CVE Vulnerability Catalog

GLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated technician can store active markup in supplier website fields. Any user who opens the affected item's suppliers list triggers the stored cross-site scripting payload. This issue is fixed in version 11.0.8.

GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the history tab that injects attacker-controlled values into a database query. This permits SQL injection through the history tab endpoint. This issue is fixed in versions 11.0.8 and 10.0.26.

GLPI is a free asset and IT management software package. From 11.0.5 until 11.0.8, under certain conditions, permission logic can grant access to a document without confirming that the document is linked to the targeted item. A user can use an unrelated item that the user is permitted to view to read a document linked to an inaccessible item. This issue is fixed in version 11.0.8.

In GLPI, a technician can manipulate the authtype value through the API to change another user's authentication method. Under configurations using the legacy REST API interface or SSO logins, this can change a super-administrator's authentication method and enable account takeover. The issue is fixed in versions 11.0.8 and 10.0.26.

In GLPI, an attacker can craft a URL for a dashboard that reflects attacker-controlled markup without sufficient output encoding. A user who opens the crafted URL triggers reflected cross-site scripting in the dashboard. The issue is fixed in version 11.0.8.

In GLPI, the time-based one-time password verification endpoint does not limit failed submissions per user. An attacker who has obtained a user's primary authentication credentials can repeatedly submit TOTP values against the MFA verification flow, making brute-force compromise of the second factor and subsequent account takeover possible. The issue is fixed in version 11.0.8.

In GLPI, any logged-in user can exploit insufficient path validation in the profile-picture update flow to request deletion of an attacker-selected file hosted by the server. The issue is fixed in versions 11.0.8 and 10.0.26.

A flaw was found in the CloudClassroom-PHP-Project in an unknown function of the file updatefaculty.php. Manipulation of the fid argument leads to SQL injection. The attack can be initiated remotely and the exploit has been publicly disclosed.

A security vulnerability was detected in the CloudClassroom-PHP-Project in an unknown function of the file updatequery.php. Manipulation of the gid argument leads to SQL injection. The attack can be initiated remotely and the exploit has been publicly disclosed.

A weakness was identified in the CloudClassroom-PHP-Project in an unknown function of the file loginlinkfaculty.php of the Faculty Authentication component. Manipulation of the fid/pass arguments leads to SQL injection. The attack can be initiated remotely and the exploit has been publicly disclosed.

A flaw was found in NetworkManager-vpnc, a VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by injecting a newline character into the CA-File path. This manipulation allows the user to execute arbitrary commands as the root user, leading to local privilege escalation.

A flaw was found in NetworkManager-vpnc. This vulnerability allows a local unprivileged user to escalate privileges to root. By injecting a newline character into the VPN username field, an attacker can manipulate the vpnc configuration to execute an arbitrary program with root privileges when the malicious VPN connection is activated.

A flaw was found in NetworkManager-fortisslvpn, the FortiSSLVPN plugin for NetworkManager. The nm-fortisslvpn-service improperly handles carriage-return/line-feed (CR/LF) characters in VPN connection profile credentials. A local unprivileged user can exploit this by crafting a malicious VPN profile to inject additional configuration directives. This can lead to arbitrary code execution with root privileges when the crafted VPN connection is activated.

A vulnerability in NetworkManager-sstp allows a local unprivileged user to embed special characters (shell metacharacters) into VPN profile fields such as CA certificate or proxy settings. These unescaped characters are processed by the pppd daemon running with root privileges, enabling arbitrary command execution with elevated permissions when a malicious VPN connection is activated.

In Zammad prior to 7.1.2, a security filter protecting the AI Agent configuration can be bypassed by entering specially crafted text into one of an AI Agent's fields. An administrator with permission to create or edit AI Agents could exploit this to run arbitrary commands on the server hosting Zammad, potentially reading, modifying, or destroying all data stored on that server. No interaction from other users is needed; the malicious code runs automatically the next time the affected AI Agent processes a ticket. This issue is fixed in version 7.1.2.

In Zammad versions 7.0.2 and 7.1.0, session management for websocket and long-polling connections is susceptible to a path traversal attack. Session identifiers supplied by the client are insufficiently validated before being used to construct internal file paths. When the file-based session store is active (the default configuration), an authenticated attacker can manipulate the session identifier to reference locations outside the intended storage directory, leading to the deletion of arbitrary files and directories on the server. Exploitation requires only a low-privilege authenticated session and a single crafted request. Instances configured to use the Redis-based session store are not affected. This issue is fixed in versions 7.0.3 and 7.1.1.

In Zammad prior to versions 7.0.2 and 7.1.0, there is a lack of validation within the authorization cascade. Under specific conditions, the granular restrictions of the access key are overridden by the latent authorization authority of the parent account, nullifying the intended separation of functional areas and resulting in uncontrolled expansion of administrative discretion. An attacker can create new administrator accounts despite token restrictions, gaining full access to all system data (tickets, customers, configuration) and complete control of the Zammad instance. This issue is fixed in versions 7.0.2 and 7.1.0.

In Zammad prior to version 7.0.1, a low-privilege authenticated user may inject arbitrary HTML markup, including JavaScript event handlers, into a ticket title via the standard ticket creation workflow. The title is persisted without sanitization. This issue is fixed in version 7.0.1.

In Zammad prior to version 7.0.2, in inbound PGP email processing, the return value of the gpg verification call was silently discarded. Regardless of whether gpg reported a valid, invalid, or missing signature, the handler unconditionally wrote sign: { success: true, comment: "Good signature" } to the article's security preferences. Any sender could tamper with the body of a multipart/signed PGP email, or craft a message with an entirely fabricated or mismatched signature, and Zammad would display it to the recipient as cryptographically verified with a "Good signature" label. Users and agents relying on Zammad's signature indicator to confirm message authenticity and integrity would be misled into trusting modified or forged content. The vulnerability affects all inbound PGP-signed emails processed while the PGP integration is enabled. This issue is fixed in version 7.0.2.

In Zammad prior to version 7.0.2, an unauthenticated request to POST /api/v1/import/otrs/import_check blocks a Zammad request worker for roughly two minutes. The import_check and import_status actions are missing the setup_done_response guard that other actions in the same controller carry, so they execute on fully set-up production instances. The action enters a retry loop against a blank OTRS endpoint, sleeping for 30 s + 45 s between attempts. An unauthenticated remote attacker denies service to a production Zammad instance. Each request costs almost nothing and forces ~115 seconds of server-side blocking. A few requests per second saturate the Puma worker pool. This issue is fixed in version 7.0.2.