7728 matches found
CVE-2021-4108
CVE-2021-4108 affects the open-source asset management platform snipe-it . The vulnerability is a Cross-site Scripting (XSS) caused by Improper Neutralization of Input During Web Page Generation in the web interface. This is described across connected sources as a stored XSS issue in snipe-it, wi...
CVE-2021-4108 Cross-site Scripting (XSS) - Stored in snipe/snipe-it
snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...
Romanian arrested for ransomware attacks and data theft
By Deeba Ahmed Europol has confirmed arresting a Romanian national for targeting an IT firm in the country. This is a post from HackRead.com Read the original post: Romanian arrested for ransomware attacks and data theft...
Upcoming Speaking Engagements
This is a current list of where and when I am scheduled to speak: I’m speaking at the RSA Conference 2022 in San Francisco on February 8, 2022. I’m speaking at IT-S Now 2022 in Vienna on June 2, 2022. I’m speaking at the 14th International Conference on Cyber Conflict, CyCon 2022, in Tallinn,...
Snipe-IT Access Control Error Vulnerability
Snipe-IT is an open source IT asset/license management system. snipe-it is vulnerable to an access control error, and no details of the vulnerability are currently available...
snipe-it 跨站脚本漏洞
Snipe-IT is an open source IT asset/license management system. snipe-it suffers from a cross-site scripting vulnerability, which stems from vulnerability to incorrect input during web page generation. No detailed vulnerability details are currently available...
Insecure Access Control
snipe/snipe-it is vulnerable to improper access control. The vulnerability exists because it does not perform sufficient user permissions, allowing users to view model information via clone endpoint...
Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware
log4j-CVE-2021-44228 On December 5, 2021, Apache identified a...
Cross-site Scripting (XSS) - Stored in snipe/snipe-it
Description Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a differen...
Server-Side Request Forgery in snipe/snipe-it
Admin users on the external network can perform blind POST-based SSRF issue requests on behalf of the server into the internal network via the Slack Integration. This vulnerability is capable of port-scanning of the internal network, issue POST requests to web servers on the internal network whic...
GHSA-553Q-HPVP-Q8PC Server-Side Request Forgery in snipe/snipe-it
Admin users on the external network can perform blind POST-based SSRF issue requests on behalf of the server into the internal network via the Slack Integration. This vulnerability is capable of port-scanning of the internal network, issue POST requests to web servers on the internal network whic...
CVE-2021-4089
snipe-it is vulnerable to Improper Access Control...
CVE-2021-4089
snipe-it is vulnerable to Improper Access Control...
CVE-2021-4089
snipe-it is vulnerable to Improper Access Control...
Improper access control
snipe-it is vulnerable to Improper Access Control...
CVE-2021-4089 Improper Access Control in snipe/snipe-it
snipe-it is vulnerable to Improper Access Control...
CVE-2021-4089
Snipe-IT is affected by an Improper Access Control vulnerability (CVE-2021-4089) affecting versions prior to 5.3.4. The issue arises because regular users with DENY to all models permissions can still view model data via the /models/{id}/clone endpoint due to missing authorize('view') checks. Imp...
Snipe-IT 访问控制错误漏洞
Snipe-IT is an open source IT asset/license management system. snipe-it is vulnerable to an access control error, and no details of the vulnerability are currently available...
PT-2021-23007 · Snipe-It · Snipe-It
Name of the Vulnerable Software and Affected Versions: snipe-it versions prior to 5.3.4 Description: The issue is related to Improper Access Control. Regular users with DENY set to all models permissions can still view model information via the "/models/id/clone" endpoint due to no authorize'view...
Improper Access Control in snipe/snipe-it
Description Regular users with DENY set to all models permissions can still view model information via the /models/id/clone endpoint due to no authorize'view' permission being set. Proof of Concept 1: Create regular user and set DENY to all permissions in asset models. 2: Login as the user 3:...