FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2025-01-25 14:24:43 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
d3f60db0-3aea-11eb-af2a-080027dbe4b7glpi -- Account takeover vulnerability

MITRE Corporation reports:

GLPI through 9.4.3 is prone to account takeover by abusing the ajax/autocompletion.php autocompletion feature. The lack of correct validation leads to recovery of the token generated via the password reset functionality, and thus an authenticated attacker can set an arbitrary password for any user. This vulnerability can be exploited to take control of admin account. This vulnerability could be also abused to obtain other sensitive fields like API keys or password hashes.


Discovery 2019-08-05
Entry 2019-08-05
Modified 2024-04-25
glpi
< 9.4.4,1

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14666
https://github.com/glpi-project/glpi/security/advisories/GHSA-47hq-pfrr-jh5q
https://www.tarlogic.com/advisories/Tarlogic-2019-GPLI-Account-Takeover.txt
CVE-2019-14666