CVE-2022-3035 Cross-site Scripting (XSS) - Stored in snipe/snipe-it

Cross-site Scripting XSS - Stored in GitHub repository snipe/snipe-it prior to v6.0.11...

CVE-2022-3035

Cross-site Scripting XSS - Stored in GitHub repository snipe/snipe-it prior to v6.0.11...

CVE-2022-3035

CVE-2022-3035 is a Stored XSS vulnerability affecting Snipe-IT prior to version 6.0.11. Multiple sources (NVD/NVD-listed entry, OSV, Veracode, CVE list) consistently describe Cross-site Scripting in the web app, originating from insufficient escaping/input handling in the UI when processing user ...

Snipe-IT 跨站脚本漏洞

Snipe-IT is an open source IT asset/license management system. A cross-site scripting vulnerability exists in Snipe-IT versions prior to v6.0.11, which originates from a user with Super Administrator privileges being able to implement cross-site scripting via a Markdown Input field...

CVE-2022-3035: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting XSS - Stored in GitHub repository snipe/snipe-it prior to v6.0.11...

PT-2022-4504 · Snipe-It · Snipe-It

Name of the Vulnerable Software and Affected Versions: snipe-it versions prior to 6.0.11 Description: The issue is related to a Cross-site Scripting XSS - Stored vulnerability. It exists due to inadequate protection of the web page structure, allowing a remote attacker to conduct an inter-site...

Session Fixation

snipe/snipe-it is vulnerable to session fixation. The vulnerability exists in passwordsave function in ProfileController.php due to not logging the user out of other devices when changing the password which allows the attacker to submit an old password session link to access the system...

Insufficient Session Expiration in snipe/snipe-it

Session Fixation in GitHub repository snipe/snipe-it prior to version 6.0.10. The session is not invalidated after a password change...

CVE-2022-2997

Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10...

CVE-2022-2997

Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10...

Session fixation

Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10...

CVE-2022-2997 Session Fixation in snipe/snipe-it

Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10...

CVE-2022-2997

Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10...

CVE-2022-2997

CVE-2022-2997 affects the Snipe-IT project (snipe/snipe-it) prior to 6.0.10. Root cause: a session-fixation issue where the session is not invalidated after a password change. Impact: could enable unauthorized access to user accounts if exploited. Remediation: upgrade to version 6.0.10 or later; ...

CVE-2022-2997 Session Fixation in snipe/snipe-it

Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10...

PT-2022-19934 · Snipe · Snipe-It

Name of the Vulnerable Software and Affected Versions: snipe/snipe-it versions prior to 6.0.10 Description: The issue concerns a session fixation problem where the session is not invalidated after a password change. This could potentially allow unauthorized access to user accounts. Recommendation...

CVE-2022-2997: Session Fixation

Session Fixation in GitHub repository snipe/snipe-it prior to 6.0.10...

Snipe-IT 授权问题漏洞

Session is a new type of encrypted private messenger open-sourced by Oxen. An authorization issue vulnerability exists in Snipe-IT versions prior to 6.0.10, which stems from the fact that sessions do not expire after a password change...

Session Fixation

Description The session is not invalidated after a password change. Proof of Concept Open Snipe-IT in the browser and login. Do the same in a private window such that there are two sessions. Change the password in one of the two sessions and observe that the second session is not invalidated...

Remote Code Execution

snipe/snipe-it is vulnerable to remote code execution. The vulnerability exists in the Select User function under the People Menu component which allows an attacker with admin privileges to inject remote code to a user via maliciously crafted pdf files...