732 matches found
Buffer overflow
Observable Discrepancy in Packagist snipe/snipe-it prior to v5.3.9...
Snipe-IT 信息泄露漏洞
Snipe-IT is an open source IT asset/license management system. snipe-it suffers from an information disclosure vulnerability that stems from the existence of two different responses for unregistered and registered email addresses in the password reset page. An attacker could use this vulnerabilit...
snipe-it 安全漏洞
Snipe-IT is an open source IT asset/license management system. security vulnerability exists in Packagist snipe/snipe-it versions prior to 5.3.9, which stems from improper privilege management. No details of the vulnerability are currently available...
CVE-2022-0569 Observable Discrepancy in snipe/snipe-it
Observable Discrepancy in Packagist snipe/snipe-it prior to v5.3.9...
CVE-2022-0569 Observable Discrepancy in snipe/snipe-it
Observable Discrepancy in Packagist snipe/snipe-it prior to v5.3.9...
CVE-2022-0569
CVE-2022-0569 affects snipe/snipe-it, prior to v5.3.9, with an information-disclosure flaw caused by differences in password-reset responses that can enumerate registered user emails. Impact is information disclosure (email enumeration) and potential brute-force risk implied by exposed email list...
Improper Privilege Management in snipe/snipe-it
Description It was found that if a user is not having access to supplier module, he can access and view the supplier content. Proof of Concept 1. Create two users, one admin and one normal user 2. A normal user is not having access to the supplier module. 3. But by enumeration the normal user vie...
in snipe/snipe-it
Description unprivileged user can get supplier Proof of Concept 1. Create regular user and set DENY to all permissions in asset and supplier models.\ 2. Login as the user and sent bellow request to get supplier await fetch"https://demo.snipeitapp.com/api/v1/suppliers/selectlist?page=1",...
Improper Privilege Management in snipe/snipe-it
Description Unprivilege user can create maintainance for asset Proof of Concept 1. Create regular user and set DENY to all permissions in asset models.\ 2. Login as the user and sent bellow request to create maintainance for asset await fetch"https://demo.snipeitapp.com/hardware/maintenances",...
GHSA-XC47-3RCH-CV57 Improper Access Control in snipe-it
Users with no system permissions are able to see and create personal access tokens...
Improper Access Control in snipe-it
Users with no system permissions are able to see and create personal access tokens...
GHSA-W3V3-CXQ5-9VR4 Incorrect Default Permissions and Improper Access Control in snipe-it
snipe-it is vulnerable to Improper Access Control/Incorrect Default Permissions...
Incorrect Default Permissions and Improper Access Control in snipe-it
snipe-it is vulnerable to Improper Access Control/Incorrect Default Permissions...
Privilege Escalation
snipe-it is vulnerable to privilege escalation. The vulnerability exists due to lack of santization of the auth controls on api key creation...
snipe-it Access Control Error Vulnerability (CNVD-2022-08381)
Snipe-IT is an open source IT asset/license management system. snipe-it is vulnerable to an access control error, which stems from the presence of improper access controls in the software. No details of the vulnerability are currently available...
CVE-2022-0178
Missing Authorization vulnerability in snipe snipe/snipe-it.This issue affects snipe/snipe-i before 5.3.8...
CVE-2022-0178
Missing Authorization vulnerability in snipe snipe/snipe-it.This issue affects snipe/snipe-i before 5.3.8...
Authorization
Missing Authorization vulnerability in snipe snipe/snipe-it.This issue affects snipe/snipe-i before 5.3.8...