5%
• CVE-2020-11036 High 7.6 XSS in GLPI 0.8%
• CVE-2020-11035 High 7.5 weak CSRF tokens in GLPI 0.9%
• CVE-2020-11034 Medium 6.1 bypass of manageRedirect in GLPI 7.6%
• CVE-2020-11033 Medium 6.6 Able to read any token through API user endpoint in GLPI 1.0%
• CVE-2020-11032 High 7.6 SQL injection on addme_observer and addme_assign in GLPI 1.0%