1531 matches found
snipe-it 跨站脚本漏洞
Snipe-IT is an open source IT asset/license management system. snipe-it suffers from a cross-site scripting vulnerability, which stems from vulnerability to incorrect input during web page generation. No detailed vulnerability details are currently available...
CVE-2021-4108: Improper Neutralization of Input During Web Page Generation
snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...
Snipe-IT Access Control Error Vulnerability
Snipe-IT is an open source IT asset/license management system. snipe-it is vulnerable to an access control error, and no details of the vulnerability are currently available...
Insecure Access Control
snipe/snipe-it is vulnerable to improper access control. The vulnerability exists because it does not perform sufficient user permissions, allowing users to view model information via clone endpoint...
Cross-site Scripting (XSS) - Stored in snipe/snipe-it
Description Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a differen...
Server-Side Request Forgery in snipe/snipe-it
Admin users on the external network can perform blind POST-based SSRF issue requests on behalf of the server into the internal network via the Slack Integration. This vulnerability is capable of port-scanning of the internal network, issue POST requests to web servers on the internal network whic...
GHSA-553Q-HPVP-Q8PC Server-Side Request Forgery in snipe/snipe-it
Admin users on the external network can perform blind POST-based SSRF issue requests on behalf of the server into the internal network via the Slack Integration. This vulnerability is capable of port-scanning of the internal network, issue POST requests to web servers on the internal network whic...
CVE-2021-4089
snipe-it is vulnerable to Improper Access Control...
CVE-2021-4089
snipe-it is vulnerable to Improper Access Control...
CVE-2021-4089
snipe-it is vulnerable to Improper Access Control...
Improper access control
snipe-it is vulnerable to Improper Access Control...
CVE-2021-4089
snipe-it is vulnerable to Improper Access Control...
CVE-2021-4089
Snipe-IT is affected by an Improper Access Control vulnerability (CVE-2021-4089) affecting versions prior to 5.3.4. The issue arises because regular users with DENY to all models permissions can still view model data via the /models/{id}/clone endpoint due to missing authorize('view') checks. Imp...
CVE-2021-4089 Improper Access Control in snipe/snipe-it
snipe-it is vulnerable to Improper Access Control...
PT-2021-23007 · Snipe-It · Snipe-It
Name of the Vulnerable Software and Affected Versions: snipe-it versions prior to 5.3.4 Description: The issue is related to Improper Access Control. Regular users with DENY set to all models permissions can still view model information via the "/models/id/clone" endpoint due to no authorize'view...
CVE-2021-4089: Improper Access Control
snipe-it is vulnerable to Improper Access Control...
Snipe-IT 访问控制错误漏洞
Snipe-IT is an open source IT asset/license management system. snipe-it is vulnerable to an access control error, and no details of the vulnerability are currently available...
Improper Access Control in snipe/snipe-it
Description Regular users with DENY set to all models permissions can still view model information via the /models/id/clone endpoint due to no authorize'view' permission being set. Proof of Concept 1: Create regular user and set DENY to all permissions in asset models. 2: Login as the user 3:...
Snipe-IT code issue vulnerability
Snipe-IT is an open source IT asset/license management system. snipe-IT is vulnerable to a code issue that could be exploited by attackers to conduct server-side request forgery SSRF attacks...