GHSA-363Q-J92X-7543 Snipe-IT vulnerable to Cross Site Scripting for View Assigned Assets

Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting XSS for View Assigned Assets...

Snipe-IT vulnerable to Cross Site Scripting for View Assigned Assets

Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting XSS for View Assigned Assets...

Snipe-IT allows attackers to check whether a user account exists

Snipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response variations in a /password/reset request...

CVE-2022-44381

Snipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response variations in a /password/reset request...

CVE-2022-44380

Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting XSS for View Assigned Assets...

Design/Logic Flaw

Snipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response variations in a /password/reset request...

Cross site scripting

Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting XSS for View Assigned Assets...

CVE-2022-44381

Snipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response variations in a /password/reset request...

Snipe-IT 安全漏洞

Snipe-IT is an open source IT asset/license management system. A security vulnerability exists in Snipe-IT versions prior to 6.0.14, which stems from the fact that an attacker can check the existence of a user account via response variables to password and reset requests...

PT-2022-27203 · Snipe-It · Snipe-It

Name of the Vulnerable Software and Affected Versions: Snipe-IT versions prior to 6.0.14 Description: The issue is related to Cross Site Scripting XSS for View Assigned Assets. This means an attacker could potentially inject malicious scripts into the website, which would then be executed by the...

CVE-2022-44380

Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting XSS for View Assigned Assets...

CVE-2022-44381

Snipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response variations in a /password/reset request...

CVE-2022-44381

Snipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response variations in a /password/reset request...

CVE-2022-44380

Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting XSS for View Assigned Assets...

CVE-2022-44381

Snipe-IT (open source IT asset/license management) up to version 6.0.14 is affected. The vulnerability arises from response variations in the /password/reset endpoint that allow an attacker to determine whether a given user account exists (user enumeration). Impact is limited to information discl...

CVE-2022-44380

Snipe-IT prior to version 6.0.14 is affected by a Cross Site Scripting (XSS) vulnerability when viewing assigned assets. The issue is documented across multiple feeds (CVE-2022-44380) and is addressed by upgrading to Snipe-IT 6.0.14 or later, per Red Hat advisory and NCSC release notes indicating...

CVE-2022-44380

Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting XSS for View Assigned Assets...

Snipe-IT 跨站脚本漏洞

Snipe-IT is an open source IT asset/license management system. A security vulnerability exists in versions of Snipe-IT prior to 6.0.14 that stems from an attacker being able to view assigned assets via cross-site scripting...

CSV Injection in CSV files generated by the backend

Description Formula Elements are not sanitized before adding to CSV reports. This leads to CSV formula injection. Proof of Concept Steps to reproduce: 1. Log in to Snipe-IT & create a new Asset with arbitrary values. For the Asset Tag enter =1+1 Screenshot 1 2. Got to Reports - Custom Asset Repor...

Improper Authentication

snipe/snipe-it is vulnerable to improper authentication. A remote authenticated attacker is able to access unauthorized files through the viewKeys function as long as they have the View permission, which exposes confidential information required to create the API keys without the corresponding...