1531 matches found
PT-2022-13842
Name of the Vulnerable Software and Affected Versions snipe/snipe-it versions prior to 5.4.3 Description The issue is related to a Stored Cross Site Scripting vulnerability in the Item name parameter. This vulnerability can lead to the theft of a user's Cookie. Recommendations For versions prior ...
snipe-it 跨站脚本漏洞
Snipe-IT is an open source IT asset/license management system. snipe-IT has a security vulnerability that can be exploited by attackers to steal user cookies...
GHSA-636J-7X7R-GVW2 Old sessions not blocked by login enable function in Snipe-IT
Snipe-IT is a FOSS project for asset management in IT Operations. In Snipe-IT versions 5.4.1 and 6.0.0-RC-5 and prior, active sessions are not revoked when a user account is disabled, allowing that user to still access information that they should no longer be able to. Workarounds include using t...
Old sessions not blocked by login enable function in Snipe-IT
Snipe-IT is a FOSS project for asset management in IT Operations. In Snipe-IT versions 5.4.1 and 6.0.0-RC-5 and prior, active sessions are not revoked when a user account is disabled, allowing that user to still access information that they should no longer be able to. Workarounds include using t...
CVE-2022-1155
Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10...
CVE-2022-1155
Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10...
Code injection
Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10...
CVE-2022-1155 Old sessions are not blocked by the login enable function. in snipe/snipe-it
Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10...
CVE-2022-1155
Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10...
CVE-2022-1155 Old sessions are not blocked by the login enable function. in snipe/snipe-it
Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10...
CVE-2022-1155
CVE-2022-1155 affects Snipe-IT, where the login enable function does not revoke/block old sessions in versions prior to 5.3.10. Exploitation could allow continuing access by existing sessions after a role/account change. Public details indicate fixes: 5.4.2 and 6.0.0-RC-6 (and later releases). Re...
Snipe-IT 安全漏洞
Snipe-IT is an open source IT asset/license management system. A security vulnerability exists in Snipe-IT versions prior to 5.3.10, which stems from the login function not blocking old sessions...
PT-2022-13677
Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 5.3.10 Snipe-IT versions 5.4.1 and 6.0.0-RC-5 Description The issue arises from the fact that old sessions are not blocked by the login enable function, and active sessions are not revoked when a user account is...
CVE-2022-1155: Undefined Security Weakness
Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10...
Information Exposure
snipe/snipe-it is vulnerable to information exposure. The vulnerability exists in the sendResetLinkEmail function in the ForgotPasswordController.php file, allowing an attacker to read sensitive information in the system...
GHSA-PWWM-PWX2-2HW7 Generation of Error Message Containing Sensitive Information in Snipe-IT
Snipe-IT prior to version 5.3.11 is vulnerable to Generation of Error Message Containing Sensitive Information...
An unspecified vulnerability exists in snipe-it (CNVD-2022-13366)
Snipe-IT is an open source IT asset/license management system. snipe-it has a security vulnerability that stems from the generation of error messages containing sensitive information in Packagist snipe/snipe-it prior to 5.3.11. No detailed vulnerability details are currently available...
Privilege Escalation
snipe/snipe-it is vulnerable to privilege escalation. The vulnerability exists in AssetMaintenancesController.php and AssetMaintenancesController.php due to missing edit / delete Asset gates which allows an unauthenticated user to create maintenance for asset...