Cross site request forgery (csrf)

snipe-it is vulnerable to Cross-Site Request Forgery CSRF...

CVE-2021-3879 Cross-site Scripting (XSS) - Stored in snipe/snipe-it

snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

CVE-2021-3879

CVE-2021-3879 affects snipe-it and is caused by improper neutralization of input during web page generation, leading to Cross-site Scripting (XSS). Multiple connected records corroborate a client-side data validation weakness in the web app, with impact described as disclosure/intrusion via injec...

CVE-2021-3863

CVE-2021-3863 affects the open-source asset management app Snipe-IT . The connected documents consistently describe it as a vulnerability of Improper Neutralization of Input During Web Page Generation (XSS) , caused by insecure handling of input that leads to arbitrary JavaScript execution via we...

CVE-2021-3863 Cross-site Scripting (XSS) - Generic in snipe/snipe-it

snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

CVE-2021-3858

CVE-2021-3858 affects the snipe-it project (an open-source IT asset/license management system) and is a Cross-Site Request Forgery (CSRF) vulnerability. Public scoring in CVSSv3.1 is 8.8 (HIGH) with AV:N, AC:L, PR:N, UI:R, C:H, I:H, A:H; CVSSv2 is 6.8 (MEDIUM). The connected documents consistentl...

CVE-2021-3858 Cross-Site Request Forgery (CSRF) in snipe/snipe-it

snipe-it is vulnerable to Cross-Site Request Forgery CSRF...

Snipe-IT 跨站脚本漏洞

Snipe-IT is an open source IT asset/license management system. snipe-IT has a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data in the WEB application, which can be exploited by attackers to execute client-side code...

Snipe-IT 跨站请求伪造漏洞

Snipe-IT is an open source IT asset/license management system. snipe-it is vulnerable to cross-site request forgery, which could be exploited by attackers to obtain sensitive information...

Snipe-IT 跨站脚本漏洞

Snipe-IT is an open source IT asset/license management system. Snipe-IT suffers from a cross-site scripting vulnerability that stems from the fact that the program is vulnerable to incorrect input during web page generation, which could be exploited by an attacker to execute arbitrary JavaScript...

Cross-site Scripting (XSS) - Stored in snipe/snipe-it

Description Multiple Stored XSS at parameter 'name' when creating a record at features 'Custom Fields', 'Asset Models', 'Suppliers', 'Locations', at Snipe-It 5.2.0 Proof of Concept // PoC.req POST /snipe-it/public/fields HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X...

in snipe/snipe-it

Description There is no rate limit sent unlimited email victim or any email address Proof of Concept There is no rate limit return-password , attacker to send unlimited email to victim or any email address. POST /password/email HTTP/1.1 Host: demo.snipeitapp.com Connection: close Content-Length: ...

Cross-Site Request Forgery (CSRF) in snipe/snipe-it

Description I found some low/medium level CSRFs on nice snipe-it application Proof of Concepts change the state of Requestable Assets : // PoC.html history.pushState'', '', '/' restore a hardware : // PoC.html history.pushState'', '', '/'...

Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting

Exploit Title: Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting Exploit Author: Metin Yunus Kandemir kandemir Vendor Homepage: https://snipeitapp.com/ Software Link: https://github.com/snipe/snipe-it/releases/tag/v4.7.5 Version: 4.7.5 Category: Webapps Tested on: Xamp...

Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting Exploit Author: Metin Yunus Kandemir kandemir Vendor Homepage: https://snipeitapp.com/ Software Link:...

Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting

Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting Exploit Title: Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting Exploit Author: Metin Yunus Kandemir kandemir Vendor Homepage: https://snipeitapp.com/ Software Link:...

Snipe-IT Open Source Asset Management 4.7.5 Cross Site Scripting

Exploit Title: Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting Exploit Author: Metin Yunus Kandemir kandemir Vendor Homepage: https://snipeitapp.com/ Software Link: https://github.com/snipe/snipe-it/releases/tag/v4.7.5 Version: 4.7.5 Category: Webapps Tested on: Xamp...

Cross-site Scripting(XSS)

Select2 as used in snipe/snipe-it is vulnerable to cross-site scripting XSS. Its rich selectlists are not sanitized when loading remote Ajax data, allowing remote attackers to inject arbitrary Javascript into a victim's browser through it...

Cross-Site Scripting (XSS)

snipe/snipe-it is vulnerable to cross-site scripting XSS. User input are not escaped before being displayed on a user's browser, allowing remote attackers to inject arbitrary Javascript into a victim's browser via logmeta values and user's last name in the API...

CVE-2016-10744

In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when HTML templates are used to display listbox data...