Search CVE reports
1 – 10 of 24 results
A stored Cross-Site Scripting (XSS) vulnerability in the notification template functionality of the endpoint /ocsreports/?function=notification. A user with administrator privileges can input malicious HTML content which is...
1 affected package
ocsinventory-server
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| ocsinventory-server | Not in release | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
Server-Side Request Forgery (SSRF) vulnerability in the /ocsreports/?function=tele_activate endpoint due to insufficient validation of the HTTPS_SERV and FILE_SERV parameters. An authenticated user with operator privileges can...
1 affected package
ocsinventory-server
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| ocsinventory-server | Not in release | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admin_double due to improper processing of the values in the ID field included in the selected_grp_dupli[] parameter. An authenticated user with operator...
1 affected package
ocsinventory-server
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| ocsinventory-server | Not in release | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
SQL injection vulnerability in the del_check parameter of the /ocsreports/?function=save_query_list endpoint. Input provided by an authenticated user with operator privileges is incorporated into an SQL query without proper...
1 affected package
ocsinventory-server
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| ocsinventory-server | Not in release | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admin_info endpoint. The application validates files solely based on the name provided by the client, without properly checking their...
1 affected package
ocsinventory-server
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| ocsinventory-server | Not in release | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
OCS Inventory NG Server version 2.12.3 and prior contain a stored cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript by submitting malicious User-Agent HTTP headers to the...
1 affected package
ocsinventory-server
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| ocsinventory-server | Not in release | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
OCSInventory allow stored email template with special characters that lead to a Stored cross-site Scripting.
1 affected package
ocsinventory-server
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| ocsinventory-server | Not in release | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
Some fixes available 4 of 5
phpCAS is an authentication library that allows PHP applications to easily authenticate users via a Central Authentication Service (CAS) server. The phpCAS library uses HTTP headers to determine the service URL used to validate...
3 affected packages
moodle, ocsinventory-server, php-cas
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| moodle | — | Not in release | Not in release | Not in release | Ignored |
| ocsinventory-server | — | Not affected | Fixed | Not affected | Not affected |
| php-cas | — | Not affected | Fixed | Fixed | Ignored |
OCS Inventory NG 2.7 allows Remote Command Execution via shell metacharacters to require/commandLine/CommandLine.php because mib_file in plugins/main_sections/ms_config/ms_snmp_config.php is mishandled in get_mib_oid.
1 affected package
ocsinventory-server
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| ocsinventory-server | Not in release | Needs evaluation | Needs evaluation | Needs evaluation | Needs evaluation |
Unrestricted file upload (with remote code execution) in OCS Inventory NG ocsreports allows a privileged user to gain access to the server via crafted HTTP requests.
1 affected package
ocsinventory-server
| Package | 26.04 LTS | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS |
|---|---|---|---|---|---|
| ocsinventory-server | Not in release | Vulnerable | Vulnerable | Vulnerable | Vulnerable |