Group :: Rede/Outros
RPM: glpi
Navegação
Main Changelog Spec Patches Sources Download Gear Bugs e FR Repocop
13 julho 2023 Pavel Zilke <zidex at altlinux.org> 10.0.9-alt1
- New version 10.0.9
- This release fixes several security issues that has been recently discovered. Update is recommended!
- Security fixes:
+ CVE-2023-37278 : SQL injection in dashboard administration - Deleted glpi-php7
- New version 10.0.8
- This release fixes several security issues that has been recently discovered. Update is recommended!
- Security fixes:
+ CVE-2023-35924 : SQL injection via inventory agent request
+ CVE-2023-36808 : SQL injection through Computer Virtual Machine information
+ CVE-2023-35939 : Unauthorized access to Dashboard data
+ CVE-2023-35940 : Unauthenticated access to Dashboard data
+ CVE-2023-34244 : Reflected XSS in search pages
+ CVE-2023-34107 : Unauthorized access to knowledge base items
+ CVE-2023-34106 : Unauthorized access to user data
- New version 10.0.7
- This release fixes several security issues that has been recently discovered. Update is recommended!
- Security fixes:
+ CVE-2023-28849 : SQL injection and Stored XSS via inventory agent request
+ CVE-2023-28632 : Account takeover by authenticated user
+ CVE-2023-28838 : SQL injection through dynamic reports
+ CVE-2023-28852 : Stored XSS through dashboard administration
+ CVE-2023-28636 : Stored XSS on external links
+ CVE-2023-28639 : Reflected XSS in search pages
+ CVE-2023-28634 : Privilege Escalation from technician to super-admin
+ CVE-2023-28633 : Blind Server-Side Request Forgery (SSRF) in RSS feeds
- New version 10.0.6
- This release fixes several security issues that has been recently discovered. Update is recommended!
- Security fixes:
+ CVE-2023-22500 : Unauthorized access to inventory files
+ CVE-2023-22722 : XSS on browse views
+ CVE-2023-22725 : XSS on external links
+ CVE-2023-22724 : XSS in RSS Description Link
+ CVE-2023-23610 : Unauthorized access to data export
+ CVE-2022-41941 : Stored XSS inside Standard Interface Help Link href attribute - Added glpi-php8.2
- New version 10.0.5
- This release fixes several security issues that has been recently discovered. Update is recommended!
- Security fixes:
+ CVE-2022-39276 : Blind SSRF in RSS feeds and planning
+ CVE-2022-39372 : Stored XSS in user information
+ CVE-2022-39373 : Stored XSS in entity name
+ CVE-2022-39376 : Improper input validation on emails links
+ CVE-2022-39370 : Improper access to debug panel
+ CVE-2022-39234 : User's session persist after permanently deleting his account
+ CVE-2022-39262 : Stored XSS on login page
+ CVE-2022-39277 : XSS in external links
+ CVE-2022-39375 : XSS through public RSS feed
+ CVE-2022-39323 : SQL Injection on REST API
+ CVE-2022-39371 : Stored XSS through asset inventory
- New version 10.0.3
- This release fixes several critical security issues that has been recently discovered. Update is strongly recommended!
- Security fixes:
+ CVE-2022-35945 : XSS through registration API
+ CVE-2022-31143 : Leak of sensitive information through login page error
+ CVE-2022-31187 : Stored XSS through global search (CVE-2022-31187)
+ CVE-2022-35914 : [critical] Command injection using a third-party library script
+ CVE-2022-35946 : SQL injection through plugin controller
+ CVE-2022-35947 : [critical] Authentication via SQL injection
+ CVE-2022-36112 : Blind Server-Side Request Forgery (SSRF) in RSS feeds and planning
- New version 10.0.2
- This is a security release, upgrading is recommended
- Security fixes:
+ CVE-2022-31061 : Unauthenticated SQL injection on login page
+ CVE-2022-31056 : SQL injection on actor part in assistance forms
+ CVE-2022-31068 : Unauthenticated Sensitive Data Exposure on Refused Inventory Files
- New version 10.0.1
- This is a security release, upgrading is recommended
- The GLPI licence has been moved to GPLv3+
- New version 10.0.0
- Added glpi-php8.0
- Added glpi-php8.1
- New version 9.5.7
- This is a security release, upgrading is recommended
- Security fixes:
+ CVE-2022-21720 : SQL injection using custom CSS administration form
+ CVE-2022-21719 : Reflected XSS using reload button
- New version 9.5.6
- This is a security release, upgrading is recommended
- Security fixes:
+ CVE-2021-39211 : Disclosure of GLPI and server informations in telemetry endpoint
+ CVE-2021-39210 : Autologin cookie accessible by scripts
+ CVE-2021-39209 : Bypassable CSRF protection on ajax endpoints
+ CVE-2021-39213 : Bypassable IP restriction on GLPI API using custom header injection
- New version 9.5.5
- This is a security release, upgrading is recommended
- Security fixes:
+ CVE-2021-3486 : Stored XSS in plugins information
- New version 9.5.4
- This is a security release, upgrading is recommended
- Security fixes:
+ CVE-2021-21326 : Horizontal Privilege Escalation
+ CVE-2021-21255 : entities switch IDOR
+ CVE-2021-21258 : XSS injection in ajax/kanban
+ CVE-2021-21314 : XSS injection on ticket update
+ CVE-2021-21312 : Stored XSS on documents
+ CVE-2021-21313 : XSS on tabs
+ CVE-2021-21325 : Stored XSS in budget type
+ CVE-2021-21327 : Unsafe Reflection in getItemForItemtype()
+ CVE-2021-21324 : Insecure Direct Object Reference (IDOR) on "Solutions"
- New version 9.5.3
- This is a security release, upgrading is recommended
- Security fixes:
+ CVE-2020-27662 : Insecure Direct Object Reference on ajax/comments.php
+ CVE-2020-27663 : Insecure Direct Object Reference on ajax/getDropdownValue.php
+ CVE-2020-26212 : Any CalDAV calendars is read-only for every authenticated user
- Changed PHP7 dependencies
- Fixed spec
- New version 9.5.2
- Security fixes:
+ CVE-2020-15176 : SQL injection with a query parameter of user form
+ CVE-2020-15175 : Removal of .htaccess file in the files folder via a plugin endpoint
+ CVE-2020-15217 : Leakage issue with knowledge base
+ CVE-2020-15177 : Stored XSS in install script
+ CVE-2020-15226 : Minor SQL Injection in Search API
- New version 9.5.1
- New version 9.4.6
- This is a security release, upgrading is highly recommended
- New version 9.4.5
- New version 9.4.4
- This is a security release, upgrading is highly recommended
- New version 9.4.3
- This is a security release, upgrading is highly recommended
- New version 9.4.2
- This is a security release, upgrading is highly recommended
- New version 9.4.1
- Deleted glpi-php5
- New version 9.4.0
- Fixed glpi-apache2 postun
- New verion 9.3.3
- PHP7 support
- Delete glpi-apache
- New version 9.1.6
- New version 9.1.3
- New version 9.1.2
- New version 9.1
- Conf for Apache2 moved to sites-available
- New version 0.90.5
- Include bugfixes and some minor features
- New version 0.90
- This is maintenance release to fix several minor bugs.
- This version correct several minor bugs.
- This version fix several minor bugs and a security bug
- This version correct several minor bugs.
- This version fix several minor bugs and a security bug
- New version 0.85
- This version fix several minor bugs and a security bug.
- New version 0.84.5 This version correct several minor bugs.
- New version 0.84.5 This version correct several minor bugs.
- New version 0.84.4 This version correct several minor bugs.
- New version 0.84.3
- Security fixes:
+ CVE-2013-5696 : SQL Injection, PHP Code Execution, CSRF
- New version 0.84.1
- New version 0.84
- Security fixes:
+ CVE-2013-2225 + CVE-2013-2227 : Security fix ( serialize + filter classname for autoload) (ALT #29189)
- New version 0.83.8
- New version 0.83.7
- New version 0.83.6
- New version 0.83.4
- New version 0.83.2
- New version 0.83.1
- New version 0.83
- New version 0.80.7
- New version 0.80.61
- New version 0.80.5
- New version 0.80.4
- New version 0.80.1 This version correct several bugs.
- New version 0.80
- New version 0.78.3
- New version 0.78.2
- New version 0.78.1
- New version 0.78
- New version 0.72.4
- remove Thumbs.db files
- New version 0.72.3
- spec bugfix
- New version 0.72.21
- fixed export to pdf
- fixed import from OCS Inventory NG
- New version 0.72.1-alt1
- Fixed README.ALT location
- New version 0.71.6-alt1
- First build for ALT Linux