deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-7250
Published: 2024-03-18
Description: A flaw was found in iperf, a utility for testing network performance using TCP, UDP, and SCTP. A malicious or malfunctioning client can send less than the expected amount of data to the iperf server, which can cause the server to hang indefinitely waiting for the remainder or until the connection gets closed. This will prevent other connections to the server, leading to a denial of service.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-183
References: https://access.redhat.com/errata/RHSA-2024:4241; https://access.redhat.com/errata/RHSA-2024:9185; https://access.redhat.com/security/cve/CVE-2023-7250
CVE: CVE-2024-28550
Published: 2024-03-18
Description: Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the filePath parameter of formExpandDlnaFile function.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC18/formExpandDlnaFile.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC18/formExpandDlnaFile.md
CVE: CVE-2024-2002
Published: 2024-03-18
Description: A double-free vulnerability was found in libdwarf. In a multiply-corrupted DWARF object, libdwarf may try to dealloc(free) an allocation twice, potentially causing unpredictable and various results.
CVSS Score: 7.5 (HIGH)
CWE: CWE-415
References: https://access.redhat.com/security/cve/CVE-2024-2002; https://bugzilla.redhat.com/show_bug.cgi?id=2267700; https://github.com/davea42/libdwarf-code/blob/main/bugxml/data.txt
CVE: CVE-2024-2496
Published: 2024-03-18
Description: A NULL pointer dereference flaw was found in the udevConnectListAllInterfaces() function in libvirt. This issue can occur when detaching a host interface while at the same time collecting the list of interfaces via virConnectListAllInterfaces API. This flaw could be used to perform a denial of service attack by causing the libvirt daemon to crash.
CVSS Score: 5.0 (MEDIUM)
CWE: CWE-476
References: https://access.redhat.com/errata/RHSA-2024:2236; https://access.redhat.com/security/cve/CVE-2024-2496; https://bugzilla.redhat.com/show_bug.cgi?id=2269672
CVE: CVE-2024-27767
Published: 2024-03-18
Description: 
CWE-287: Improper Authentication may allow Authentication Bypass


CVSS Score: 10.0 (CRITICAL)
CWE: CWE-287
References: https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0; https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0
CVE: CVE-2024-27768
Published: 2024-03-18
Description: 
Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-22: 'Path Traversal' may allow RCE


CVSS Score: 9.8 (CRITICAL)
CWE: CWE-22
References: https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered; https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0; https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered
CVE: CVE-2024-27769
Published: 2024-03-18
Description: 
Unitronics Unistream Unilogic – Versions prior to 1.35.227 - 

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor may allow Taking Ownership Over Devices


CVSS Score: 8.8 (HIGH)
CWE: CWE-200
References: https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered; https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0; https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered
CVE: CVE-2024-27770
Published: 2024-03-18
Description: 
Unitronics Unistream Unilogic – Versions prior to 1.35.227 - 

CWE-23: Relative Path Traversal


CVSS Score: 8.8 (HIGH)
CWE: CWE-23, CWE-22
References: https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered; https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0; https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered
CVE: CVE-2024-27771
Published: 2024-03-18
Description: 
Unitronics Unistream Unilogic – Versions prior to 1.35.227 -

CWE-22: 'Path Traversal' may allow RCE


CVSS Score: 8.8 (HIGH)
CWE: CWE-22
References: https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered; https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0; https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered
CVE: CVE-2024-27772
Published: 2024-03-18
Description: 
Unitronics Unistream Unilogic – Versions prior to 1.35.227 -

CWE-78: 'OS Command Injection' may allow RCE


CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered; https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0; https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered
CVE: CVE-2024-27773
Published: 2024-03-18
Description: 
Unitronics Unistream Unilogic – Versions prior to 1.35.227 -

CWE-348: Use of Less Trusted Source may allow RCE


CVSS Score: 8.8 (HIGH)
CWE: CWE-348, CWE-345
References: https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered; https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0; https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered
CVE: CVE-2024-27774
Published: 2024-03-18
Description: 
Unitronics Unistream Unilogic – Versions prior to 1.35.227 -

CWE-259: Use of Hard-coded Password may allow disclosing Sensitive Information Embedded inside Device's Firmware


CVSS Score: 7.5 (HIGH)
CWE: CWE-259, CWE-798
References: https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered; https://www.gov.il/en/departments/dynamiccollectors/cve_advisories_listing?skip=0; https://claroty.com/team82/blog/new-critical-vulnerabilities-in-unitronics-unistream-devices-uncovered
CVE: CVE-2024-28537
Published: 2024-03-18
Description: Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the page parameter of fromNatStaticSetting function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC18/fromNatStaticSetting.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC18/fromNatStaticSetting.md
CVE: CVE-2024-28547
Published: 2024-03-18
Description: Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the firewallEn parameter of formSetFirewallCfg function.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-121
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC18/formSetFirewallCfg.md; https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Tenda/AC18/formSetFirewallCfg.md
CVE: CVE-2024-2584
Published: 2024-03-18
Description: Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/book/main/select_send.php, in the 'sd_index' parameter. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB.
CVSS Score: 8.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss
CVE: CVE-2024-2585
Published: 2024-03-18
Description: Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/book/main/select_send_2.php, in the 'sd_index' parameter. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB.
CVSS Score: 8.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss
CVE: CVE-2024-2586
Published: 2024-03-18
Description: Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/index.php, in the 'username' parameter. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB.
CVSS Score: 8.2 (HIGH)
CWE: CWE-89, CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss
CVE: CVE-2024-2587
Published: 2024-03-18
Description: Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/book/main/bookdetail_khet_person.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB.
CVSS Score: 8.2 (HIGH)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss
CVE: CVE-2024-2588
Published: 2024-03-18
Description: Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/admin/index.php, in the 'id' parameter. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB.
CVSS Score: 8.2 (HIGH)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss
CVE: CVE-2024-2589
Published: 2024-03-18
Description: Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/book/main/bookdetail_school_person.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB.
CVSS Score: 8.2 (HIGH)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss
CVE: CVE-2024-2590
Published: 2024-03-18
Description: Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/mail/main/select_send.php, in the 'sd_index' parameter. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB.
CVSS Score: 8.2 (HIGH)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss
CVE: CVE-2024-2591
Published: 2024-03-18
Description: Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/book/main/bookdetail_group.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB.
CVSS Score: 8.2 (HIGH)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss
CVE: CVE-2024-2592
Published: 2024-03-18
Description: Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/person/pic_show.php, in the 'person_id' parameter. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB.
CVSS Score: 8.2 (HIGH)
CWE: CWE-89
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss
CVE: CVE-2024-2593
Published: 2024-03-18
Description: Vulnerability in AMSS++ version 4.31, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability through /amssplus/modules/book/main/bookdetail_group.php, in the 'b_id' parameter. This vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss
CVE: CVE-2024-2594
Published: 2024-03-18
Description: Vulnerability in AMSS++ version 4.31, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability through /amssplus/admin/index.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss
CVE: CVE-2024-2595
Published: 2024-03-18
Description: Vulnerability in AMSS++ version 4.31, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability through /amssplus/modules/book/main/bookdetail_khet_person.php, in the 'b_id' parameter. This vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss
CVE: CVE-2024-2596
Published: 2024-03-18
Description: Vulnerability in AMSS++ version 4.31, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability through /amssplus/modules/mail/main/select_send.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss
CVE: CVE-2024-2597
Published: 2024-03-18
Description: Vulnerability in AMSS++ version 4.31, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability through /amssplus/modules/book/main/bookdetail_school_person.php, in the 'b_id' parameter. This vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss
CVE: CVE-2024-2598
Published: 2024-03-18
Description: Vulnerability in AMSS++ version 4.31, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability through /amssplus/modules/book/main/select_send_2.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss
CVE: CVE-2024-2599
Published: 2024-03-18
Description: File upload restriction evasion vulnerability in AMSS++ version 4.31. This vulnerability could allow an authenticated user to potentially obtain RCE through webshell, compromising the entire infrastructure.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434
References: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss; https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-amssplus-amss
CVE: CVE-2024-1753
Published: 2024-03-18
Description: A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write access to the host filesystem, allowing for full container escape at build time.
CVSS Score: 8.6 (HIGH)
CWE: CWE-59
References: https://access.redhat.com/errata/RHSA-2024:2049; https://access.redhat.com/errata/RHSA-2024:2055; https://access.redhat.com/errata/RHSA-2024:2064
CVE: CVE-2024-20745
Published: 2024-03-18
Description: Premiere Pro versions 24.1, 23.6.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://helpx.adobe.com/security/products/premiere_pro/apsb24-12.html; https://helpx.adobe.com/security/products/premiere_pro/apsb24-12.html
CVE: CVE-2024-20746
Published: 2024-03-18
Description: Premiere Pro versions 24.1, 23.6.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/premiere_pro/apsb24-12.html; https://helpx.adobe.com/security/products/premiere_pro/apsb24-12.html
CVE: CVE-2024-22257
Published: 2024-03-18
Description: In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 
5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, 
versions 6.2.x prior to 6.2.3, an application is possible vulnerable to 
broken access control when it directly uses the AuthenticatedVoter#vote passing a null Authentication parameter.
CVSS Score: 8.2 (HIGH)
CWE: CWE-862
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://spring.io/security/cve-2024-22257; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-1331
Published: 2024-03-18
Description: The Team Members WordPress plugin before 5.3.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/b2bac900-3d8f-406c-b03d-c8db156acc59/; https://wpscan.com/vulnerability/b2bac900-3d8f-406c-b03d-c8db156acc59/
CVE: CVE-2024-1333
Published: 2024-03-18
Description: The Responsive Pricing Table WordPress plugin before 5.1.11 does not validate and escape some of its Pricing Table options before outputting them back in a page/post where the related shortcode is embed, which could allow users with the author role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/30546402-03b8-4e18-ad7e-04a6b556ffd7/; https://wpscan.com/vulnerability/30546402-03b8-4e18-ad7e-04a6b556ffd7/
CVE: CVE-2024-1658
Published: 2024-03-18
Description: The Grid Shortcodes WordPress plugin before 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/9489925e-5a47-4608-90a2-0139c5e1c43c/; https://wpscan.com/vulnerability/9489925e-5a47-4608-90a2-0139c5e1c43c/
CVE: CVE-2024-20752
Published: 2024-03-18
Description: Bridge versions 13.0.5, 14.0.1 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://helpx.adobe.com/security/products/bridge/apsb24-15.html; https://helpx.adobe.com/security/products/bridge/apsb24-15.html
CVE: CVE-2024-20755
Published: 2024-03-18
Description: Bridge versions 13.0.5, 14.0.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-122, CWE-787
References: https://helpx.adobe.com/security/products/bridge/apsb24-15.html; https://helpx.adobe.com/security/products/bridge/apsb24-15.html
CVE: CVE-2024-20756
Published: 2024-03-18
Description: Bridge versions 13.0.5, 14.0.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://helpx.adobe.com/security/products/bridge/apsb24-15.html; https://helpx.adobe.com/security/products/bridge/apsb24-15.html
CVE: CVE-2024-20757
Published: 2024-03-18
Description: Bridge versions 13.0.5, 14.0.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://helpx.adobe.com/security/products/bridge/apsb24-15.html; https://helpx.adobe.com/security/products/bridge/apsb24-15.html
CVE: CVE-2024-27930
Published: 2024-03-18
Description: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can access sensitive fields data from items on which he has read access. This issue has been patched in version 10.0.13.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-285
References: https://borelenzo.github.io/stuff/2024/02/29/glpi-pwned.html; https://github.com/glpi-project/glpi/commit/1942b70b2422fff51822f6eb3af500c94760871e; https://github.com/glpi-project/glpi/releases/tag/10.0.13
CVE: CVE-2024-27937
Published: 2024-03-18
Description: GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An authenticated user can obtain the email address of all GLPI users. This issue has been patched in version 10.0.13.

CVSS Score: 6.5 (MEDIUM)
CWE: CWE-285
References: https://borelenzo.github.io/stuff/2024/02/29/glpi-pwned.html; https://github.com/glpi-project/glpi/commit/d02c537d23cbb729fe18b87f71b3c6e84e9892da; https://github.com/glpi-project/glpi/releases/tag/10.0.13