p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in ocsinventory-server

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für ocsinventory-server: 0. Davon im KEV-Katalog: 0.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 10

  1. CVE-2026-76178

    Kritisch · CVSS 9.2EPSS 0,42%Keine Korrektur veröffentlicht

    Multiple vulnerabilities in Ocsreports for OCS Inventory NG

    A stored Cross-Site Scripting (XSS) vulnerability in the notification template functionality of the endpoint /ocsreports/?function=notification. A user with administrator privileges can input malicious HTML content which is subsequently stored and displayed without proper sanitisation when other administrators access the template customisation view, allowing JavaScript code to be executed within the application’s security context and potentially compromising the sessions of other users with administrative privileges.

    ocsinventory-serverBetriebssysteme
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  2. CVE-2026-76177

    Hoch · CVSS 7.1EPSS 0,35%Keine Korrektur veröffentlicht

    Multiple vulnerabilities in Ocsreports for OCS Inventory NG

    Server-Side Request Forgery (SSRF) vulnerability in the /ocsreports/?function=tele_activate endpoint due to insufficient validation of the HTTPS_SERV and FILE_SERV parameters. An authenticated user with operator privileges can provide arbitrary values for these parameters, causing the OCS Inventory server to make HTTP/HTTPS requests to external systems or internal resources, which could allow access to internal network services or metadata resources of cloud services.

    ocsinventory-serverBetriebssysteme
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  3. CVE-2026-76176

    Hoch · CVSS 8.6EPSS 0,34%Keine Korrektur veröffentlicht

    Multiple vulnerabilities in Ocsreports for OCS Inventory NG

    SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admin_double due to improper processing of the values in the ID field included in the selected_grp_dupli[] parameter. An authenticated user with operator privileges can manipulate these values to alter the SQL queries executed by the application and retrieve information stored in the database.

    ocsinventory-serverBetriebssysteme
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  4. CVE-2026-76175

    Hoch · CVSS 8.6EPSS 0,34%Keine Korrektur veröffentlicht

    Multiple vulnerabilities in Ocsreports for OCS Inventory NG

    SQL injection vulnerability in the del_check parameter of the /ocsreports/?function=save_query_list endpoint. Input provided by an authenticated user with operator privileges is incorporated into an SQL query without proper parameterisation or validation, allowing the query to be manipulated and information to be extracted from the database using SQL injection techniques.

    ocsinventory-serverBetriebssysteme
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  5. CVE-2026-76174

    Kritisch · CVSS 9.4EPSS 0,51%Keine Korrektur veröffentlicht

    Multiple vulnerabilities in Ocsreports for OCS Inventory NG

    Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admin_info endpoint. The application validates files solely based on the name provided by the client, without properly checking their content or securely restricting the permitted file types. This allows a user with administrator privileges to upload PHP files to a directory accessible via the web interface. If the file is subsequently processed by the server, an attacker could execute arbitrary code with the privileges of the account used by the web service.

    ocsinventory-serverBetriebssysteme
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗

  6. CVE-2026-22675

    Mittel · CVSS 5.1EPSS 0,22%Keine Korrektur veröffentlicht

    OCS Inventory NG Server Stored XSS via User-Agent

    OCS Inventory NG Server version 2.12.3 and prior contain a stored cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary JavaScript by submitting malicious User-Agent HTTP headers to the /ocsinventory endpoint. Attackers can register rogue agents or craft requests with malicious User-Agent values that are stored without sanitization and rendered with insufficient encoding in the web console, leading to arbitrary JavaScript execution in the browsers of authenticated users viewing the statistics dashboard.

    ocsinventory-serverBetriebssysteme
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →