Date: Mon, 29 Jul 2024 06:17:21 GMT From: Zsolt Udvari <uzsolt@FreeBSD.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org Subject: git: ce3e9bc7ca66 - main - security/vuxml: document glpi vulnerability Message-ID: <202407290617.46T6HLBG049804@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by uzsolt: URL: https://cgit.FreeBSD.org/ports/commit/?id=ce3e9bc7ca66471f27b1745ee0306964b4cfcbd4 commit ce3e9bc7ca66471f27b1745ee0306964b4cfcbd4 Author: Mathias Monnerville <mathias@monnerville.com> AuthorDate: 2024-07-29 06:15:12 +0000 Commit: Zsolt Udvari <uzsolt@FreeBSD.org> CommitDate: 2024-07-29 06:15:12 +0000 security/vuxml: document glpi vulnerability PR: 280313 --- security/vuxml/vuln/2024.xml | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) diff --git a/security/vuxml/vuln/2024.xml b/security/vuxml/vuln/2024.xml index 0435a88a113b..16e327cfeb9a 100644 --- a/security/vuxml/vuln/2024.xml +++ b/security/vuxml/vuln/2024.xml @@ -210,6 +210,42 @@ </dates> </vuln> + <vuln vid="6091d1d8-4347-11ef-a4d4-080027957747"> + <topic>GLPI -- multiple vulnerabilities</topic> + <affects> + <package> + <name>glpi</name> + <range><lt>10.0.16,1</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>GLPI team reports:</p> + <blockquote cite="https://github.com/glpi-project/glpi/releases/tag/10.0.16">; + <p>GLPI 10.0.16 Changelog</p> + <ul> + <li>[SECURITY - high] Account takeover via SQL Injection in AJAX scripts (CVE-2024-37148)</li> + <li>[SECURITY - high] Remote code execution through the plugin loader (CVE-2024-37149)</li> + <li>[SECURITY - moderate] Authenticated file upload to restricted tickets (CVE-2024-37147)</li> + </ul> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2024-37148</cvename> + <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37148</url>; + <cvename>CVE-2024-37149</cvename> + <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37149</url>; + <cvename>CVE-2024-37147</cvename> + <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37147</url>; + <url>https://github.com/glpi-project/glpi/releases/tag/10.0.16</url>; + </references> + <dates> + <discovery>2024-06-03</discovery> + <entry>2024-07-16</entry> + </dates> + </vuln> + <vuln vid="6410f91d-1214-4f92-b7e0-852e39e265f9"> <topic>electron30 -- multiple vulnerabilities</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202407290617.46T6HLBG049804>