<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="3">
<package pkgid="57baf53720f2a223596eadba5b3d02b8e47343aca35f236f45e22dddc1b66afa" name="glpi" arch="noarch">
  <version epoch="0" ver="10.0.26" rel="1.fc43"/>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 10.0.16-1" date="1720094400">- Update to 10.0.16
  see https://github.com/glpi-project/glpi/milestone/68?closed=1
- This is a security release, upgrading is recommended:
  [SECURITY - high] Account takeover via SQL Injection in AJAX scripts (CVE-2024-37148)
  [SECURITY - high] Remote code execution through the plugin loader (CVE-2024-37149)
  [SECURITY - moderate] Authenticated file upload to restricted tickets (CVE-2024-37147)
- Also, here is a short list of main changes done in this version:
  [FIX] Freesize database field was not correctly migrated
  [FIX] Network inventoried stacked switches had all the same name
  [FIX] Remove monitors from inventory when no monitor is present
  [FIX] Import location hierarchy from LDAP and Inventory</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 10.0.16-2" date="1729857600">- Fix patch for Fedora 41</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 10.0.17-1" date="1730980800">- Update to 10.0.17
  see https://github.com/glpi-project/glpi/milestone/68?closed=1
- This is a security release, upgrading is recommended:
  [SECURITY - critical] Unauthenticated session hijacking (CVE-2024-50339)
  [SECURITY - high] Account takeover through SQL injection (CVE-2024-40638)
  [SECURITY - high] Users email enumeration by unauthenticated user (CVE-2024-43416)
  [SECURITY - high] Account takeover without privilege escalation through the API (CVE-2024-47758)
  [SECURITY - high] Account takeover via the password reset feature (CVE-2024-47761)
  [SECURITY - high] Account takeover via API (CVE-2024-47760)
  [SECURITY - high] Insecure account deletion by authenticated user (CVE-2024-48912)
  [SECURITY - moderate] Authenticated SQL Injection (CVE-2024-45608)
  [SECURITY - moderate] Authenticated SQL injection in ticket form (CVE-2024-41679)
  [SECURITY - moderate] Stored XSS in RSS feeds (CVE-2024-45611)
  [SECURITY - moderate] Stored XSS via document upload (CVE-2024-47759)
  [SECURITY - moderate] Multiple reflected XSS (CVE-2024-43417, CVE-2024-43418, CVE-2024-45609, CVE-2024-45610, CVE-2024-41678)</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 10.0.18-1" date="1740312000">- Update to 10.0.18
  see https://github.com/glpi-project/glpi/milestone/70?closed=1
- This is a security release, upgrading is recommended:
  [SECURITY - high] Unauthenticated SQL injection through the inventory endpoint (CVE-2025-24799)
  [SECURITY - high] Authenticated Remote code execution (CVE-2025-24801)
  [SECURITY - high] SQL injection through the rules configuration (CVE-2025-21619)
  [SECURITY - moderate] Open Redirection (CVE-2024-11955)
  [SECURITY - moderate] Reflected XSS in search page (CVE-2025-21627)
  [SECURITY - moderate] Exposure of sensitive information in the status.php endpoint (CVE-2025-21626)
  [SECURITY - moderate] Plugins disabled by unauthenticated user (CVE-2025-23024)
  [SECURITY - moderate] Unauthorized authentication by email using the OAuthIMAP plugin (CVE-2025-23046)
  [SECURITY - moderate] Unauthorized access to debug mode (CVE-2025-25192)</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 10.0.19-1" date="1753185600">- Update to 10.0.19
  see https://github.com/glpi-project/glpi/milestone/73?closed=1
- This is a security release, upgrading is recommended:
  [SECURITY - MODERATE] Stored XSS on projects kanban (CVE-2025-27514)
  [SECURITY - LOW] Blind SSRF in RSS feeds and planning (CVE-2025-52567)
  [SECURITY - MODERATE] XSS and open redirection in planning (CVE-2025-52897)
  [SECURITY - MODERATE] Mail receiver credentials exfiltration (CVE-2025-53008)
  [SECURITY - MODERATE] Reservations modification by unauthorized user (CVE-2025-53357)
  [SECURITY - LOW] Access to unallowed items information through external links (CVE-2025-53113)
  [SECURITY - MODERATE] Data exposure to non allowed users (CVE-2025-53111)
  [SECURITY - MODERATE] Data removal from allowed users (CVE-2025-53112)
  [SECURITY - HIGH] Unauthorized rules execution order update (CVE-2025-53105)</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 10.0.20-1" date="1758801600">- Update to 10.0.20
- This is bugfix release, upgrading is recommended:
  see https://github.com/glpi-project/glpi/releases/tag/10.0.20
- Update glpi-httpd.conf with deny access to non-public files</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 10.0.22-1" date="1765195200">- Update to 10.0.22 (replace 10.0.21)
- This is a security release, upgrading is recommended:
  see https://github.com/glpi-project/glpi/milestone/76?closed=1
  [SECURITY - HIGH] Unauthorized access to documents (CVE-2025-64516)
  [SECURITY - MODERATE] Unauthenticated Stored XSS through the inventory endpoint (CVE-2025-59935)
  [SECURITY - MODERATE] Unauthorized access to Knowledge Base items through the API (CVE-2025-64520)
- Many bug fixes have also been made</changelog>
  <changelog author="Alan Flambard &lt;alan.flambard@flambard.ovh&gt; - 10.0.23-1" date="1769601600">- Update to 10.0.23
- This is a security release, upgrading is recommended:
  [SECURITY - MODERATE] Authenticated SQL Injection (CVE-2026-22044)
  [SECURITY - MODERATE] Session stealing on externally authenticated user change (CVE-2026-23624)</changelog>
  <changelog author="Alan Flambard &lt;alan.flambard@flambard.ovh&gt; - 10.0.24-1" date="1772539200">- Update to 10.0.24
- This is a security release, upgrading is recommended:
  [SECURITY - High] Stored XSS in Supplier (CVE-2026-25932)
  [SECURITY - High] Authenticated SQL Injection (CVE requested)</changelog>
  <changelog author="Alan Flambard &lt;alan.flambard@flambard.ovh&gt; - 10.0.25-1" date="1777809600">- Update to 10.0.25</changelog>
</package>
<package pkgid="eeb51a5a57939dd22f9215be55aeb34a3d0f801d85c8378be171575625831221" name="glpi" arch="src">
  <version epoch="0" ver="10.0.26" rel="1.fc43"/>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 10.0.16-1" date="1720094400">- Update to 10.0.16
  see https://github.com/glpi-project/glpi/milestone/68?closed=1
- This is a security release, upgrading is recommended:
  [SECURITY - high] Account takeover via SQL Injection in AJAX scripts (CVE-2024-37148)
  [SECURITY - high] Remote code execution through the plugin loader (CVE-2024-37149)
  [SECURITY - moderate] Authenticated file upload to restricted tickets (CVE-2024-37147)
- Also, here is a short list of main changes done in this version:
  [FIX] Freesize database field was not correctly migrated
  [FIX] Network inventoried stacked switches had all the same name
  [FIX] Remove monitors from inventory when no monitor is present
  [FIX] Import location hierarchy from LDAP and Inventory</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 10.0.16-2" date="1729857600">- Fix patch for Fedora 41</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 10.0.17-1" date="1730980800">- Update to 10.0.17
  see https://github.com/glpi-project/glpi/milestone/68?closed=1
- This is a security release, upgrading is recommended:
  [SECURITY - critical] Unauthenticated session hijacking (CVE-2024-50339)
  [SECURITY - high] Account takeover through SQL injection (CVE-2024-40638)
  [SECURITY - high] Users email enumeration by unauthenticated user (CVE-2024-43416)
  [SECURITY - high] Account takeover without privilege escalation through the API (CVE-2024-47758)
  [SECURITY - high] Account takeover via the password reset feature (CVE-2024-47761)
  [SECURITY - high] Account takeover via API (CVE-2024-47760)
  [SECURITY - high] Insecure account deletion by authenticated user (CVE-2024-48912)
  [SECURITY - moderate] Authenticated SQL Injection (CVE-2024-45608)
  [SECURITY - moderate] Authenticated SQL injection in ticket form (CVE-2024-41679)
  [SECURITY - moderate] Stored XSS in RSS feeds (CVE-2024-45611)
  [SECURITY - moderate] Stored XSS via document upload (CVE-2024-47759)
  [SECURITY - moderate] Multiple reflected XSS (CVE-2024-43417, CVE-2024-43418, CVE-2024-45609, CVE-2024-45610, CVE-2024-41678)</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 10.0.18-1" date="1740312000">- Update to 10.0.18
  see https://github.com/glpi-project/glpi/milestone/70?closed=1
- This is a security release, upgrading is recommended:
  [SECURITY - high] Unauthenticated SQL injection through the inventory endpoint (CVE-2025-24799)
  [SECURITY - high] Authenticated Remote code execution (CVE-2025-24801)
  [SECURITY - high] SQL injection through the rules configuration (CVE-2025-21619)
  [SECURITY - moderate] Open Redirection (CVE-2024-11955)
  [SECURITY - moderate] Reflected XSS in search page (CVE-2025-21627)
  [SECURITY - moderate] Exposure of sensitive information in the status.php endpoint (CVE-2025-21626)
  [SECURITY - moderate] Plugins disabled by unauthenticated user (CVE-2025-23024)
  [SECURITY - moderate] Unauthorized authentication by email using the OAuthIMAP plugin (CVE-2025-23046)
  [SECURITY - moderate] Unauthorized access to debug mode (CVE-2025-25192)</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 10.0.19-1" date="1753185600">- Update to 10.0.19
  see https://github.com/glpi-project/glpi/milestone/73?closed=1
- This is a security release, upgrading is recommended:
  [SECURITY - MODERATE] Stored XSS on projects kanban (CVE-2025-27514)
  [SECURITY - LOW] Blind SSRF in RSS feeds and planning (CVE-2025-52567)
  [SECURITY - MODERATE] XSS and open redirection in planning (CVE-2025-52897)
  [SECURITY - MODERATE] Mail receiver credentials exfiltration (CVE-2025-53008)
  [SECURITY - MODERATE] Reservations modification by unauthorized user (CVE-2025-53357)
  [SECURITY - LOW] Access to unallowed items information through external links (CVE-2025-53113)
  [SECURITY - MODERATE] Data exposure to non allowed users (CVE-2025-53111)
  [SECURITY - MODERATE] Data removal from allowed users (CVE-2025-53112)
  [SECURITY - HIGH] Unauthorized rules execution order update (CVE-2025-53105)</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 10.0.20-1" date="1758801600">- Update to 10.0.20
- This is bugfix release, upgrading is recommended:
  see https://github.com/glpi-project/glpi/releases/tag/10.0.20
- Update glpi-httpd.conf with deny access to non-public files</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 10.0.22-1" date="1765195200">- Update to 10.0.22 (replace 10.0.21)
- This is a security release, upgrading is recommended:
  see https://github.com/glpi-project/glpi/milestone/76?closed=1
  [SECURITY - HIGH] Unauthorized access to documents (CVE-2025-64516)
  [SECURITY - MODERATE] Unauthenticated Stored XSS through the inventory endpoint (CVE-2025-59935)
  [SECURITY - MODERATE] Unauthorized access to Knowledge Base items through the API (CVE-2025-64520)
- Many bug fixes have also been made</changelog>
  <changelog author="Alan Flambard &lt;alan.flambard@flambard.ovh&gt; - 10.0.23-1" date="1769601600">- Update to 10.0.23
- This is a security release, upgrading is recommended:
  [SECURITY - MODERATE] Authenticated SQL Injection (CVE-2026-22044)
  [SECURITY - MODERATE] Session stealing on externally authenticated user change (CVE-2026-23624)</changelog>
  <changelog author="Alan Flambard &lt;alan.flambard@flambard.ovh&gt; - 10.0.24-1" date="1772539200">- Update to 10.0.24
- This is a security release, upgrading is recommended:
  [SECURITY - High] Stored XSS in Supplier (CVE-2026-25932)
  [SECURITY - High] Authenticated SQL Injection (CVE requested)</changelog>
  <changelog author="Alan Flambard &lt;alan.flambard@flambard.ovh&gt; - 10.0.25-1" date="1777809600">- Update to 10.0.25</changelog>
</package>
<package pkgid="9d0ac286c2f265ed23f8d14eef5d38172d0e601eba91be386b852bbfedc2a8f4" name="glpi-marketplace" arch="noarch">
  <version epoch="0" ver="10.0.26" rel="1.fc43"/>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 10.0.16-1" date="1720094400">- Update to 10.0.16
  see https://github.com/glpi-project/glpi/milestone/68?closed=1
- This is a security release, upgrading is recommended:
  [SECURITY - high] Account takeover via SQL Injection in AJAX scripts (CVE-2024-37148)
  [SECURITY - high] Remote code execution through the plugin loader (CVE-2024-37149)
  [SECURITY - moderate] Authenticated file upload to restricted tickets (CVE-2024-37147)
- Also, here is a short list of main changes done in this version:
  [FIX] Freesize database field was not correctly migrated
  [FIX] Network inventoried stacked switches had all the same name
  [FIX] Remove monitors from inventory when no monitor is present
  [FIX] Import location hierarchy from LDAP and Inventory</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 10.0.16-2" date="1729857600">- Fix patch for Fedora 41</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 10.0.17-1" date="1730980800">- Update to 10.0.17
  see https://github.com/glpi-project/glpi/milestone/68?closed=1
- This is a security release, upgrading is recommended:
  [SECURITY - critical] Unauthenticated session hijacking (CVE-2024-50339)
  [SECURITY - high] Account takeover through SQL injection (CVE-2024-40638)
  [SECURITY - high] Users email enumeration by unauthenticated user (CVE-2024-43416)
  [SECURITY - high] Account takeover without privilege escalation through the API (CVE-2024-47758)
  [SECURITY - high] Account takeover via the password reset feature (CVE-2024-47761)
  [SECURITY - high] Account takeover via API (CVE-2024-47760)
  [SECURITY - high] Insecure account deletion by authenticated user (CVE-2024-48912)
  [SECURITY - moderate] Authenticated SQL Injection (CVE-2024-45608)
  [SECURITY - moderate] Authenticated SQL injection in ticket form (CVE-2024-41679)
  [SECURITY - moderate] Stored XSS in RSS feeds (CVE-2024-45611)
  [SECURITY - moderate] Stored XSS via document upload (CVE-2024-47759)
  [SECURITY - moderate] Multiple reflected XSS (CVE-2024-43417, CVE-2024-43418, CVE-2024-45609, CVE-2024-45610, CVE-2024-41678)</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 10.0.18-1" date="1740312000">- Update to 10.0.18
  see https://github.com/glpi-project/glpi/milestone/70?closed=1
- This is a security release, upgrading is recommended:
  [SECURITY - high] Unauthenticated SQL injection through the inventory endpoint (CVE-2025-24799)
  [SECURITY - high] Authenticated Remote code execution (CVE-2025-24801)
  [SECURITY - high] SQL injection through the rules configuration (CVE-2025-21619)
  [SECURITY - moderate] Open Redirection (CVE-2024-11955)
  [SECURITY - moderate] Reflected XSS in search page (CVE-2025-21627)
  [SECURITY - moderate] Exposure of sensitive information in the status.php endpoint (CVE-2025-21626)
  [SECURITY - moderate] Plugins disabled by unauthenticated user (CVE-2025-23024)
  [SECURITY - moderate] Unauthorized authentication by email using the OAuthIMAP plugin (CVE-2025-23046)
  [SECURITY - moderate] Unauthorized access to debug mode (CVE-2025-25192)</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 10.0.19-1" date="1753185600">- Update to 10.0.19
  see https://github.com/glpi-project/glpi/milestone/73?closed=1
- This is a security release, upgrading is recommended:
  [SECURITY - MODERATE] Stored XSS on projects kanban (CVE-2025-27514)
  [SECURITY - LOW] Blind SSRF in RSS feeds and planning (CVE-2025-52567)
  [SECURITY - MODERATE] XSS and open redirection in planning (CVE-2025-52897)
  [SECURITY - MODERATE] Mail receiver credentials exfiltration (CVE-2025-53008)
  [SECURITY - MODERATE] Reservations modification by unauthorized user (CVE-2025-53357)
  [SECURITY - LOW] Access to unallowed items information through external links (CVE-2025-53113)
  [SECURITY - MODERATE] Data exposure to non allowed users (CVE-2025-53111)
  [SECURITY - MODERATE] Data removal from allowed users (CVE-2025-53112)
  [SECURITY - HIGH] Unauthorized rules execution order update (CVE-2025-53105)</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 10.0.20-1" date="1758801600">- Update to 10.0.20
- This is bugfix release, upgrading is recommended:
  see https://github.com/glpi-project/glpi/releases/tag/10.0.20
- Update glpi-httpd.conf with deny access to non-public files</changelog>
  <changelog author="Jean-Marc Liger &lt;ligenix@iscp.fr&gt; - 10.0.22-1" date="1765195200">- Update to 10.0.22 (replace 10.0.21)
- This is a security release, upgrading is recommended:
  see https://github.com/glpi-project/glpi/milestone/76?closed=1
  [SECURITY - HIGH] Unauthorized access to documents (CVE-2025-64516)
  [SECURITY - MODERATE] Unauthenticated Stored XSS through the inventory endpoint (CVE-2025-59935)
  [SECURITY - MODERATE] Unauthorized access to Knowledge Base items through the API (CVE-2025-64520)
- Many bug fixes have also been made</changelog>
  <changelog author="Alan Flambard &lt;alan.flambard@flambard.ovh&gt; - 10.0.23-1" date="1769601600">- Update to 10.0.23
- This is a security release, upgrading is recommended:
  [SECURITY - MODERATE] Authenticated SQL Injection (CVE-2026-22044)
  [SECURITY - MODERATE] Session stealing on externally authenticated user change (CVE-2026-23624)</changelog>
  <changelog author="Alan Flambard &lt;alan.flambard@flambard.ovh&gt; - 10.0.24-1" date="1772539200">- Update to 10.0.24
- This is a security release, upgrading is recommended:
  [SECURITY - High] Stored XSS in Supplier (CVE-2026-25932)
  [SECURITY - High] Authenticated SQL Injection (CVE requested)</changelog>
  <changelog author="Alan Flambard &lt;alan.flambard@flambard.ovh&gt; - 10.0.25-1" date="1777809600">- Update to 10.0.25</changelog>
</package>
</otherdata>