Skip to content
OpenAdvisories

Archive

7 October 2020

Vulnerabilities first published on this day (UTC), newest first.

← September 2020 2020 / October /7 November 2020 →
  1. 147
  2. 273
  3. 3 
  4. 41
  5. 523
  6. 672
  7. 728
  8. 855
  9. 941
  10. 106
  11. 11 
  12. 1260
  13. 1323
  14. 1452
  15. 1552
  16. 16201
  17. 171
  18. 181
  19. 1998
  20. 2049
  21. 21245
  22. 2299
  23. 2328
  24. 24 
  25. 251
  26. 2626
  27. 27173
  28. 2859
  29. 2954
  30. 3026
  31. 3114
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.0
    CVE-2020-15177

    Unauthenticated Stored XSS in GLPI

    In GLPI before version 9.5.2, the `install/install.php` endpoint insecurely stores user input into the database as `url_base` and `url_base_api`. These settings are referenced throughout the application and allow for vulnerabilities like Cross-Site Scripting …

    GLPI glpi glpi Ubuntu
  • High 8.7
    CVE-2020-15176

    SQL injection in GLPI

    In GLPI before version 9.5.2, when supplying a back tick in input that gets put into a SQL query,the application does not escape or sanitize allowing for SQL Injection to occur. Leveraging this vulnerability an attacker is able to exfiltrate sensitive informa…

    GLPI glpi
  • High 7.4
    CVE-2020-15175 Public exploit EPSS 70%

    Unauthenticated File Deletion in GLPI

    In GLPI before version 9.5.2, the `​pluginimage.send.php​` endpoint allows a user to specify an image from a plugin. The parameters can be maliciously crafted to instead delete the .htaccess file for the files directory. Any user becomes able to read all the …

    GLPI glpi glpi Ubuntu
  • High 7.5
    CVE-2020-7742

    Prototype Pollution

    This affects the package simpl-schema before 1.10.2.

    simpl-schema npm