822 matches found
Snipe-IT 跨站脚本漏洞
Snipe-IT is an open source IT asset/license management system. Snipe-IT suffers from a cross-site scripting vulnerability that stems from the fact that the program is vulnerable to incorrect input during web page generation, which could be exploited by an attacker to execute arbitrary JavaScript...
Cross-site Scripting (XSS) - Stored in snipe/snipe-it
Description Multiple Stored XSS at parameter 'name' when creating a record at features 'Custom Fields', 'Asset Models', 'Suppliers', 'Locations', at Snipe-It 5.2.0 Proof of Concept // PoC.req POST /snipe-it/public/fields HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X...
in snipe/snipe-it
Description There is no rate limit sent unlimited email victim or any email address Proof of Concept There is no rate limit return-password , attacker to send unlimited email to victim or any email address. POST /password/email HTTP/1.1 Host: demo.snipeitapp.com Connection: close Content-Length: ...
Cross-Site Request Forgery (CSRF) in snipe/snipe-it
Description I found some low/medium level CSRFs on nice snipe-it application Proof of Concepts change the state of Requestable Assets : // PoC.html history.pushState'', '', '/' restore a hardware : // PoC.html history.pushState'', '', '/'...
Snipe-IT Open Source Asset Management 4.7.5 Cross Site Scripting
Exploit Title: Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting Exploit Author: Metin Yunus Kandemir kandemir Vendor Homepage: https://snipeitapp.com/ Software Link: https://github.com/snipe/snipe-it/releases/tag/v4.7.5 Version: 4.7.5 Category: Webapps Tested on: Xamp...
Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting
Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting Exploit Title: Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting Exploit Author: Metin Yunus Kandemir kandemir Vendor Homepage: https://snipeitapp.com/ Software Link:...
Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting
Exploit Title: Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting Exploit Author: Metin Yunus Kandemir kandemir Vendor Homepage: https://snipeitapp.com/ Software Link: https://github.com/snipe/snipe-it/releases/tag/v4.7.5 Version: 4.7.5 Category: Webapps Tested on: Xamp...
Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting Vulnerability
Exploit for php platform in category web applications Exploit Title: Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting Exploit Author: Metin Yunus Kandemir kandemir Vendor Homepage: https://snipeitapp.com/ Software Link:...
Cross-site Scripting(XSS)
Select2 as used in snipe/snipe-it is vulnerable to cross-site scripting XSS. Its rich selectlists are not sanitized when loading remote Ajax data, allowing remote attackers to inject arbitrary Javascript into a victim's browser through it...
Cross-Site Scripting (XSS)
snipe/snipe-it is vulnerable to cross-site scripting XSS. User input are not escaped before being displayed on a user's browser, allowing remote attackers to inject arbitrary Javascript into a victim's browser via logmeta values and user's last name in the API...
CVE-2016-10744
In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when HTML templates are used to display listbox data...
CVE-2019-10118
Snipe-IT before 4.6.14 has XSS, as demonstrated by logmeta values and the user's last name in the API...
CVE-2019-10118
Snipe-IT before 4.6.14 has XSS, as demonstrated by logmeta values and the user's last name in the API...
Cross site scripting
Snipe-IT before 4.6.14 has XSS, as demonstrated by logmeta values and the user's last name in the API...
CVE-2016-10744
In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when HTML templates are used to display listbox data...
Code injection
In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when HTML templates are used to display listbox data...
CVE-2016-10744
In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when HTML templates are used to display listbox data...
CVE-2016-10744
In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when HTML templates are used to display listbox data...
CVE-2016-10744
CVE-2016-10744 affects Select2 up to version 4.0.5 (as used by products like Snipe-IT). The vulnerability is a cross-site scripting (XSS) flaw in rich selectlists when Ajax remote data is loaded and HTML templates render listbox data. NVD lists CVSS v3.0 base score 6.1 (UI Required, Network vecto...