Design/Logic Flaw

In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which once clicked lead to an attacker controlled server and thus leading to password...

CVE-2022-23064

Snipe-IT (versions v3.0-alpha to v5.3.7) is affected by a Host Header Injection vulnerability. A specially crafted Host header in the reset password request can cause password reset links to be sent to an attacker-controlled server, enabling leakage of password reset tokens and potentially result...

CVE-2022-23064 Snipe-IT - Host Header Injection

In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which once clicked lead to an attacker controlled server and thus leading to password...

CVE-2022-23064 Snipe-IT - Host Header Injection

In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which once clicked lead to an attacker controlled server and thus leading to password...

Snipe-IT 注入漏洞

Snipe-IT is an open source IT asset/license management system. An injection vulnerability exists in Snipe-IT versions v3.0-alpha through v5.3.7. The vulnerability stems from sending a specially crafted request header in a password reset request that can send a password reset link to the user, whi...

CVE-2022-23064

In Snipe-IT, versions v3.0-alpha to v5.3.7 are vulnerable to Host Header Injection. By sending a specially crafted host header in the reset password request, it is possible to send password reset links to users which once clicked lead to an attacker controlled server and thus leading to password...

Improper Access Control

snipe/snipe-it is vulnerable to improper access control. The vulnerability exists in the getRequestedIndex function in AssetsController.php due to insufficient user permissions to assets index which allows unauthorized users to access the system...

Improper Access Control in snipe/snipe-it

Snipe-IT prior to 5.4.4 is vulnerable to Missing Authorization...

GHSA-P2VW-F87C-Q597 Improper Access Control in snipe/snipe-it

Snipe-IT prior to 5.4.4 is vulnerable to Missing Authorization...

CVE-2022-1511

Missing Authorization in GitHub repository snipe/snipe-it prior to 5.4.4...

CVE-2022-1511

Missing Authorization in GitHub repository snipe/snipe-it prior to 5.4.4...

Authorization

Missing Authorization in GitHub repository snipe/snipe-it prior to 5.4.4...

Snipe-IT 安全漏洞

Snipe-IT is an open source IT asset/license management system. A security vulnerability exists in Snipe-IT that stems from incorrect access control...

PT-2022-13925 · Snipe-It · Snipe-It

Name of the Vulnerable Software and Affected Versions: snipe/snipe-it versions prior to 5.4.4 Description: The issue is related to Missing Authorization or Improper Access Control in the snipe/snipe-it GitHub repository. No information is provided about the estimated number of potentially affecte...

CVE-2022-1511 Missing Authorization in snipe/snipe-it

Missing Authorization in GitHub repository snipe/snipe-it prior to 5.4.4...

CVE-2022-1511

CVE-2022-1511 affects snipe/snipe-it prior to 5.4.4, due to Missing Authorization / Improper Access Control. Exploitation allows unauthorized access to the GitHub repository assets and data exposed by insufficient access controls. The issue is documented across multiple sources (GitHub advisory G...

CVE-2022-1511 Missing Authorization in snipe/snipe-it

Missing Authorization in GitHub repository snipe/snipe-it prior to 5.4.4...

Snipe-IT Cross-Site Scripting Vulnerability (CNVD-2022-47474)

Snipe-IT is an open source IT asset/license management system. snipe-IT has a cross-site scripting vulnerability that stems from a cross-site scripting vulnerability stored in the checkedoutto parameter, which can be exploited by attackers to obtain user cookies...

Cross-Site Scripting (XSS)

snipe/snipe-it is vulnerable to cross-site scripting. The vulnerability exists in transformAssets function in DepreciationReportTransformer because the checkedoutto parameter is not properly escaped which allows an attacker to send and execute arbitrary javascript...

GHSA-HPX4-XJP7-M4VR Stored cross-site scripting in Snipe-IT

Snipe-IT prior to version 5.4.3 is vulnerable to stored cross-site scripting because the input to the checkedoutto parameter is not escaped. The vulnerability is capable of stealing a user's cookie...