Edr4Analyst

**Name of the Vulnerable Software and Affected Versions** GLPI versions 0.60 through 9.5.12 GLPI versions 10.0.0 through 10.0.6 **Description** The issue is related to insufficient cleaning of user data when processing external links, allowing a user to inject and execute arbitrary HTML code and scripts in the user's browser within the context of the vulnerable website. This can enable a remote attacker to steal potentially confidential information, modify the appearance of web pages, and perform phishing and drive-by download attacks. **Recommendations** For GLPI versions 0.60 through 9.5.12, update to version 9.5.13 to resolve the issue. For GLPI versions 10.0.0 through 10.0.6, update to version 10.0.7 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** GLPI versions prior to 10.0.3 **Description** The issue is related to the improper escaping of information associated with the registration key on the registration key configuration page in GLPI, a Free Asset and IT Management Software package. This can be exploited to steal a GLPI administrator cookie, allowing an attacker to gain unauthorized access. There are no known workarounds for this issue. **Recommendations** For versions prior to 10.0.3, upgrade to version 10.0.3 to resolve the issue. As a temporary workaround, do not use a registration key created by an untrusted person.