1531 matches found
PT-2022-13842
Name of the Vulnerable Software and Affected Versions snipe/snipe-it versions prior to 5.4.3 Description The issue is related to a Stored Cross Site Scripting vulnerability in the Item name parameter. This vulnerability can lead to the theft of a user's Cookie. Recommendations For versions prior ...
snipe-it 跨站脚本漏洞
Snipe-IT is an open source IT asset/license management system. snipe-IT has a security vulnerability that can be exploited by attackers to steal user cookies...
Old sessions not blocked by login enable function in Snipe-IT
Snipe-IT is a FOSS project for asset management in IT Operations. In Snipe-IT versions 5.4.1 and 6.0.0-RC-5 and prior, active sessions are not revoked when a user account is disabled, allowing that user to still access information that they should no longer be able to. Workarounds include using t...
GHSA-636J-7X7R-GVW2 Old sessions not blocked by login enable function in Snipe-IT
Snipe-IT is a FOSS project for asset management in IT Operations. In Snipe-IT versions 5.4.1 and 6.0.0-RC-5 and prior, active sessions are not revoked when a user account is disabled, allowing that user to still access information that they should no longer be able to. Workarounds include using t...
CVE-2022-1155
Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10...
CVE-2022-1155
Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10...
Code injection
Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10...
CVE-2022-1155 Old sessions are not blocked by the login enable function. in snipe/snipe-it
Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10...
CVE-2022-1155 Old sessions are not blocked by the login enable function. in snipe/snipe-it
Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10...
CVE-2022-1155
Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10...
CVE-2022-1155
CVE-2022-1155 affects Snipe-IT, where the login enable function does not revoke/block old sessions in versions prior to 5.3.10. Exploitation could allow continuing access by existing sessions after a role/account change. Public details indicate fixes: 5.4.2 and 6.0.0-RC-6 (and later releases). Re...
PT-2022-13677
Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 5.3.10 Snipe-IT versions 5.4.1 and 6.0.0-RC-5 Description The issue arises from the fact that old sessions are not blocked by the login enable function, and active sessions are not revoked when a user account is...
CVE-2022-1155: Undefined Security Weakness
Old sessions are not blocked by the login enable function. in GitHub repository snipe/snipe-it prior to 5.3.10...
Snipe-IT 安全漏洞
Snipe-IT is an open source IT asset/license management system. A security vulnerability exists in Snipe-IT versions prior to 5.3.10, which stems from the login function not blocking old sessions...
Information Exposure
snipe/snipe-it is vulnerable to information exposure. The vulnerability exists in the sendResetLinkEmail function in the ForgotPasswordController.php file, allowing an attacker to read sensitive information in the system...
GHSA-PWWM-PWX2-2HW7 Generation of Error Message Containing Sensitive Information in Snipe-IT
Snipe-IT prior to version 5.3.11 is vulnerable to Generation of Error Message Containing Sensitive Information...
An unspecified vulnerability exists in snipe-it (CNVD-2022-13366)
Snipe-IT is an open source IT asset/license management system. snipe-it has a security vulnerability that stems from the generation of error messages containing sensitive information in Packagist snipe/snipe-it prior to 5.3.11. No detailed vulnerability details are currently available...
Privilege Escalation
snipe/snipe-it is vulnerable to privilege escalation. The vulnerability exists in AssetMaintenancesController.php and AssetMaintenancesController.php due to missing edit / delete Asset gates which allows an unauthenticated user to create maintenance for asset...