GHSA-HW9X-8M75-4VJQ Cross Site Scripting vulnerability in Snipe-IT

Cross Site Scripting vulnerability in Snipe-IT v.7.0.13 allows a remote attacker to escalate privileges via an unknown part of the file /users/user-id/files...

CVE-2024-51093

Stored Cross-Site Scripting XSS vulnerability in Snipe-IT - v7.0.13 allows an attacker to upload a malicious XML file containing JavaScript code. This can lead to privilege escalation when the payload is executed, granting the attacker super admin permissions within the Snipe-IT system...

CVE-2024-51094

An issue in Snipe-IT v.7.0.13 build 15514 allows a low-privileged attacker to modify their profile name and inject a malicious payload into the "Name" field. When an administrator later accesses the People Management page, exports the data as a CSV file, and opens it, the injected payload will be...

CVE-2024-51093

Stored Cross-Site Scripting XSS vulnerability in Snipe-IT - v7.0.13 allows an attacker to upload a malicious XML file containing JavaScript code. This can lead to privilege escalation when the payload is executed, granting the attacker super admin permissions within the Snipe-IT system...

Snipe-IT 安全漏洞

Snipe-IT is an open source IT asset/license management system for snipe individual developers. A security vulnerability exists in Snipe-IT version v.7.0.13. An attacker can exploit the vulnerability to elevate privileges...

CVE-2024-51094

An issue in Snipe-IT v.7.0.13 build 15514 allows a low-privileged attacker to modify their profile name and inject a malicious payload into the "Name" field. When an administrator later accesses the People Management page, exports the data as a CSV file, and opens it, the injected payload will be...

CVE-2024-51094

An issue in Snipe-IT v.7.0.13 build 15514 allows a low-privileged attacker to modify their profile name and inject a malicious payload into the "Name" field. When an administrator later accesses the People Management page, exports the data as a CSV file, and opens it, the injected payload will be...

CVE-2024-51094

CVE-2024-51094 affects Snipe-IT v7.0.13 build 15514. A low-privileged attacker can modify their profile Name field to inject a malicious payload; when an administrator uses the People Management page to export data as CSV and opens it, the payload can exfiltrate internal data from the CSV to a re...

CVE-2024-51093

Stored Cross-Site Scripting XSS vulnerability in Snipe-IT - v7.0.13 allows an attacker to upload a malicious XML file containing JavaScript code. This can lead to privilege escalation when the payload is executed, granting the attacker super admin permissions within the Snipe-IT system...

CVE-2024-51093

Stored Cross-Site Scripting XSS vulnerability in Snipe-IT - v7.0.13 allows an attacker to upload a malicious XML file containing JavaScript code. This can lead to privilege escalation when the payload is executed, granting the attacker super admin permissions within the Snipe-IT system...

CVE-2024-51093

CVE-2024-51093 is a Stored XSS vulnerability in Snipe-IT 7.0.13 where an attacker can upload a malicious XML file containing JavaScript. The payload can execute in the victim’s browser and, as described across sources, may enable privilege escalation to a super admin. Affected component is the fi...

Snipe-IT 安全漏洞

Snipe-IT is an open source IT asset/license management system for snipe individual developers. A security vulnerability exists in Snipe-IT version v.7.0.13. An attacker can exploit the vulnerability to elevate privileges...

PT-2024-34522 · Snipe-It · Snipe-It

Name of the Vulnerable Software and Affected Versions: Snipe-IT version 7.0.13 build 15514 Description: The issue allows a low-privileged attacker to modify their profile name and inject a malicious payload into the Name field. When an administrator later accesses the People Management page,...

CVE-2024-51094

An issue in Snipe-IT v.7.0.13 build 15514 allows a low-privileged attacker to modify their profile name and inject a malicious payload into the "Name" field. When an administrator later accesses the People Management page, exports the data as a CSV file, and opens it, the injected payload will be...

Remote Code Execution (RCE)

snipe/snipe-it is vulnerable to Remote Code Execution RCE. The vulnerability is due to the deserialization of untrusted data in the cookie-handling process, allows an attacker can execute arbitrary code on the server by exploiting the APPKEY, especially if it is set to a default value as found in...

Snipe-IT remote code execution

Snipe-IT before 7.0.10 allows remote code execution associated with cookie serialization when an attacker knows the APPKEY. This is exacerbated by .env files, available from the product's repository, that have default APPKEY values...

Remote Code Execution (RCE)

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Remote Code Execution RCE due to the deserialization of untrusted data in the cookie-handling process. An attacker can execute arbitrary code on the server by exploiting the...

GHSA-57QH-VMJR-5JXG Snipe-IT remote code execution

Snipe-IT before 7.0.10 allows remote code execution associated with cookie serialization when an attacker knows the APPKEY. This is exacerbated by .env files, available from the product's repository, that have default APPKEY values...

CVE-2024-48987

Snipe-IT before 7.0.10 allows remote code execution associated with cookie serialization when an attacker knows the APPKEY. This is exacerbated by .env files, available from the product's repository, that have default APPKEY values...

Snipe-IT 安全漏洞

Snipe-IT is an open source IT asset/license management system for snipe individual developers. A security vulnerability exists in Snipe-IT versions prior to 7.0.10 that stems from allowing remote code execution when an attacker knows the APPKEY...