Vulnerabilities > Glpi Project > Glpi > 9.4.1.1

DATE CVE VULNERABILITY TITLE RISK
2020-05-05 CVE-2020-11033 Information Exposure vulnerability in multiple products
In GLPI from version 9.1 and before version 9.4.6, any API user with READ right on User itemtype will have access to full list of users when querying apirest.php/User.
network
low complexity
glpi-project fedoraproject CWE-200
7.2
7.2
2019-09-25 CVE-2019-14666 Information Exposure vulnerability in Glpi-Project Glpi
GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature.
network
low complexity
glpi-project CWE-200
8.8
8.8
2019-07-04 CVE-2019-13239 Cross-site Scripting vulnerability in Glpi-Project Glpi
inc/user.class.php in GLPI before 9.4.3 allows XSS via a user picture.
network
low complexity
glpi-project CWE-79
6.1
6.1