1531 matches found
CSV Injection in CSV files generated by the backend
Description Formula Elements are not sanitized before adding to CSV reports. This leads to CSV formula injection. Proof of Concept Steps to reproduce: 1. Log in to Snipe-IT & create a new Asset with arbitrary values. For the Asset Tag enter =1+1 Screenshot 1 2. Got to Reports - Custom Asset Repor...
Improper Authentication
snipe/snipe-it is vulnerable to improper authentication. A remote authenticated attacker is able to access unauthorized files through the viewKeys function as long as they have the View permission, which exposes confidential information required to create the API keys without the corresponding...
GHSA-FHVV-P968-6VVJ Snipe-IT vulnerable to Improper Authentication
Snipe-IT prior to 6.0.10 is vulnerable to Improper Authentication. A user without the View and Modify License Files permission may access files uploaded to licenses as long as they have the View permission for licenses...
Snipe-IT vulnerable to Improper Authentication
Snipe-IT prior to 6.0.10 is vulnerable to Improper Authentication. A user without the View and Modify License Files permission may access files uploaded to licenses as long as they have the View permission for licenses...
CVE-2022-3173
Improper Authentication in GitHub repository snipe/snipe-it prior to 6.0.10...
CVE-2022-3173
Improper Authentication in GitHub repository snipe/snipe-it prior to 6.0.10...
Authentication flaw
Improper Authentication in GitHub repository snipe/snipe-it prior to 6.0.10...
CVE-2022-3173
Improper Authentication in GitHub repository snipe/snipe-it prior to 6.0.10...
CVE-2022-3173 Improper Authentication in snipe/snipe-it
Improper Authentication in GitHub repository snipe/snipe-it prior to 6.0.10...
CVE-2022-3173
CVE-2022-3173 affects Snipe-IT prior to 6.0.10. The issue is improper authentication/authorization, allowing a user with only limited license-view permissions to access files uploaded to licenses and, per sources, to create API keys despite lacking permission. Documents indicate a remote authenti...
Snipe-IT 授权问题漏洞
Snipe-IT is an open source IT asset/license management system. An authorization issue vulnerability exists in Snipe-IT versions prior to 6.0.10 that stems from incorrect authentication...
CVE-2022-3173: Improper Authentication
Improper Authentication in GitHub repository snipe/snipe-it prior to 6.0.10...
PT-2022-20898
Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 6.0.10 Description The issue concerns improper authentication in the Snipe-IT repository. A user without the View and Modify License Files permission may still access files uploaded to licenses if they have the View...
Cross-Site Scripting (XSS)
snipe/snipe-it is vulnerable to cross-site scripting. The vulnerability exists in views/dashboard.blade.php and login.blade.php because the user inputs are not properly escaped which allows a remote attacker to inject and execute malicious code into the system...
snipe-it vulnerable to cross-site scripting (XSS)
Cross-site Scripting XSS - Stored in GitHub repository snipe/snipe-it prior to v6.0.11...
GHSA-RFF2-VQM3-JPV5 snipe-it vulnerable to cross-site scripting (XSS)
Cross-site Scripting XSS - Stored in GitHub repository snipe/snipe-it prior to v6.0.11...
The vulnerability of the IT asset management system snipe-it arises from the lack of measures taken to protect the website structure. This vulnerability allows attackers to carry out XSS attacks.
The vulnerability of the IT asset management system snipe-it exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...
CVE-2022-3035
Cross-site Scripting XSS - Stored in GitHub repository snipe/snipe-it prior to v6.0.11...