Snipe-IT 跨站请求伪造漏洞

Snipe-IT is an open source IT asset/license management system. snipe-it is vulnerable to cross-site request forgery, which could be exploited by attackers to obtain sensitive information...

Snipe-IT 跨站脚本漏洞

Snipe-IT is an open source IT asset/license management system. snipe-IT has a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data in the WEB application, which can be exploited by attackers to execute client-side code...

CVE-2021-3863: Improper Neutralization of Input During Web Page Generation

snipe-it is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

CVE-2021-3858: Cross-Site Request Forgery (CSRF)

snipe-it is vulnerable to Cross-Site Request Forgery CSRF...

PT-2021-22254

Name of the Vulnerable Software and Affected Versions snipe-it affected versions not specified Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This means that the software fails to properly neutralize user input,...

Cross-site Scripting (XSS) - Stored in snipe/snipe-it

Description Multiple Stored XSS at parameter 'name' when creating a record at features 'Custom Fields', 'Asset Models', 'Suppliers', 'Locations', at Snipe-It 5.2.0 Proof of Concept // PoC.req POST /snipe-it/public/fields HTTP/1.1 Host: 127.0.0.1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X...

in snipe/snipe-it

Description There is no rate limit sent unlimited email victim or any email address Proof of Concept There is no rate limit return-password , attacker to send unlimited email to victim or any email address. POST /password/email HTTP/1.1 Host: demo.snipeitapp.com Connection: close Content-Length: ...

Cross-Site Request Forgery (CSRF) in snipe/snipe-it

Description I found some low/medium level CSRFs on nice snipe-it application Proof of Concepts change the state of Requestable Assets : // PoC.html history.pushState'', '', '/' restore a hardware : // PoC.html history.pushState'', '', '/'...

Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title: Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting Exploit Author: Metin Yunus Kandemir kandemir Vendor Homepage: https://snipeitapp.com/ Software Link:...

Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting

Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting Exploit Title: Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting Exploit Author: Metin Yunus Kandemir kandemir Vendor Homepage: https://snipeitapp.com/ Software Link:...

Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting

Exploit Title: Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting Exploit Author: Metin Yunus Kandemir kandemir Vendor Homepage: https://snipeitapp.com/ Software Link: https://github.com/snipe/snipe-it/releases/tag/v4.7.5 Version: 4.7.5 Category: Webapps Tested on: Xamp...

Snipe-IT Open Source Asset Management 4.7.5 Cross Site Scripting

Exploit Title: Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting Exploit Author: Metin Yunus Kandemir kandemir Vendor Homepage: https://snipeitapp.com/ Software Link: https://github.com/snipe/snipe-it/releases/tag/v4.7.5 Version: 4.7.5 Category: Webapps Tested on: Xamp...

Cross-site Scripting(XSS)

Select2 as used in snipe/snipe-it is vulnerable to cross-site scripting XSS. Its rich selectlists are not sanitized when loading remote Ajax data, allowing remote attackers to inject arbitrary Javascript into a victim's browser through it...

Cross-Site Scripting (XSS)

snipe/snipe-it is vulnerable to cross-site scripting XSS. User input are not escaped before being displayed on a user's browser, allowing remote attackers to inject arbitrary Javascript into a victim's browser via logmeta values and user's last name in the API...

CVE-2016-10744

In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when HTML templates are used to display listbox data...

CVE-2019-10118

Snipe-IT before 4.6.14 has XSS, as demonstrated by logmeta values and the user's last name in the API...

CVE-2019-10118

Snipe-IT before 4.6.14 has XSS, as demonstrated by logmeta values and the user's last name in the API...

Cross site scripting

Snipe-IT before 4.6.14 has XSS, as demonstrated by logmeta values and the user's last name in the API...

Code injection

In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when HTML templates are used to display listbox data...

CVE-2016-10744

In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when HTML templates are used to display listbox data...